0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

13.2K

Stars

TypeScript

Language

1.1M

Lines of Code

6.1K

Files

667

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 460 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.4/100 · LOW

Are imports declared and package/API names verified? 175 finding(s).

Agent Over-Engineering Ratio 1.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 233 finding(s).

PR Review Velocity Impact 4.0/100 · LOW

Which changes need focused human review? 667 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 12HIGH 2MEDIUM 48LOW 605

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 667 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers201 hits · 204 pts

Severity	File	Line	Snippet	Context
LOW	docker/cube/cube.js	6	function assertRequiredEnvironmentVariable(name) {	CODE
LOW	docker/cube/cube.js	67	function collectTimeDimensionMembers(timeDimensions) {	CODE
LOW	docker/cube/cube.js	115	function assertValidSecurityContext(securityContext) {	CODE
LOW	docker/cube/cube.js	139	function assertNoCallerTenantMember(query) {	CODE
LOW	docker/cube/cube.js	171	function logCubeQuerySecurityContextFailure(query, error) {	CODE
LOW	docker/cube/cube.js	216	function normalizeCaseInsensitiveFilter(filter) {	CODE
LOW	docker/cube/cube.js	246	function normalizeCaseInsensitiveFilters(filters) {	CODE
LOW	charts/formbricks/cube/cube.js	6	function assertRequiredEnvironmentVariable(name) {	CODE
LOW	charts/formbricks/cube/cube.js	67	function collectTimeDimensionMembers(timeDimensions) {	CODE
LOW	charts/formbricks/cube/cube.js	115	function assertValidSecurityContext(securityContext) {	CODE
LOW	charts/formbricks/cube/cube.js	139	function assertNoCallerTenantMember(query) {	CODE
LOW	charts/formbricks/cube/cube.js	171	function logCubeQuerySecurityContextFailure(query, error) {	CODE
LOW	charts/formbricks/cube/cube.js	216	function normalizeCaseInsensitiveFilter(filter) {	CODE
LOW	charts/formbricks/cube/cube.js	246	function normalizeCaseInsensitiveFilters(filters) {	CODE
LOW	…0119123112_migrate_legacy_validation_to_rules/utils.ts	110	export function migrateFileUploadExtensions(element: SurveyElement): void {	CODE
LOW	…n/20260401000001_promote_dev_environments/migration.ts	294	async function deleteRemainingDevEnvironments(tx: TxClient): Promise<void> {	CODE
LOW	…260204174943_migrate_storage_urls_to_relative/utils.ts	13	export function convertStorageUrlToRelative(url: string): string {	CODE
LOW	…260204174943_migrate_storage_urls_to_relative/utils.ts	80	export function containsAbsoluteStorageUrl(obj: unknown): boolean {	CODE
LOW	…es/survey-ui/src/components/elements/single-select.tsx	179	function SingleSelectDropdownVariant({	CODE
LOW	…es/survey-ui/src/components/elements/single-select.tsx	385	function getOptionContainerClassName(isSelected: boolean, disabled: boolean): string {	CODE
LOW	packages/i18n-utils/src/scan-translations.ts	315	function checkIncompleteTranslations(	CODE
LOW	packages/i18n-utils/src/scan-translations.ts	559	async function loadDefaultLocaleWithValues(	CODE
LOW	…/components/elements/multiple-choice-multi-element.tsx	24	export function MultipleChoiceMultiElement({	CODE
LOW	…components/elements/multiple-choice-single-element.tsx	24	export function MultipleChoiceSingleElement({	CODE
LOW	packages/surveys/src/lib/language-display-name.ts	269	export function getShortLanguageDisplayName(code: string): string {	CODE
LOW	…ages/email/emails/auth/password-reset-notify-email.tsx	28	export default function PasswordResetNotifyEmailPreview(): React.JSX.Element {	CODE
LOW	packages/email/emails/auth/new-email-verification.tsx	38	export default function NewEmailVerificationPreview(): React.JSX.Element {	CODE
LOW	packages/email/emails/auth/delete-account-email.tsx	41	export default function DeleteAccountEmailPreview(): React.JSX.Element {	CODE
LOW	packages/email/emails/auth/forgot-password-email.tsx	40	export default function ForgotPasswordEmailPreview(): React.JSX.Element {	CODE
LOW	packages/email/emails/auth/sso-sign-in-hint-email.tsx	64	export default function SsoSignInHintEmailPreview(): React.JSX.Element {	CODE
LOW	…ail/emails/auth/sso-recovery-factors-removed-email.tsx	32	export function SsoRecoveryFactorsRemovedEmail({	CODE
LOW	…ail/emails/auth/sso-recovery-factors-removed-email.tsx	79	export default function SsoRecoveryFactorsRemovedEmailPreview(): React.JSX.Element {	CODE
LOW	…l/emails/general/email-customization-preview-email.tsx	14	export function EmailCustomizationPreviewEmail({	CODE
LOW	…l/emails/general/email-customization-preview-email.tsx	30	export default function EmailCustomizationPreviewEmailPreview(): React.JSX.Element {	CODE
LOW	…ail/emails/retention/survey-retention-notice-email.tsx	42	export function SurveyRetentionNoticeEmail({	CODE
LOW	…ail/emails/retention/survey-retention-notice-email.tsx	105	export default function SurveyRetentionNoticeEmailPreview(): React.JSX.Element {	CODE
LOW	…ail/emails/retention/member-retention-notice-email.tsx	23	export function MemberRetentionNoticeEmail({	CODE
LOW	…ail/emails/retention/member-retention-notice-email.tsx	45	export default function MemberRetentionNoticeEmailPreview(): React.JSX.Element {	CODE
LOW	packages/email/emails/invite/invite-accepted-email.tsx	32	export default function InviteAcceptedEmailPreview(): React.JSX.Element {	CODE
LOW	…ges/email/emails/survey/embed-survey-preview-email.tsx	40	export default function EmbedSurveyPreviewEmailPreview(): React.JSX.Element {	CODE
LOW	…ckages/email/emails/survey/response-finished-email.tsx	197	export default function ResponseFinishedEmailPreview(): React.JSX.Element {	CODE
LOW⚡	packages/email/src/lib/render.ts	38	export async function renderForgotPasswordEmail(	CODE
LOW⚡	packages/email/src/lib/render.ts	48	export async function renderAccountDeletionEmail(	CODE
LOW⚡	packages/email/src/lib/render.ts	58	export async function renderNewEmailVerification(	CODE
LOW⚡	packages/email/src/lib/render.ts	67	export async function renderPasswordResetNotifyEmail(	CODE
LOW⚡	packages/email/src/lib/render.ts	73	export async function renderSsoRecoveryFactorsRemovedEmail(	CODE
LOW	packages/email/src/lib/render.ts	95	export async function renderSurveyRetentionNoticeEmail(	CODE
LOW	packages/email/src/lib/render.ts	107	export async function renderMemberRetentionNoticeEmail(	CODE
LOW	packages/email/src/lib/render.ts	129	export async function renderInviteAcceptedEmail(	CODE
LOW	packages/email/src/lib/render.ts	150	export async function renderEmbedSurveyPreviewEmail(	CODE
LOW	packages/email/src/lib/render.ts	161	export async function renderResponseFinishedEmail(	CODE
LOW	packages/email/src/lib/render.ts	167	export async function renderEmailCustomizationPreviewEmail(	CODE
LOW	…/app/api/v1/management/responses/[responseId]/route.ts	25	async function fetchAndAuthorizeResponse(	CODE
LOW	…/web/app/api/internal/retention-runs/lib/operations.ts	14	export async function listRetentionRunsOperation({	CODE
LOW	…p/api/internal/retention-runs/export/lib/operations.ts	35	export async function exportRetentionRunsOperation({	CODE
LOW	apps/web/app/api/internal/charts/lib/operations.ts	190	export async function listInternalMatrixQuestions({	CODE
LOW	…pp/api/internal/retention-exemptions/lib/operations.ts	51	export async function listRetentionExemptionsOperation({	CODE
LOW	…pp/api/internal/retention-exemptions/lib/operations.ts	102	export async function getRetentionExemptionOperation({	CODE
LOW	…pp/api/internal/retention-exemptions/lib/operations.ts	145	export async function createRetentionExemptionOperation({	CODE
LOW	…pp/api/internal/retention-exemptions/lib/operations.ts	223	export async function revokeRetentionExemptionOperation({	CODE
141 more matches not shown…

Over-Commented Block197 hits · 195 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.dev.yml	1	# Google credentials for the Hub's Vertex enrichment providers (the google-gemini provider) are read	COMMENT
LOW	docker-compose.dev.yml	21	# A YAML merge key (<<:) only works on mappings, and volumes is a sequence, so this is a plain	COMMENT
LOW	docker-compose.dev.yml	261	EMBEDDING_GOOGLE_CLOUD_PROJECT: ${EMBEDDING_GOOGLE_CLOUD_PROJECT:-}	COMMENT
LOW	playwright.config.ts	81	// {	COMMENT
LOW	playwright.config.ts	101	// {	COMMENT
LOW	.coderabbit.yaml	1	# CodeRabbit configuration — see https://docs.coderabbit.ai/reference/configuration	COMMENT
LOW	.coderabbit.yaml	61	# reports everything else as "excluded by none and included by none". That is what the	COMMENT
LOW	pnpm-workspace.yaml	21	# workspaces. Packages reference these as `"typescript": "catalog:"` and never as a	COMMENT
LOW	pnpm-workspace.yaml	121	# Security overrides for transitive dependencies that still fail audit without a pin.	COMMENT
LOW	pnpm-workspace.yaml	141	# Pin every affected instrumentation, including nested Sentry copies, to its first patched release.	COMMENT
LOW	pnpm-workspace.yaml	161	# DoS via a long hyphen-separated language tag.	COMMENT
LOW	pnpm-workspace.yaml	181	# The 7.x line no longer needs a pin: @grpc/proto-loader and the older otlp-transformer lines resolve	COMMENT
LOW	pnpm-workspace.yaml	201	# `parseFromString(xml)` without a mimeType, which every 0.9 release throws on, so on 0.9 jackson can neither	COMMENT
LOW	pnpm-workspace.yaml	221	# load-bearing: pino-pretty resolves 4.0.2.	COMMENT
LOW	pnpm-workspace.yaml	241	# GHSA-p98j-92pf-mc4p / GHSA-6688-9rhm-gjv2: IN_PLACE sanitization leaves executable removed roots.	COMMENT
LOW	pnpm-workspace.yaml	261	ip-address@10: 10.7.5	COMMENT
LOW	pnpm-workspace.yaml	281	esbuild: 0.28.1 # ENG-1327 / GHSA-g7r4-m6w7-qqqr (>=0.27.3 <0.28.1). load-bearing: vite@7/tsx/storybook resolve 0.27.7	COMMENT
LOW	pnpm-workspace.yaml	301	# from 4.3.1 to 4.3.2 (still <5).	COMMENT
LOW	pnpm-workspace.yaml	321	# redirect cache findings; patched in 6.29.1 and 7.30.1.	COMMENT
LOW	pnpm-workspace.yaml	341	"@opentelemetry/propagator-jaeger": 2.9.0	COMMENT
LOW	pnpm-workspace.yaml	361	# attacker-chosen host (or an injected CRLF).	COMMENT
LOW	pnpm-workspace.yaml	381	# of two consumers, both of which declare a 7.x dependency — verified safe: @prisma/config only	COMMENT
LOW	pnpm-workspace.yaml	401	# load-bearing: prisma resolves 3.15.3 (dev-only Prisma CLI, mysql adapter) and better-auth /	COMMENT
LOW	pnpm-workspace.yaml	421	# the parse -> stringify round-trip throws an uncaught `TypeError`. Both patched in 6.16.0.	COMMENT
LOW	pnpm-workspace.yaml	441	# (compressed_size=0xFFFFFFFF) but omits the required ZIP64 extra field; the out-of-bounds read that	COMMENT
LOW	pnpm-workspace.yaml	461	# can throw an uncaught exception and crash the process (DoS). Patched in 6.6.10, the lowest fix.	COMMENT
LOW	pnpm-workspace.yaml	481	brace-expansion@1: 1.1.21	COMMENT
LOW	pnpm-workspace.yaml	501	# resource server must answer. (An earlier note here claimed 1.7 drops `verifyOptions.audience`	COMMENT
LOW	pnpm-workspace.yaml	521	# 3 days (4320 minutes) ago, so compromised releases are usually detected/yanked before we	COMMENT
LOW	pnpm-workspace.yaml	541	patchedDependencies:	COMMENT
LOW	docker/docker-compose.yml	81		COMMENT
LOW	docker/docker-compose.yml	101		COMMENT
LOW	docker/docker-compose.yml	121	# INVITE_RATE_LIMIT_PER_24_HOURS: 50	COMMENT
LOW	docker/docker-compose.yml	141	# Set S3 Storage configuration (required for the file upload in serverless environments)	COMMENT
LOW	docker/docker-compose.yml	161	# RECAPTCHA_SECRET_KEY:	COMMENT
LOW	docker/docker-compose.yml	181	# OIDC_SIGNING_ALGORITHM:	COMMENT
LOW	docker/docker-compose.yml	201	# SLACK_CLIENT_ID:	COMMENT
LOW	docker/docker-compose.yml	221	# RATE_LIMITING_DISABLED: 1	COMMENT
LOW	docker/docker-compose.yml	241	# Set the below to get the ip address of the user from the request headers	COMMENT
LOW	docker/cube-image/.trivyignore.yaml	1	# Findings the Trivy gate in .github/workflows/cube-image.yml accepts. Each entry needs a one-line	COMMENT
LOW	docker/cube-image/smoke-test.sh	1	#!/usr/bin/env bash	COMMENT
LOW	docker/cube/schema/FeedbackRecords.js	361	// The regex accepts both a jsonb number (rendered '42' / '42.5' by ->>) and the string form;	COMMENT
LOW	charts/formbricks/values.yaml	1	# Override the name for the application.	COMMENT
LOW	charts/formbricks/values.yaml	21	# Optional: Public URL for surveys (defaults to webappUrl if not set)	COMMENT
LOW	charts/formbricks/values.yaml	81	# rollingUpdate:	COMMENT
LOW	charts/formbricks/values.yaml	121	envFrom:	COMMENT
LOW	charts/formbricks/values.yaml	601	# Setting both will cause a helm install/upgrade failure.	COMMENT
LOW	charts/formbricks/values.yaml	621	# maxUnavailable: 1	COMMENT
LOW	charts/formbricks/values.yaml	681	# migrationAcknowledged=true only after that preparation has completed successfully.	COMMENT
LOW	charts/formbricks/values.yaml	741	# dedicated `spicedb` role and database. It needs CREATEROLE and CREATEDB,	COMMENT
LOW	charts/formbricks/values.yaml	1201	# The app secret still needs HUB_API_KEY as well because the web app talks to Hub directly.	COMMENT
LOW	charts/formbricks/cube/schema/FeedbackRecords.js	361	// The regex accepts both a jsonb number (rendered '42' / '42.5' by ->>) and the string form;	COMMENT
LOW	charts/formbricks/tests/authzed-bootstrap-runtime.sh	1	#!/usr/bin/env bash	COMMENT
LOW	authzed/schema-validation.yaml	1	# Validation suite for the canonical Formbricks authorization schema.	COMMENT
LOW	authzed/schema-validation.yaml	21	# api_key_writer api_key:org_writer_key (accessControl.write)	COMMENT
LOW	authzed/schema-validation.yaml	161	# ------------------------------------------------------------------	COMMENT
LOW	authzed/schema-validation.yaml	201	- response:r1#export_v2@user:uma	COMMENT
LOW	docs/api-v3-reference/redocly.yaml	1	# Lint configuration for the v3 OpenAPI source tree (used by `pnpm api:v3:lint` via scripts/bundle.mjs).	COMMENT
LOW	docs/api-v3-reference/contract-tests/schemathesis.toml	1	# Schemathesis configuration for the v3 API contract tests (ENG-2191).	COMMENT
LOW	docs/api-v3-reference/contract-tests/schemathesis.toml	21	# which reads as a green run that proves nothing. `fill-missing` generates the	COMMENT
137 more matches not shown…

Fake / Example Data160 hits · 164 pts

Severity	File	Line	Snippet	Context
LOW	docker/README.md	219	TAXONOMY_LLM_API_KEY=<api-key-or-dummy-value>	CODE
LOW	docs/api-reference/openapi.json	536	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	4539	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	4627	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	4810	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5003	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5091	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5328	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5416	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5640	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5728	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5902	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5990	"placeholder": {	CODE
LOW	packages/database/zod/users.ts	41	example: "John Doe",	CODE
LOW	packages/types/common.test.ts	67	expect(ZEndingCardButtonLink.safeParse("mailto:a@example.com,b@example.org").success).toBe(true);	CODE
LOW	packages/types/surveys/validation.ts	112	placeholder: "placeholder",	CODE
LOW	packages/types/surveys/elements-validation.ts	34	placeholder: "placeholder",	CODE
LOW	packages/types/surveys/types.ts	1198	const initialFieldsToValidate = ["buttonLabel", "upperLabel", "lowerLabel", "label", "placeholder"];	CODE
LOW	packages/types/surveys/types.ts	1238	"placeholder",	CODE
LOW	packages/types/surveys/types.ts	1625	"placeholder",	CODE
LOW	…urvey-ui/src/components/elements/open-text.stories.tsx	195	value: "John Doe",	CODE
LOW	packages/workflows/src/types/content.test.ts	65	const filled = { to: "user@example.com", subject: "Hello", body: "<p>Hi</p>" };	CODE
LOW	…s/src/types/__fixtures__/workflow-definition.full.json	95	"right": "@example.org"	CODE
LOW	packages/surveys/src/lib/response.test.ts	43	expect(processResponseData({ name: "John Doe", age: "30" })).toBe("name: John Doe\nage: 30");	CODE
LOW	packages/surveys/src/lib/response.test.ts	45	expect(processResponseData({ age: "30", name: "John Doe" })).toBe("age: 30\nname: John Doe");	CODE
LOW	packages/surveys/src/lib/recall.test.ts	26	name: "John Doe",	CODE
LOW	packages/surveys/src/lib/recall.test.ts	152	name: "John Doe",	CODE
LOW	packages/surveys/src/lib/validation/evaluator.test.ts	751	const result = validateElementResponse(element, ["123 Main St", "", "NY", "", "", ""], "en");	CODE
LOW	packages/surveys/src/lib/validation/evaluator.test.ts	772	const result = validateElementResponse(element, ["123 Main St", "", "New York", "", "", ""], "en");	CODE
LOW	packages/surveys/src/lib/validation/evaluator.ts	63	if (fieldConfig && "placeholder" in fieldConfig) {	CODE
LOW	packages/surveys/src/lib/validation/evaluator.ts	70	if (fieldConfig && "placeholder" in fieldConfig) {	CODE
LOW	packages/email/src/lib/example-data.ts	75	inviterName: "John Doe",	CODE
LOW	packages/email/src/lib/example-data.ts	80	inviterName: "John Doe",	CODE
LOW	packages/js-core/src/lib/user/tests/attribute.test.ts	6	name: "John Doe",	CODE
LOW	…es/js-core/src/lib/user/tests/__mocks__/update.mock.ts	5	name: "John Doe",	CODE
LOW	…core/src/lib/user/tests/__mocks__/update-queue.mock.ts	4	name: "John Doe",	CODE
LOW	apps/web/locales/zh-Hans-CN.json	464	"placeholder": "占位符",	CODE
LOW	apps/web/locales/zh-Hans-CN.json	4874	"placeholder": "<!-- 在此粘贴你的跟踪脚本 -->\n<script>\n // Google Tag Manager、Analytics 等\n</script>",	CODE
LOW	apps/web/locales/zh-Hant-TW.json	464	"placeholder": "提示文字",	CODE
LOW	apps/web/locales/zh-Hant-TW.json	4874	"placeholder": "<!-- 請在此貼上您的追蹤腳本 -->\n<script>\n // Google Tag Manager、Analytics 等\n</script>",	CODE
LOW	apps/web/locales/es-ES.json	464	"placeholder": "Marcador de posición",	CODE
LOW	apps/web/locales/es-ES.json	4874	"placeholder": "<!-- Pega tus scripts de seguimiento aquí -->\n<script>\n // Google Tag Manager, Analytics, e	CODE
LOW	apps/web/locales/ja-JP.json	464	"placeholder": "プレースホルダー",	CODE
LOW	apps/web/locales/ja-JP.json	4874	"placeholder": "<!-- トラッキングスクリプトをここに貼り付けてください -->\n<script>\n // Google Tag Manager、Analyticsなど\n</script>",	CODE
LOW	apps/web/locales/tr-TR.json	464	"placeholder": "Yer tutucu",	CODE
LOW	apps/web/locales/tr-TR.json	4874	"placeholder": "<!-- İzleme betiklerinizi buraya yapıştırın -->\n<script>\n // Google Tag Manager, Analytics,	CODE
LOW	apps/web/locales/hu-HU.json	464	"placeholder": "Helykitöltő",	CODE
LOW	apps/web/locales/hu-HU.json	4874	"placeholder": "<!-- Ide illessze be a követő parancsfájlokat -->\n<script>\n // Google Tag Manager, Analytic	CODE
LOW	apps/web/locales/pt-PT.json	464	"placeholder": "Espaço reservado",	CODE
LOW	apps/web/locales/pt-PT.json	4874	"placeholder": "<!-- Cole os seus scripts de rastreamento aqui -->\n<script>\n // Google Tag Manager, Analyti	CODE
LOW	apps/web/locales/sv-SE.json	464	"placeholder": "Platshållare",	CODE
LOW	apps/web/locales/sv-SE.json	4874	"placeholder": "<!-- Klistra in dina spårningsskript här -->\n<script>\n // Google Tag Manager, Analytics, et	CODE
LOW	apps/web/locales/ro-RO.json	464	"placeholder": "Marcaj substituent",	CODE
LOW	apps/web/locales/ro-RO.json	4874	"placeholder": "<!-- Lipește aici scripturile tale de tracking -->\n<script>\n // Google Tag Manager, Analyti	CODE
LOW	apps/web/locales/pt-BR.json	464	"placeholder": "Espaço reservado",	CODE
LOW	apps/web/locales/pt-BR.json	4874	"placeholder": "<!-- Cole seus scripts de rastreamento aqui -->\n<script>\n // Google Tag Manager, Analytics,	CODE
LOW	apps/web/locales/de-DE.json	464	"placeholder": "Platzhalter",	CODE
LOW	apps/web/locales/de-DE.json	4874	"placeholder": "<!-- Füge hier deine Tracking-Skripte ein -->\n<script>\n // Google Tag Manager, Analytics, e	CODE
LOW	apps/web/locales/fr-FR.json	464	"placeholder": "Remplaçant",	CODE
LOW	apps/web/locales/fr-FR.json	4874	"placeholder": "<!-- Collez vos scripts de suivi ici -->\n<script>\n // Google Tag Manager, Analytics, etc.\n	CODE
100 more matches not shown…

Hallucination Indicators12 hits · 120 pts

Severity	File	Line	Snippet	Context
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	177	if (!workload.spec.template.spec.containers.some((c) => c.image === dependency.image))	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	229	!surge.spec.template.spec.containers.some(	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	310	!workload.spec.template.spec.containers.some((c) => c.image === expected.image)	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	346	workload.spec.template.spec.containers.some(	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	361	workload.spec.template.spec.containers.some(	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	413	!previous.spec.template.spec.containers.some((c) => c.image === this.config.targetImage)	CODE
CRITICAL	apps/web/lib/upgrade/online/kubernetes.ts	530	!existing.spec.template.spec.containers.some((c) => c.image === this.config.targetImage)	CODE
CRITICAL	apps/web/lib/response/tests/response.test.ts	204	const findUniqueCall = prisma.response.findUnique.mock.calls.at(-1)?.[0];	CODE
CRITICAL	apps/web/lib/survey/service.test.ts	1431	const created = prisma.survey.create.mock.results.at(-1)?.value;	CODE
CRITICAL	apps/web/modules/ee/data-retention/sweep/run.test.ts	388	expect(tx.retentionRun.update.mock.calls.map((call) => call[0].data)).toEqual([	CODE
CRITICAL	apps/web/modules/storage/utils.test.ts	1189	expect(result.level1.level2.level3.level4.level5.imageUrl.startsWith("http")).toBe(true);	CODE
CRITICAL	apps/web/modules/storage/utils.test.ts	1205	expect(result.level1.level2.level3.sibling.startsWith("http")).toBe(true);	CODE

Decorative Section Separators32 hits · 111 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/cube/schema/FeedbackRecords.js	297	// ── Response context (ENG-1554 metadata) ──────────────────────────────────	COMMENT
MEDIUM	docker/cube/schema/FeedbackRecords.js	397	// ── Hub enrichment fields ─────────────────────────────────────────────────	COMMENT
MEDIUM	docker/cube/schema/FeedbackRecords.js	500	// ── Normalized (LOWER+TRIM) companions ────────────────────────────────────	COMMENT
MEDIUM	charts/formbricks/cube/schema/FeedbackRecords.js	297	// ── Response context (ENG-1554 metadata) ──────────────────────────────────	COMMENT
MEDIUM	charts/formbricks/cube/schema/FeedbackRecords.js	397	// ── Hub enrichment fields ─────────────────────────────────────────────────	COMMENT
MEDIUM	charts/formbricks/cube/schema/FeedbackRecords.js	500	// ── Normalized (LOWER+TRIM) companions ────────────────────────────────────	COMMENT
MEDIUM	authzed/schema-validation.yaml	114	# ------------------------------------------------------------------	COMMENT
MEDIUM	authzed/schema-validation.yaml	120	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	161	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	165	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	169	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	174	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	190	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	195	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	203	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	207	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	212	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	authzed/schema-validation.yaml	217	# ------------------------------------------------------------------	COMMENT
MEDIUM	packages/types/analysis.ts	3	// ── Cube.js Query shape (stored as JSON in Chart.query) ─────────────────────	COMMENT
MEDIUM	packages/types/analysis.ts	54	// ── Chart visualization config (stored as JSON in Chart.config) ─────────────	COMMENT
MEDIUM	packages/types/analysis.ts	87	// ── Widget grid layout (stored as JSON in DashboardWidget.layout) ───────────	COMMENT
MEDIUM	apps/web/lib/utils/action-client/index.test.ts	72	// ── shared helper tests (pure logic, no action client needed) ──────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/types/analysis.ts	9	// ── Chart as the app renders it ──────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/types/analysis.ts	32	// ── Widget as the app renders it ─────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/types/analysis.ts	43	// ── Charts UI (query execution, AI response) ─────────────────────────────────	COMMENT
MEDIUM	…/web/modules/ee/analysis/charts/lib/option-grouping.ts	15	// ── Option-id resolution helpers ──────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/matrix-pivot.ts	38	// ── Query shape ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/matrix-pivot.ts	55	// ── The recipe for a matrix question ──────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/matrix-pivot.ts	101	// ── Pivot ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/matrix-pivot.ts	271	// ── Display helpers ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/chart-utils.ts	365	// ── Flipped (horizontal) bar chart axis sizing ────────────────────────────────	COMMENT
MEDIUM	apps/web/modules/ee/analysis/charts/lib/chart-utils.ts	422	// ── Wrapped axis label sizing ─────────────────────────────────────────────────	COMMENT

Verbosity Indicators18 hits · 33 pts

Severity	File	Line	Snippet	Context
LOW	docker/formbricks.sh	1153	# Step 1: Add Traefik labels to formbricks service	COMMENT
LOW	docker/formbricks.sh	1224	# Step 2: Ensure formbricks waits for rustfs-init to complete successfully (mapping depends_on)	COMMENT
LOW	docker/formbricks.sh	1256	# Step 3: Build service snippets and inject them BEFORE the volumes section (non-destructive: skip if service exists)	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	8	// Step 1: Get all existing API keys with related data	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	23	// Step 2: Migrate each API key to the new format	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	48	// Step 3: Create new API key in the ApiKeyNew table and its environment relation	COMMENT
LOW⚡	apps/web/app/api/v1/management/me/route.ts	74	// Step 1: Fast SHA-256 lookup by indexed lookupHash	COMMENT
LOW⚡	apps/web/app/api/v1/management/me/route.ts	82	// Step 2: Security verification with bcrypt	COMMENT
LOW⚡	…/modules/organization/settings/api-keys/lib/api-key.ts	84	// Step 1: Fast SHA-256 lookup by indexed lookupHash	COMMENT
LOW⚡	…/modules/organization/settings/api-keys/lib/api-key.ts	91	// Step 2: Security verification with bcrypt	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	621	// Step 2: Extract metadata from CSV data	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	624	// Step 3: Fetch existing data from database	COMMENT
LOW	apps/web/modules/ee/contacts/lib/contacts.ts	646	// Step 3: Build lookup maps	COMMENT
LOW	apps/web/modules/ee/contacts/lib/contacts.ts	662	// Step 4: Detect and validate attribute types	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	673	// Step 5: Create missing attribute keys	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	682	// Step 6: Process each CSV record	COMMENT
LOW	…les/ee/contacts/segments/components/segment-filter.tsx	237	// when the operator changes, we need to check if the value is valid	COMMENT
LOW	…les/ee/contacts/segments/components/segment-filter.tsx	478	// when the operator changes, we need to check if the value is valid	COMMENT

AI Slop Vocabulary11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/authzed-smoke.sh	576	# this harness never runs that scope, so the edge is never reported as an orphan.	COMMENT
MEDIUM	.github/workflows/api-v3-contract-tests.yml	74	# this landed do not contain the harness. Detect it and skip instead of failing every open PR —	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	3	# Runs the Better Auth integration harness (apps/web/integration + the *.integration.test.ts files)	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	10	# apps/web holds the auth code under test; packages/** because the harness transitively imports	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	78	# Branches that predate the Better Auth cutover (#8384) don't contain the integration harness,	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	80	# the base branch) and dangerous-git-checkout checks out the PR head. Detect whether the harness	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	118	# The harness exercises enterprise-gated flows (e.g. SSO provisioning) by calling the functions	COMMENT
MEDIUM	.github/workflows/integration-tests.yml	180	# Shared with apps/web/integration/global-setup.ts (the local harness applies the same file) so	COMMENT
MEDIUM	apps/web/playwright/survey-styling.spec.ts	361	// The selector needs to be robust.	COMMENT
MEDIUM	apps/web/playwright/api/auth/security.spec.ts	215	// Calculate statistics using median (more robust to outliers)	COMMENT
MEDIUM	apps/web/playwright/api/auth/security.spec.ts	263	// Note: This uses MEDIAN-based comparison (more robust to outliers than mean)	COMMENT

Structural Annotation Overuse16 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	docker/formbricks.sh	1153	# Step 1: Add Traefik labels to formbricks service	COMMENT
LOW	docker/formbricks.sh	1224	# Step 2: Ensure formbricks waits for rustfs-init to complete successfully (mapping depends_on)	COMMENT
LOW	docker/formbricks.sh	1256	# Step 3: Build service snippets and inject them BEFORE the volumes section (non-destructive: skip if service exists)	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	8	// Step 1: Get all existing API keys with related data	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	23	// Step 2: Migrate each API key to the new format	COMMENT
LOW	…50326111101_move_api_keys_to_api_keys_new/migration.ts	48	// Step 3: Create new API key in the ApiKeyNew table and its environment relation	COMMENT
LOW⚡	apps/web/app/api/v1/management/me/route.ts	74	// Step 1: Fast SHA-256 lookup by indexed lookupHash	COMMENT
LOW⚡	apps/web/app/api/v1/management/me/route.ts	82	// Step 2: Security verification with bcrypt	COMMENT
LOW⚡	…/modules/organization/settings/api-keys/lib/api-key.ts	84	// Step 1: Fast SHA-256 lookup by indexed lookupHash	COMMENT
LOW⚡	…/modules/organization/settings/api-keys/lib/api-key.ts	91	// Step 2: Security verification with bcrypt	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	621	// Step 2: Extract metadata from CSV data	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	624	// Step 3: Fetch existing data from database	COMMENT
LOW	apps/web/modules/ee/contacts/lib/contacts.ts	646	// Step 3: Build lookup maps	COMMENT
LOW	apps/web/modules/ee/contacts/lib/contacts.ts	662	// Step 4: Detect and validate attribute types	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	673	// Step 5: Create missing attribute keys	COMMENT
LOW⚡	apps/web/modules/ee/contacts/lib/contacts.ts	682	// Step 6: Process each CSV record	COMMENT

Redundant / Tautological Comments11 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	docker/docker-compose.yml	15	# Set this to your public-facing URL, e.g., example http://localhost:3000 or https://example.com	COMMENT
LOW	docker/migrate-to-v4.sh	693	# Check if service exists	COMMENT
LOW	docker/migrate-to-v4.sh	705	# Check if dependency is already present in the service depends_on section	COMMENT
LOW	docker/migrate-to-v4.sh	1038	# Check if this is a container-based uploads directory	COMMENT
LOW	docker/migrate-to-v4.sh	1156	# Check if we're in the right directory	COMMENT
LOW	docker/migrate-to-v4.sh	1173	# Check if MinIO is already configured unless migrating only	COMMENT
LOW	docker/migrate-to-v4.sh	1469	# Check if script is being run directly	COMMENT
LOW	charts/formbricks/values.yaml	680	# Set this to false only when an operator performs the same guarded cutover externally, and set	COMMENT
LOW	.github/workflows/docker-build-validation.yml	717	# Check if container is still running	COMMENT
LOW	.github/actions/resolve-docker-version/action.yml	188	# Output results	COMMENT
LOW	apps/web/scripts/docker/next-start.sh	53	# Check if migrations should be skipped (e.g., when using Helm migration job)	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/migrate-to-v4.sh	1065	# Create a temporary container to handle the migration	COMMENT
MEDIUM	charts/formbricks/templates/service.yaml	23	# Define the service type (ClusterIP, NodePort, LoadBalancer)	COMMENT
MEDIUM	charts/formbricks/templates/service.yaml	38	# Define the exposed service ports	COMMENT
MEDIUM	charts/formbricks/templates/serviceaccount.yaml	6	# Define the ServiceAccount name, either from values or generated	COMMENT

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	packages/surveys/README.md	67	LINGO_API_KEY=<YOUR_API_KEY>	CODE
HIGH	packages/surveys/README.md	67	LINGO_API_KEY=<YOUR_API_KEY>	CODE

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	pnpm-workspace.yaml	498	# the verified `aud` against its own allow-list (ENG-2339). That is not leftover scaffolding from this	COMMENT

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	docs/api-v3-reference/contract-tests/hooks.py	22		CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	docs/api-v3-reference/contract-tests/hooks.py	93		CODE

formbricks/formbricks

Open-Source Code Quality, Security and Technical Debt Review