gadievron/raptor

43.7

Adjusted Score

43.7

Raw Score

100%

Time Factor

2026-08-02

Last Push

3.5K

Stars

Python

Language

1.2M

Lines of Code

3.1K

Files

33.9K

Pattern Hits

2026-08-02

Scan Date

0.07

HC Hit Rate

What These Metrics Mean

Adjusted Score: Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score: The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor: The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits: Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate: High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files: Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 14HIGH 195MEDIUM 7764LOW 25892

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 33865 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators7406 hits · 27134 pts

Severity	File	Line	Snippet	Context
MEDIUM	conftest.py	74	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	conftest.py	76	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	conftest.py	95	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	conftest.py	97	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	raptor_agentic.py	2300	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2302	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2531	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2533	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2595	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2597	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2605	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	2607	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2484	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2486	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2747	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2749	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2802	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2806	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2834	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2836	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2925	# ========================================================================	COMMENT
MEDIUM	raptor_agentic.py	2927	# ========================================================================	COMMENT
MEDIUM⚡	raptor_agentic.py	1792	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1794	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1797	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1799	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1813	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1819	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1906	# ========================================================================	STRING
MEDIUM⚡	raptor_agentic.py	1914	# ========================================================================	STRING
MEDIUM	raptor_agentic.py	1722	# ========================================================================	STRING
MEDIUM	raptor_agentic.py	1724	# ========================================================================	STRING
MEDIUM⚡	raptor_fuzzing.py	587	# ========================================================================	STRING
MEDIUM⚡	raptor_fuzzing.py	589	# ========================================================================	STRING
MEDIUM⚡	raptor_fuzzing.py	832	# ========================================================================	STRING
MEDIUM⚡	raptor_fuzzing.py	834	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	302	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	304	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	407	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	409	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	516	# ========================================================================	STRING
MEDIUM	raptor_fuzzing.py	518	# ========================================================================	STRING
MEDIUM	core/dataflow/known_safe_calls.py	54	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	56	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	81	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	83	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	129	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	131	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	144	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	146	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	169	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	171	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	200	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	202	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	220	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/known_safe_calls.py	222	# ------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/smt_barrier.py	74	# --------------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/smt_barrier.py	81	# --------------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/smt_barrier.py	101	# --------------------------------------------------------------------------	COMMENT
MEDIUM	core/dataflow/smt_barrier.py	103	# --------------------------------------------------------------------------	COMMENT
7346 more matches not shown…

Hyper-Verbose Identifiers18513 hits · 17732 pts

Severity	File	Line	Snippet	Context
LOW	conftest.py	109	def pytest_collection_modifyitems(items):	CODE
LOW	raptor.py	92	def _extract_and_strip_max_cost_usd(args: list) -> tuple[float \| None, list]:	CODE
LOW	raptor.py	189	def _extract_agentic_log_level(args: list) -> str \| None:	CODE
LOW⚡	raptor_agentic.py	610	def _prepare_fuzz_crashes_for_validate(	CODE
LOW⚡	raptor_agentic.py	3530	def _build_threat_model_report_section(summary):	CODE
LOW	raptor_agentic.py	41	def _materialise_threat_model_phase(	CODE
LOW	raptor_agentic.py	262	def _write_threat_model_candidate_sarif(context_map: dict, sarif_path: Path) -> int:	CODE
LOW	raptor_agentic.py	360	def _print_threat_model_phase(summary: dict) -> None:	CODE
LOW	raptor_agentic.py	692	def _candidate_replay_binaries(binary_path: Path) -> list[str]:	CODE
LOW	raptor_agentic.py	825	def _crash_context_to_validate_finding(context, replay: list[dict] \| None = None) -> dict:	CODE
LOW	raptor_agentic.py	864	def _run_fuzz_validation_smoke(findings_path: Path, target: Path, out_dir: Path) -> dict:	CODE
LOW	raptor_agentic.py	932	def _build_fuzz_phase_summary(fuzzing_result: dict \| None, fuzz_out: Path \| None) -> dict:	CODE
LOW	raptor_agentic.py	985	def _build_completion_manifest(orch_meta, import_result, import_sarif_files,	CODE
LOW	raptor_agentic.py	3573	def _build_aggregation_report_section(aggregation):	CODE
LOW	raptor_agentic.py	3635	def _build_dataflow_validation_report_section(dv):	CODE
LOW	core/dataflow/evidence_collector.py	39	def collect_sanitizer_evidence(	CODE
LOW	core/dataflow/evidence_collector.py	96	def _describe_pool_completeness(*, file_count: int, truncated: bool) -> str:	CODE
LOW	core/dataflow/smt_barrier.py	371	def _try_charset_sub_validator(line: str, offset: int) -> Optional[ValidatorSpec]:	CODE
LOW	core/dataflow/smt_barrier.py	571	def _line_in_try_body_with_catching_handler(	CODE
LOW	core/dataflow/smt_barrier.py	614	def _validator_block_exits_on_failure(	CODE
LOW	core/dataflow/smt_barrier.py	679	def _variable_reassigned_between(	CODE
LOW	core/dataflow/smt_barrier.py	1001	def _lexical_validator_dominates(	CODE
LOW	core/dataflow/smt_barrier.py	1089	def _crosses_function_boundary(	CODE
LOW	core/dataflow/smt_barrier.py	1126	def _python_chain_reaches_sink(	CODE
LOW	core/dataflow/smt_barrier.py	1184	def substitution_dominates_sink(	CODE
LOW	core/dataflow/smt_barrier.py	1236	def _lexical_substitution_dominates(	CODE
LOW	core/dataflow/evidence_renderer.py	33	def render_evidence_for_prompt(evidence: SanitizerEvidence) -> str:	CODE
LOW	core/dataflow/barrier_synth.py	468	def _summarise_surviving_finding(	CODE
LOW	core/dataflow/owasp_corpus_generator.py	84	def _rewrite_finding_paths_and_snippets(	CODE
LOW⚡	core/dataflow/sanitizer_catalog.py	176	def sanitizer_callables_for_cwe(	CODE
LOW	core/dataflow/structural_validator.py	260	def _identify_sanitizer_calls(	CODE
LOW	core/dataflow/structural_validator.py	284	def _extract_branch_guards_from_content(	CODE
LOW	core/dataflow/codeql_augmented_run.py	180	def run_baseline_and_augmented(	CODE
LOW	core/dataflow/cvefix_walk.py	217	def _toolchain_readable_paths(codeql_bin: str) -> list:	CODE
LOW	core/dataflow/tier1_llm.py	163	def _mechanical_recheck_charset_kind(	CODE
LOW	core/dataflow/tier1_llm.py	186	def _find_best_validator_line(	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	28	def test_all_fixtures_resolve_to_records(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	34	def test_validator_fixture_lexical_suppresses(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	39	def test_sanitizer_cut_safe_value_bound_suppresses(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	47	def test_helper_fixture_inter_proc_suppresses(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	52	def test_wrong_variable_not_suppressed(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	59	def test_complementary_coverage_fails_removal_gate(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	69	def test_no_bug_hidden_by_either_method(self):	CODE
LOW⚡	core/dataflow/tests/test_sanitizer_cut_parity_report.py	74	def test_report_renders_and_states_gate_no(self):	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	54	def test_analyze_builds_expected_cli(tmp_path: Path):	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	172	def test_default_timeout_is_reasonable_for_a_real_codeql_run():	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	183	def test_analyze_raises_codeqlrunerror_on_non_zero_exit(tmp_path: Path):	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	191	def test_analyze_trims_very_long_stderr_in_error_message(tmp_path: Path):	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	216	def test_analyze_rejects_empty_queries(tmp_path: Path):	CODE
LOW⚡	core/dataflow/tests/test_codeql_augmented_run.py	228	def test_baseline_and_augmented_runs_twice(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	73	def test_analyze_omits_additional_packs_when_no_extension(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	84	def test_analyze_adds_additional_packs_when_extension_supplied(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	102	def test_analyze_creates_output_parent_dir(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	110	def test_analyze_returns_analysis_result(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	128	def test_analyze_forwards_extra_args(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	143	def test_analyze_uses_custom_codeql_binary_path(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	155	def test_analyze_passes_timeout_to_runner(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	202	def test_analyze_raises_on_timeout(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	242	def test_baseline_first_call_has_no_extension_pack(tmp_path: Path):	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	255	def test_augmented_second_call_has_extension_pack(tmp_path: Path):	CODE
18453 more matches not shown…

Unused Imports2801 hits · 2482 pts

Severity	File	Line	Context
LOW	raptor.py	61	CODE
LOW	core/dataflow/validator.py	14	CODE
LOW	core/dataflow/known_safe_calls.py	18	CODE
LOW	core/dataflow/finding.py	18	CODE
LOW	core/dataflow/run_corpus.py	13	CODE
LOW	core/dataflow/smt_barrier.py	61	CODE
LOW	core/dataflow/barrier_synth.py	22	CODE
LOW	core/dataflow/finding_diff.py	19	CODE
LOW	core/dataflow/corpus_metrics.py	12	CODE
LOW	core/dataflow/cvefix_bridge.py	24	CODE
LOW	core/dataflow/sanitizer_cut_parity_report.py	29	CODE
LOW	core/dataflow/trust_corpus_report.py	31	CODE
LOW	core/dataflow/ghsa_harvester.py	23	CODE
LOW	core/dataflow/owasp_corpus_generator.py	22	CODE
LOW	core/dataflow/cvefix_corpus_generator.py	34	CODE
LOW	core/dataflow/cvefix_corpus_generator.py	49	CODE
LOW	core/dataflow/cvefix_pipeline.py	18	CODE
LOW	core/dataflow/__init__.py	16	CODE
LOW	core/dataflow/__init__.py	16	CODE
LOW	core/dataflow/__init__.py	16	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/__init__.py	17	CODE
LOW	core/dataflow/sanitizer_evidence.py	37	CODE
LOW	core/dataflow/trust_report.py	18	CODE
LOW	core/dataflow/cvefix_loader.py	19	CODE
LOW	core/dataflow/sanitizer_catalog.py	27	CODE
LOW	core/dataflow/structural_validator.py	18	CODE
LOW	core/dataflow/llm_bridge.py	25	CODE
LOW	core/dataflow/codeql_augmented_run.py	34	CODE
LOW	core/dataflow/label.py	15	CODE
LOW	core/dataflow/llm_extractor.py	22	CODE
LOW	core/dataflow/cvefix_walk.py	20	CODE
LOW	core/dataflow/sanitizer_cut_config.py	39	CODE
LOW	core/dataflow/tier1_llm.py	39	CODE
LOW	core/dataflow/path_annotator.py	37	CODE
LOW	core/dataflow/sanitizer_cut_parity.py	33	CODE
LOW	core/dataflow/tests/test_sanitizer_cut_parity_report.py	2	CODE
LOW	core/dataflow/tests/test_codeql_augmented_run.py	8	CODE
LOW	core/dataflow/tests/test_sanitizer_catalog.py	21	CODE
LOW	core/dataflow/tests/test_trust_corpus_report.py	3	CODE
LOW	core/dataflow/tests/test_barrier_synth.py	3	CODE
LOW	core/dataflow/tests/test_barrier_synth.py	457	CODE
LOW	core/dataflow/tests/test_lexical_removal_switch.py	24	CODE
LOW	core/dataflow/tests/test_label.py	3	CODE
LOW	core/dataflow/tests/test_finding.py	3	CODE
LOW	core/dataflow/tests/test_structural_validator.py	3	CODE
LOW	core/dataflow/tests/test_adapters_codeql.py	3	CODE
LOW	core/dataflow/tests/test_tier1_llm.py	8	CODE
LOW	core/dataflow/tests/test_llm_bridge.py	3	CODE
LOW	core/dataflow/tests/test_sanitizer_cut_config.py	7	CODE
LOW	core/dataflow/tests/test_smt_barrier.py	10	CODE
2741 more matches not shown…

Excessive Try-Catch Wrapping1353 hits · 1219 pts

Severity	File	Line	Snippet	Context
LOW⚡	raptor.py	502	except Exception as e:	CODE
LOW⚡	raptor.py	520	except Exception as e:	CODE
LOW	raptor.py	161	except Exception: # noqa: BLE001	CODE
LOW	raptor.py	183	except Exception: # noqa: BLE001	CODE
LOW	raptor.py	280	except Exception as e:	CODE
LOW	raptor.py	430	except Exception as e:	CODE
LOW	raptor.py	444	except Exception: # noqa: BLE001	CODE
LOW	raptor.py	576	except Exception as exc:	CODE
LOW	raptor.py	668	except Exception:	CODE
LOW	raptor.py	673	except Exception as e:	CODE
LOW	raptor.py	779	except Exception as e:	CODE
LOW	raptor.py	816	except Exception as exc:	CODE
LOW	raptor.py	1291	except Exception as e:	CODE
LOW⚡	raptor_agentic.py	600	except Exception as e:	CODE
LOW⚡	raptor_agentic.py	605	except Exception:	CODE
LOW⚡	raptor_agentic.py	2527	except Exception as e:	CODE
LOW⚡	raptor_agentic.py	3517	except Exception as e:	CODE
LOW⚡	raptor_agentic.py	3526	except Exception as e:	CODE
LOW	raptor_agentic.py	99	except Exception as e:	CODE
LOW	raptor_agentic.py	128	except Exception:	CODE
LOW	raptor_agentic.py	173	except Exception as e:	CODE
LOW	raptor_agentic.py	200	except Exception as e:	CODE
LOW	raptor_agentic.py	208	except Exception as e:	CODE
LOW	raptor_agentic.py	439	except Exception as exc:	CODE
LOW	raptor_agentic.py	453	except Exception: # noqa: BLE001	CODE
LOW	raptor_agentic.py	457	except Exception: # noqa: BLE001	CODE
LOW	raptor_agentic.py	478	except Exception as exc:	CODE
LOW	raptor_agentic.py	885	except Exception as e:	CODE
LOW	raptor_agentic.py	1942	except Exception: # noqa: BLE001	CODE
LOW	raptor_agentic.py	1973	except Exception: # noqa: BLE001	CODE
LOW	raptor_agentic.py	2162	except Exception as e:	CODE
LOW	raptor_agentic.py	2337	except Exception as e:	CODE
LOW	raptor_agentic.py	2382	except Exception:	CODE
LOW	raptor_agentic.py	2387	except Exception as e:	CODE
LOW	raptor_agentic.py	3040	except Exception as e:	CODE
LOW	raptor_agentic.py	3042	except Exception as e:	CODE
LOW	raptor_agentic.py	3498	except Exception:	CODE
LOW⚡	raptor_agentic.py	1788	except Exception as e:	STRING
LOW⚡	raptor_agentic.py	1810	except Exception as e:	STRING
LOW⚡	raptor_agentic.py	1893	except Exception as e:	STRING
LOW⚡	raptor_agentic.py	1899	except Exception as e:	STRING
LOW⚡	raptor_agentic.py	1921	except Exception:	STRING
LOW	raptor_agentic.py	1583	except Exception:	STRING
LOW	raptor_agentic.py	1659	except Exception as e:	STRING
LOW	raptor_agentic.py	1686	except Exception as e:	STRING
LOW	raptor_agentic.py	1852	except Exception as e:	STRING
LOW⚡	raptor_fuzzing.py	576	except Exception:	STRING
LOW⚡	raptor_fuzzing.py	582	except Exception as e:	STRING
LOW⚡	raptor_fuzzing.py	825	except Exception as e:	STRING
LOW	raptor_fuzzing.py	223	except Exception as e:	STRING
LOW	raptor_fuzzing.py	252	except Exception as e:	STRING
LOW	raptor_fuzzing.py	318	except Exception as e:	STRING
LOW	raptor_fuzzing.py	328	except Exception as e:	STRING
LOW	raptor_fuzzing.py	364	except Exception as e:	STRING
LOW	raptor_fuzzing.py	424	except Exception as e:	STRING
LOW	raptor_fuzzing.py	623	except Exception as e: # noqa: BLE001 — best-effort	STRING
LOW	raptor_fuzzing.py	633	except Exception as e: # noqa: BLE001 — best-effort	STRING
LOW	raptor_codeql.py	53	except Exception as e:	CODE
LOW	raptor_codeql.py	63	except Exception as e:	CODE
LOW	raptor_codeql.py	232	except Exception as e:	CODE
1293 more matches not shown…

Cross-Language Confusion159 hits · 913 pts

Severity	File	Line	Snippet	Context
HIGH	raptor_fuzzing.py	208	"Allowlist matches ExploitValidator: address, undefined, "	STRING
HIGH	core/dataflow/tests/test_smt_barrier.py	643	" if (!/^[A-Za-z0-9]+$/.test(name)) return null;\n" # line 2	CODE
HIGH	core/dataflow/tests/test_smt_barrier.py	653	"+ if (!/^[A-Za-z0-9]+$/.test(name)) return null;\n"	CODE
HIGH	core/dataflow/scripts/handlabel_seed.py	308	rationale="@PathVariable userId (line 43) flows into UserProfile construction (line 51). The auth check on line	CODE
HIGH	core/sarif/parser.py	737	# finding can carry `{"snippet": null}` or `{"message": null}`	COMMENT
HIGH⚡	core/llm/tests/test_quota_detection.py	170	"'tokens', 'param': null, 'code': 'rate_limit_exceeded'}}"	CODE
HIGH	core/analysis/binary_oracle.py	1010	"address": null},	STRING
HIGH	core/analysis/cfg_builder_cpp.py	30	``a && escape(x)`` is independently attributable) is documented	STRING
HIGH	core/analysis/taint_multi_lang.py	85	_JAVA_NULL_CHECK = re.compile(r"if\s\(\s(\w+)\s(?:==\snull\|!=\s*null)")	CODE
HIGH	core/analysis/taint_multi_lang.py	91	r"if\s\(\s!?\s(\w+)\s(?:===?\s(?:null\|undefined)\|!==?\s(?:null\|undefined))"	CODE
HIGH	core/analysis/tests/test_lifecycle_field_discovery.py	187	lines[i] = "if (auth && permission && null && lock && bounds) init alloc free"	STRING
HIGH	core/analysis/tests/test_lifecycle_field_discovery.py	211	if (s->auth_level > 0 && s->token != NULL) {	CODE
HIGH	core/analysis/tests/test_taint_multi_lang.py	34	if (input == null) return;	CODE
HIGH	core/analysis/tests/test_taint_multi_lang.py	76	if (data === null) throw new Error("null");	CODE
HIGH⚡	core/analysis/tests/test_lifecycle_collector.py	25	cond = _extract_condition_from_label("If (task->mm && task->flags & PF_EXITING)")	CODE
HIGH⚡	core/analysis/tests/test_lifecycle_collector.py	26	assert cond == "task->mm && task->flags & PF_EXITING"	CODE
HIGH⚡	core/analysis/tests/test_lifecycle_checker.py	55	assert _normalize_condition(" a && b ") == "a && b"	CODE
HIGH	core/smt_solver/canonicalise.py	95	# identifiers like `a.equals(b)` (`.` and `(` are	COMMENT
HIGH⚡	core/smt_solver/session.py	97	solver.push()	CODE
HIGH⚡	core/smt_solver/session.py	99	raise RuntimeError(f"scoped: solver.push() failed: {e}") from e	CODE
HIGH⚡	core/config/tests/test_config.py	137	# to a safe sentinel (/dev/null) so git ignores ~/.gitconfig and	COMMENT
HIGH⚡	core/security/tests/test_prompt_envelope.py	517	slots={"code": TaintedString(value="a < b && c > d", trust="untrusted")},	CODE
HIGH	core/security/tests/test_prompt_envelope.py	616	code = "if (a < b && c > d) { x = a < 10; }"	CODE
HIGH⚡	core/security/tests/test_adversarial_robustness.py	356	payload = "if (a < b && c > d) { vector<int> v; }"	CODE
HIGH	core/dockerfile/apt.py	17	* ``RUN apt-get update && apt-get install -y pkg`` (chained)	STRING
HIGH	core/dockerfile/apt.py	164	commands whether they're standalone (``a && b``) or fused	STRING
HIGH⚡	core/dockerfile/tests/test_parser.py	23	RUN apt-get update && apt-get install -y curl	CODE
HIGH⚡	core/dockerfile/tests/test_apt.py	74	"RUN apt-get update && apt-get install -y curl wget\n"	CODE
HIGH⚡	core/dockerfile/tests/test_apt.py	92	"RUN apt-get install -y maybe-this \|\| apt-get install -y fallback\n"	CODE
HIGH⚡	core/dockerfile/tests/test_apt.py	136	"RUN apt-get update && apt-get install -y --no-install-recommends \\\n"	CODE
HIGH⚡	core/dockerfile/tests/test_apt.py	516	'"apt-get update && apt-get install -y curl"\n'	CODE
HIGH⚡	core/dockerfile/tests/test_apt.py	70	"""The standard ``apt-get update && apt-get install -y ...``	STRING
HIGH⚡	core/dockerfile/tests/test_apt.py	131	``RUN apt-get update && apt-get install -y --no-install-recommends \\``	STRING
HIGH	core/audit/frida_observe.py	302	var addrs = Module.findExportByName(null, name);	CODE
HIGH	core/audit/frida_observe.py	307	if (exp) matches.push(exp);	CODE
HIGH	core/audit/frida_observe.py	322	argv.push(args[i].toString());	CODE
HIGH	core/audit/frida_observe.py	324	argv.push('?');	CODE
HIGH	core/audit/frida_observe.py	339	'retval': retval.toString(),	CODE
HIGH	core/audit/condition_smt.py	337	solver.push()	CODE
HIGH	core/audit/condition_smt.py	389	solver.push()	CODE
HIGH	core/audit/sentinel_collapse.py	392	rf"\b{re.escape(var_name)}\s!==?\s(?:null\|undefined)\b",	CODE
HIGH	core/audit/tests/test_path_feasibility.py	105	hyp = "assuming ptr is non-null, the dereference is safe"	CODE
HIGH	core/audit/tests/test_condition_binding.py	182	source = "void f() {\n if (is_admin && len < MAX)\n memcpy(dst, src, len);\n}"	CODE
HIGH⚡	core/audit/tests/test_llm_review.py	293	"When the allocation fails and returns null, the subsequent "	CODE
HIGH	core/audit/tests/test_condition_smt.py	161	"len < MAX_SIZE && len < LIMIT",	CODE
HIGH	core/audit/tests/test_condition_smt.py	177	"len < MAX_SIZE && len < MID",	CODE
HIGH⚡	core/audit/tests/test_value_space_checker.py	428	return true	CODE
HIGH⚡	core/audit/tests/test_value_space_checker.py	430	return false	CODE
HIGH⚡	core/audit/tests/test_value_space_checker.py	432	return false	CODE
HIGH	core/audit/tests/test_prefilter.py	238	if (idx < 0 \|\| idx >= len)	CODE
HIGH	core/audit/tests/test_prefilter.py	328	while (si < src_len && di < dst_cap) {	CODE
HIGH	core/audit/tests/test_prefilter.py	348	while (i < cap - 1 && src[i]) {	CODE
HIGH	core/audit/tests/test_prefilter.py	368	while (i < cap && src[i]) {	CODE
HIGH	core/audit/tests/test_fail_open_detector.py	294	results.push(port);	CODE
HIGH	core/audit/tests/test_fail_open_detector.py	316	results.push(port);	CODE
HIGH	core/audit/tests/test_sentinel_collapse.py	334	if (result !== null) {	CODE
HIGH⚡	core/audit/tests/test_ts_extract.py	65	return null;	CODE
HIGH⚡	core/audit/tests/test_ts_extract.py	69	return undefined;	CODE
HIGH	core/audit/tests/test_ts_extract.py	86	if (item == null) {	CODE
HIGH	core/audit/tests/test_ts_extract.py	87	return null;	CODE
99 more matches not shown…

Modern Structural Boilerplate888 hits · 895 pts

Severity	File	Line	Snippet	Context
LOW	core/__init__.py	83	__all__ = [	CODE
LOW	core/dataflow/sanitizer_cut_parity_report.py	225	__all__ = [	CODE
LOW	core/dataflow/cvefix_corpus_generator.py	53	logger = logging.getLogger(__name__)	CODE
LOW	core/dataflow/__init__.py	31	__all__ = [	CODE
LOW	core/dataflow/sanitizer_catalog.py	294	__all__ = [	CODE
LOW	core/dataflow/structural_validator.py	39	logger = logging.getLogger(__name__)	CODE
LOW	core/dataflow/llm_bridge.py	44	logger = logging.getLogger(__name__)	CODE
LOW	core/dataflow/sanitizer_cut_config.py	355	__all__ = [	CODE
LOW	core/dataflow/sanitizer_cut_parity.py	568	__all__ = [	CODE
LOW	core/reporting/witnesses.py	31	logger = logging.getLogger(__name__)	CODE
LOW	core/reporting/__init__.py	33	__all__ = [	CODE
LOW	core/reporting/scan_coverage.py	175	__all__ = [	CODE
LOW	core/staleness/__init__.py	37	__all__ = [	CODE
LOW	core/witness/store.py	36	logger = logging.getLogger(__name__)	CODE
LOW	core/witness/discovery.py	32	logger = logging.getLogger(__name__)	CODE
LOW	core/witness/__init__.py	46	__all__ = [	CODE
LOW	core/llm/prompt_budget.py	32	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/semantic_entropy.py	232	__all__ = ["divergence", "pairwise_distance"]	CODE
LOW	core/llm/egress.py	90	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/egress.py	284	__all__ = [	CODE
LOW	core/llm/cc_proxy_hosts.py	57	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/config.py	495	def set_operator_primary_override(model: Optional['ModelConfig']) -> None:	CODE
LOW	core/llm/log_quiet.py	68	__all__ = ["quiet_noisy_loggers"]	CODE
LOW	core/llm/task_types.py	83	__all__ = ["TaskType", "FAST_TIER_TASKS"]	CODE
LOW	core/llm/concurrency.py	22	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/__init__.py	36	__all__ = [	CODE
LOW	core/llm/coerce.py	80	__all__ = ["to_int_safe", "to_float_safe"]	CODE
LOW	core/llm/cost.py	67	__all__ = ["sanitize_cost", "sanitize_iterations"]	CODE
LOW	core/llm/bedrock_prefixes.py	54	__all__ = [	CODE
LOW	core/llm/throttle.py	43	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/cc_adapter.py	16	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/tool_use/__init__.py	42	__all__ = [	CODE
LOW	core/llm/tool_use/loop.py	166	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/dispatcher/__init__.py	37	__all__ = [	CODE
LOW	core/llm/multi_model/panel_log.py	209	__all__ = [	CODE
LOW	core/llm/multi_model/dispatch.py	61	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/multi_model/calibrated_aggregation.py	262	__all__ = [	CODE
LOW	core/llm/multi_model/__init__.py	38	__all__ = [	CODE
LOW	core/llm/multi_model/dawid_skene.py	377	__all__ = [	CODE
LOW	core/llm/cwe_strategies/__init__.py	52	__all__ = [	CODE
LOW	core/llm/scorecard/prefilter.py	144	__all__ = [	CODE
LOW	core/llm/scorecard/stage_roles.py	127	__all__ = [	CODE
LOW	core/llm/scorecard/stability.py	27	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/__init__.py	70	__all__ = [	CODE
LOW	core/llm/scorecard/self_consistency.py	27	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/scorecard.py	1219	__all__ = [	CODE
LOW	core/llm/scorecard/reasoning_divergence.py	58	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/reasoning_divergence.py	186	__all__ = [	CODE
LOW	core/llm/scorecard/dataflow_validation.py	20	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/consensus.py	47	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/consensus.py	203	__all__ = ["record_consensus_outcomes"]	CODE
LOW	core/llm/scorecard/cross_family.py	22	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/judge.py	39	logger = logging.getLogger(__name__)	CODE
LOW	core/llm/scorecard/judge.py	171	__all__ = ["record_judge_outcomes"]	CODE
LOW	core/llm/scorecard/priors.py	316	__all__ = [	CODE
LOW	core/llm/scorecard/tool_evidence.py	40	logger = logging.getLogger(__name__)	CODE
LOW⚡	core/llm/scorecard/tool_evidence.py	190	__all__ = [	CODE
LOW	core/analysis/reach_audit.py	30	logger = logging.getLogger(__name__)	CODE
LOW	core/analysis/reach_audit.py	48	def set_joern_server(server) -> None:	CODE
LOW	core/analysis/reach_audit.py	390	__all__ = ["AuditReport", "audit_corpus", "classify_reachability"]	CODE
828 more matches not shown…

Over-Commented Block1020 hits · 842 pts

Severity	File	Line	Snippet	Context
LOW	conftest.py	61	# ``from packages.Y.Z import W`` resolve during pytest collection.	COMMENT
LOW	conftest.py	81	# faulthandler_timeout (set in tests.yml) catches a hang; this catches	COMMENT
LOW	pytest.ini	1	[pytest]	COMMENT
LOW	requirements.txt	1	# RAPTOR Framework Requirements	COMMENT
LOW	requirements.txt	21	# (CVE-2025-69872 was the trigger; raptor doesn't use the cache	COMMENT
LOW	requirements.txt	41	# tree-sitter-c-sharp==0.23.5	COMMENT
LOW	requirements.txt	61	pyyaml==6.0.3	COMMENT
LOW	requirements.txt	81	# Optional: For SMT-based constraint analysis (one-gadget feasibility, etc.)	COMMENT
LOW	raptor.py	381	return 1 # extraction failed (message printed); no run sealed yet	COMMENT
LOW	raptor.py	461	# so CostTracker enforces the cap during LLM calls.	COMMENT
LOW	raptor.py	641	return proc.wait()	COMMENT
LOW	raptor.py	1061	# the subprocess writes to fd 1 directly — interleaving the	COMMENT
LOW	raptor_agentic.py	521	# Create threads to read stdout and stderr concurrently.	COMMENT
LOW	raptor_agentic.py	1561	# paths in the except handlers below, leaking raptor_git_*/ under	COMMENT
LOW	raptor_agentic.py	2041	"--out", str(out_dir / "scan"),	COMMENT
LOW	raptor_agentic.py	2081	# the operator's command needs shell semantics	COMMENT
LOW	raptor_agentic.py	2141	)	COMMENT
LOW	raptor_fuzzing.py	281	# configured project run dir. Subsequent /project status	COMMENT
LOW	requirements-dev.txt	21	gcovr==8.6	COMMENT
LOW	raptor_codeql.py	381	# /agentic + /fuzz: entry-point CLI flag mutates the named	COMMENT
LOW	raptor_codeql.py	401	from core.analysis.binary_oracle_cli import apply_to_config	COMMENT
LOW	core/dataflow/known_safe_calls.py	221	# C / C++ — Phase 11 entries	COMMENT
LOW	core/dataflow/smt_barrier.py	81	# --------------------------------------------------------------------------	COMMENT
LOW	core/dataflow/smt_barrier.py	141	counterexample: Optional[str] = None	COMMENT
LOW	core/dataflow/smt_barrier.py	161	# one) gives a one-char language which doesn't generalise to the	COMMENT
LOW	core/dataflow/smt_barrier.py	221	)	COMMENT
LOW	core/dataflow/smt_barrier.py	301	# If our literal-char extractor silently reads ``\W`` as chars	COMMENT
LOW	core/dataflow/smt_barrier.py	461	line = raw[1:]	COMMENT
LOW	core/dataflow/smt_barrier.py	481	# ``if``-check inspects the value without transforming it, so the	COMMENT
LOW	core/dataflow/smt_barrier.py	1021	# means the validator's exit-on-fail (the diff's guard-and-exit shape)	COMMENT
LOW	core/dataflow/barrier_synth.py	961	"ruby": _RB_SYSTEM_PROMPT,	COMMENT
LOW	core/dataflow/cvefix_bridge.py	101	_OTHER_DIFF_TOTAL_CAP = 500	COMMENT
LOW	core/dataflow/cvefix_bridge.py	141	"CREATE TABLE IF NOT EXISTS synth_results ("	COMMENT
LOW	core/dataflow/sanitizer_catalog.py	101		COMMENT
LOW	core/dataflow/cvefix_walk.py	41	"central.sonatype.com", "oss.sonatype.org", "maven.google.com", "dl.google.com",	COMMENT
LOW	core/schema_constants/__init__.py	161	"code_injection": "command_injection",	COMMENT
LOW	core/schema_constants/__init__.py	181	# CWE-190 (overflow) and CWE-191 (underflow) cover different	COMMENT
LOW	core/reporting/formatting.py	61	#	COMMENT
LOW	core/sarif/parser.py	221	"rules_by_id": {},	COMMENT
LOW	core/sarif/parser.py	381		COMMENT
LOW	core/sarif/parser.py	521	for result in results:	COMMENT
LOW	core/llm/detection.py	161	Returns True if litellm was found (migration handled here), False otherwise.	COMMENT
LOW	core/llm/detection.py	601	# (if it is, _check_litellm_installed already handled migration)	COMMENT
LOW	core/llm/detection.py	621	# the env signal here. Without dispatcher AND without botocore	COMMENT
LOW	core/llm/detection.py	641	# silently degrade ``--sequential`` runs to ClaudeCodeProvider /	COMMENT
LOW	core/llm/egress.py	221	allowlist = derive_allowlist(config)	COMMENT
LOW	core/llm/cc_proxy_hosts.py	401	return foundry	COMMENT
LOW	core/llm/config.py	241		COMMENT
LOW	core/llm/config.py	481	# so every downstream ``LLMConfig()`` no-arg construction honours the	COMMENT
LOW	core/llm/config.py	561	# explicit choice beats env-var defaults — if they configured	COMMENT
LOW	core/llm/config.py	1101	# or under this cap. None = no eviction (cache grows unboundedly).	COMMENT
LOW	core/llm/config.py	1121	# data keeps flowing in — drift detection via random sampling.	COMMENT
LOW	core/llm/log_quiet.py	21	called once from the dispatcher's ``start()`` so EVERY run path	COMMENT
LOW	core/llm/task_types.py	41		COMMENT
LOW	core/llm/client.py	61	# After this many consecutive cache write failures, auto-disable	COMMENT
LOW	core/llm/client.py	121	msg = re.sub(r'gh[oprsu]_[a-zA-Z0-9_]{36,}', '[REDACTED-API-KEY]', msg)	COMMENT
LOW	core/llm/client.py	141	# quote could close, with a lazy match in between, and	COMMENT
LOW	core/llm/client.py	461	# cost shows up as a concrete line.	COMMENT
LOW	core/llm/client.py	481	# CONCURRENT keys.	COMMENT
LOW	core/llm/client.py	681	# threads run the provider call concurrently for the	COMMENT
960 more matches not shown…

Deep Nesting1047 hits · 837 pts

Severity	File	Line	Context
LOW	raptor.py	322	CODE
LOW	raptor_agentic.py	41	CODE
LOW	raptor_agentic.py	399	CODE
LOW	raptor_agentic.py	713	CODE
LOW	raptor_agentic.py	1003	CODE
LOW	raptor_agentic.py	427	CODE
LOW	raptor_fuzzing.py	48	CODE
LOW	raptor_codeql.py	68	CODE
LOW	core/dataflow/smt_barrier.py	540	CODE
LOW	core/dataflow/smt_barrier.py	571	CODE
LOW	core/dataflow/smt_barrier.py	679	CODE
LOW	core/dataflow/smt_barrier.py	1295	CODE
LOW	core/dataflow/barrier_synth.py	440	CODE
LOW	core/dataflow/barrier_synth.py	565	CODE
LOW	core/dataflow/corpus_metrics.py	68	CODE
LOW	core/dataflow/cvefix_bridge.py	305	CODE
LOW	core/dataflow/cvefix_bridge.py	368	CODE
LOW	core/dataflow/trust_corpus_report.py	135	CODE
LOW	core/dataflow/trust_report.py	67	CODE
LOW	core/dataflow/sanitizer_catalog.py	232	CODE
LOW	core/dataflow/structural_validator.py	284	CODE
LOW	core/dataflow/structural_validator.py	333	CODE
LOW	core/dataflow/cvefix_walk.py	325	CODE
LOW	core/dataflow/tier1_llm.py	229	CODE
LOW	core/dataflow/tier1_llm.py	237	CODE
LOW	core/dataflow/sanitizer_cut_parity.py	364	CODE
LOW	core/schema_constants/tests/test_cwe_map_unique.py	25	CODE
LOW	core/reporting/findings.py	70	CODE
LOW	core/reporting/scan_coverage.py	51	CODE
LOW	core/sarif/parser.py	71	CODE
LOW	core/sarif/parser.py	187	CODE
LOW	core/sarif/parser.py	287	CODE
LOW	core/sarif/parser.py	665	CODE
LOW	core/witness/discovery.py	52	CODE
LOW	core/witness/discovery.py	116	CODE
LOW	core/llm/prompt_budget.py	112	CODE
LOW	core/llm/detection.py	158	CODE
LOW	core/llm/detection.py	245	CODE
LOW	core/llm/detection.py	512	CODE
LOW	core/llm/config.py	86	CODE
LOW	core/llm/client.py	293	CODE
LOW	core/llm/client.py	424	CODE
LOW	core/llm/client.py	661	CODE
LOW	core/llm/client.py	1266	CODE
LOW	core/llm/client.py	1589	CODE
LOW	core/llm/providers.py	713	CODE
LOW	core/llm/providers.py	934	CODE
LOW	core/llm/providers.py	1865	CODE
LOW	core/llm/providers.py	2692	CODE
LOW	core/llm/providers.py	353	CODE
LOW	core/llm/providers.py	494	CODE
LOW	core/llm/providers.py	649	CODE
LOW	core/llm/providers.py	1289	CODE
LOW	core/llm/providers.py	1598	CODE
LOW	core/llm/providers.py	2477	CODE
LOW	core/llm/providers.py	2890	CODE
LOW	core/llm/providers.py	3589	CODE
LOW	core/llm/response_validation.py	355	CODE
LOW	core/llm/throttle.py	186	CODE
LOW	core/llm/cc_adapter.py	175	CODE
987 more matches not shown…

Modern AI Meta-Vocabulary237 hits · 735 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	raptor.py	492	# /scan writes codeql_*.sarif at the top level; /agentic writes it	COMMENT
MEDIUM⚡	raptor.py	511	# Print a coverage summary at the end of /agentic (after complete_run,	COMMENT
MEDIUM⚡	raptor.py	513	# /scan and /validate print their own; this closes the agentic gap.	COMMENT
MEDIUM⚡	raptor.py	528	# Read by the subprocess mode handlers (codeql/agentic) to re-inject the	COMMENT
MEDIUM	raptor.py	408	# mode itself, or scan/agentic with ``--codeql`` /	COMMENT
MEDIUM	raptor.py	409	# ``--codeql-only``. Plain /agentic (no --codeql) doesn't reach	COMMENT
MEDIUM	raptor.py	655	# next /scan or /agentic invocation saw a stale	COMMENT
MEDIUM	raptor.py	854	# Enable CodeQL by default for comprehensive agentic mode	COMMENT
MEDIUM	raptor.py	868	# Re-inject --trust-repo stripped by main(): the agentic child parses it	COMMENT
MEDIUM	raptor.py	1159	# SUBPROCESS mode handlers (codeql/agentic) can't rely on that flag —	COMMENT
MEDIUM	raptor.py	1247	# ``agentic`` shouldn't force the operator to read the	COMMENT
MEDIUM	raptor_agentic.py	144	# concurrent writer (a second /agentic run, an operator	COMMENT
MEDIUM	raptor_agentic.py	2014	# this, `python raptor.py agentic --audit` would set audit mode in	COMMENT
MEDIUM	raptor_agentic.py	2015	# the agentic process but the actual sandbox-using subprocesses	COMMENT
MEDIUM	raptor_agentic.py	2145	# Surface the timeout in the agentic-run summary even when	COMMENT
MEDIUM	raptor_agentic.py	2253	# exited non-zero. Pre-fix the agentic wrapper threw away	COMMENT
MEDIUM	raptor_agentic.py	3054	# Build findings funnel from orchestration results	COMMENT
MEDIUM	raptor_agentic.py	3091	# Post-process orchestration results: compute CVSS, infer CWE, fix severity	COMMENT
MEDIUM⚡	raptor_agentic.py	1816	# bridge tier-2/3) AND enriches the agentic checklist with priority	STRING
MEDIUM⚡	raptor_agentic.py	1908	# Marks dead-code functions priority=low in the agentic checklist using	STRING
MEDIUM⚡	raptor_agentic.py	1910	# the agentic LLM analysis prompt reads priority/priority_reason and	STRING
MEDIUM	raptor_codeql.py	350	# pass per finding (filter + summarise), while agentic does the	STRING
MEDIUM	raptor_codeql.py	354	# ``--max-findings 20`` to agentic explicitly.	STRING
MEDIUM	raptor_codeql.py	381	# /agentic + /fuzz: entry-point CLI flag mutates the named	STRING
MEDIUM	core/dataflow/smt_barrier.py	910	# /agentic run mid-flight.	COMMENT
MEDIUM	core/dataflow/cvefix_bridge.py	106	# test scaffolding crowds out the real validator code with noise.	COMMENT
MEDIUM	core/dataflow/cvefix_bridge.py	342	# proposer hallucinates plausible-looking guards on shapes	COMMENT
MEDIUM	core/dataflow/cvefix_bridge.py	511	# so it's the diagnostic material for improving the proposer's few-shot.	COMMENT
MEDIUM	core/dataflow/sanitizer_cut_parity.py	344	Review #3 on PR #794: the parity log is append-only, and agentic	STRING
MEDIUM	core/reporting/findings.py	257	# Reasoning / analysis (from agentic or validate)	COMMENT
MEDIUM	core/reporting/__init__.py	34	# Layer 1 — domain-agnostic report scaffolding	COMMENT
MEDIUM	core/reporting/formatting.py	54	# Check for error first (agentic)	COMMENT
MEDIUM	core/reporting/formatting.py	58	# Boolean fields (agentic pipeline) are the actual verdict — check first.	COMMENT
MEDIUM	core/witness/discovery.py	41	"autonomous/witnesses", # /agentic's AutonomousSecurityAgentV2	CODE
MEDIUM	core/witness/types.py	66	# /agentic or /crash-analysis (future PR) executed their	COMMENT
MEDIUM	core/llm/detection.py	639	# (Phase 4 orchestration in raptor_agentic.py, the ``--prep-only``	COMMENT
MEDIUM	core/llm/task_types.py	64	# Multi-turn tool-using orchestrators (cve-diff, agentic). Routes	COMMENT
MEDIUM	core/llm/client.py	479	# than any current consumer needs — even agentic at 1k	COMMENT
MEDIUM	core/llm/client.py	1336	# Warn if prompt likely exceeds context window (~4 chars per token)	COMMENT
MEDIUM	core/llm/client.py	1654	# Warn if prompt likely exceeds context window (~4 chars per token)	COMMENT
MEDIUM⚡	core/llm/providers.py	246	# Single-turn round-trip used by the agentic ``ToolUseLoop``	COMMENT
MEDIUM	core/llm/providers.py	475	# provider instances per request (a common pattern in the agentic	COMMENT
MEDIUM	core/llm/providers.py	3558	# generalises across consumers; per-consumer guardrails	COMMENT
MEDIUM	core/llm/model_data.py	170	# Per-model context window, max output token, and rate limits.	COMMENT
MEDIUM	core/llm/response_validation.py	133	# that are already usable. Tuned on the agentic+/validate retry-rate	COMMENT
MEDIUM	core/llm/tool_use/types.py	494	"context_overflow", # request would exceed context window	CODE
MEDIUM	core/llm/tool_use/loop.py	292	# Submission discipline: when an agentic consumer needs the	COMMENT
MEDIUM	core/llm/tool_use/loop.py	491	# ---- pre-flight: context window -----------------------------	COMMENT
MEDIUM	core/llm/tool_use/loop.py	1132	# whole orchestration. Wrap as a regular Exception so	COMMENT
MEDIUM	core/llm/dispatcher/server.py	73	# ~100+ per /agentic run. No operator action on success.	COMMENT
MEDIUM⚡	core/llm/dispatcher/server.py	101	_TOKEN_DEFAULT_TTL_S = 8 * 60 * 60 # 8 hours — long-running /agentic	CODE
MEDIUM⚡	core/llm/dispatcher/server.py	105	_TOKEN_DEFAULT_BUDGET = 10_000 # requests per worker run — agentic	CODE
MEDIUM	core/llm/dispatcher/server.py	353	# /agentic / /understand / /validate isn't drowned in	COMMENT
MEDIUM	core/llm/tests/test_dispatcher_integration.py	540	# In-process LLM call (Phase 4 orchestration shape)	COMMENT
MEDIUM⚡	core/llm/tests/test_log_quiet.py	131	# bulk of operator log noise during /agentic.	COMMENT
MEDIUM⚡	core/llm/multi_model/tests/test_pipelines.py	79	# Verdict-style: full /agentic-shape pipeline	COMMENT
MEDIUM⚡	…e/llm/multi_model/tests/test_calibrated_aggregation.py	259	# priors_by_class has no entry for "agentic:rule-y" → falls to default.	COMMENT
MEDIUM	core/llm/scorecard/tests/test_consensus.py	355	# Cell exists under agentic:java/path-traversal, NOT bare	COMMENT
MEDIUM	core/llm/scorecard/tests/test_tool_evidence.py	301	# Cell under codeql:..., not agentic:...	COMMENT
MEDIUM	core/analysis/binary_oracle.py	509	# is generous for the largest binaries we expect to see in /agentic.	COMMENT
177 more matches not shown…

AI Slop Vocabulary81 hits · 263 pts

Severity	File	Line	Snippet	Context
MEDIUM	raptor.py	854	# Enable CodeQL by default for comprehensive agentic mode	COMMENT
MEDIUM	raptor_agentic.py	2094	# behaviour is more nuanced.	COMMENT
MEDIUM	core/llm/providers.py	3232	# The claude-code harness reports the model it used in `analysed_by`;	COMMENT
LOW	core/llm/multi_model/tests/test_pipelines.py	169	# Here we just return a dict summarising what we'd send.	COMMENT
MEDIUM	core/llm/scorecard/scorecard.py	147	# harness-side-channel demotion). ``incorrect`` = attempted +	COMMENT
MEDIUM⚡	core/analysis/binary_oracle_autodetect.py	38	# harness) so an existing operator build isn't overridden by a leftover	COMMENT
MEDIUM⚡	core/analysis/binary_oracle_autodetect.py	39	# harness cache.	COMMENT
MEDIUM	core/analysis/binary_oracle_precision.py	463	# Late import: the registry is the only thing the harness depends on	COMMENT
MEDIUM	core/analysis/binary_oracle_precision.py	464	# for driver lookup; pulling it lazily lets the harness module stay	COMMENT
MEDIUM⚡	core/analysis/tests/test_reachability.py	1011	# ``attributes`` field predates this feature), so Tier-1 dispatch is robust.	COMMENT
MEDIUM	core/analysis/tests/test_binary_oracle_cli.py	90	# Opt-out is comprehensive: even project-persisted binaries	COMMENT
MEDIUM⚡	core/analysis/tests/test_binary_oracle_precision.py	374	# ``mode`` is the harness cross-tab style — liveness-based, used by	COMMENT
MEDIUM	core/labeled_attempts/types.py	110	# Candidate tried to side-channel the harness — modify the target	COMMENT
MEDIUM⚡	core/labeled_attempts/retrieval.py	82	# the run's goal. Fuzz-harness-class output —	COMMENT
MEDIUM	core/function_taxonomy/__init__.py	223	# elevate privilege, escape namespace isolation, or load kernel	COMMENT
MEDIUM	core/function_taxonomy/__init__.py	469	"LLVMFuzzerTestOneInput", # libFuzzer harness convention	CODE
MEDIUM⚡	core/annotations/tests/test_cli.py	525	# command harness; here, just ensure the explicit-base path works.	COMMENT
LOW⚡	core/audit/condition_extraction_python.py	213	# Early-return guard pattern: if-body is just return/raise,	COMMENT
MEDIUM⚡	core/audit/sentinel_collapse.py	122	# is more comprehensive (covers None, True, False, "", 0 in addition to	COMMENT
MEDIUM	core/audit/tests/test_dark_verify.py	181	assert "#include <stdlib.h>" in harness	CODE
MEDIUM⚡	core/audit/dark_verify/_harness.py	22	# Helpers shared across harness generators	COMMENT
MEDIUM	core/audit/dark_verify/_execute.py	246	# Python harness uses repr(), which includes quotes for strings	COMMENT
MEDIUM	core/sandbox/seccomp.py	497	# robust against supply-chain drift (int 0x80 / x32 / AArch32	COMMENT
MEDIUM	core/sandbox/proxy.py	96	# 64 — original conservative default. SCA stress harness on	COMMENT
MEDIUM	core/sandbox/profiles.py	35	# target_run: posture for spawning a harness-authored target binary	COMMENT
MEDIUM	core/sandbox/profiles.py	39	# the spawning harness. Callers that want isolation FROM	COMMENT
LOW	core/sandbox/tests/test_audit_integration.py	189	# Should not raise; just return False.	COMMENT
MEDIUM	core/sandbox/tests/test_audit_degraded_marker.py	113	# before the fork. Call the marker site through a thin harness so	COMMENT
MEDIUM	core/sandbox/tests/test_consumer_sanitisation_e2e.py	146	# without needing real harness paths.	COMMENT
MEDIUM	core/sandbox/tests/test_fork_safe_warn_sites.py	114	# extra_ro_paths block via a minimal harness.	COMMENT
MEDIUM	core/inventory/exclusions.py	8	# Default exclude patterns — comprehensive list for clean inventory	COMMENT
MEDIUM	core/inventory/fixture_detection.py	291	# No production caller. Confirmed test-harness-only.	COMMENT
MEDIUM	core/inventory/binary_oracle_corpora/snappy.py	104	mode: Literal["gcov"] = "gcov" # harness cross-tab is liveness-based	CODE
LOW	…-forensics/github-evidence-kit/src/collectors/local.py	67	# For now, we just return an empty list or implement basic logic if needed.	COMMENT
MEDIUM⚡	.devcontainer/test_devcontainer.py	112	# ``name`` comes from the harness's hardcoded list, not	COMMENT
MEDIUM	.devcontainer/test_devcontainer.py	321	# ``module_name`` is from the harness's hardcoded list	COMMENT
MEDIUM	packages/source_intel/adapter.py	1514	# that pass synthetic file_paths). The regex path is robust on	COMMENT
MEDIUM	packages/exploitation/reporting.py	425	# tail'ing the file, CI harness scraping the report,	COMMENT
MEDIUM	packages/coccinelle/runner.py	30	# @script:python@ harness — they'd shadow Python builtins / keywords	COMMENT
MEDIUM	packages/coccinelle/runner.py	214	# If the rule needs harness injection, the modified text has to	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	480	# harness AND used as a Python identifier in the harness's for-	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	482	# rule file with a homoglyph pos_var could produce a harness	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	485	# the harness-injected identifier; legitimate Coccinelle rules	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	494	# becomes a Python identifier inside the @script:python@ harness	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	501	# check skip harness injection (spatch still runs, just	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	514	# Detect multi-rule .cocci files. Pre-fix the harness only	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	518	# harness reference.	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	525	# JSON harness), and the caller logs that structured	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	529	# rule names are Python identifiers in the harness.	COMMENT
MEDIUM⚡	packages/coccinelle/runner.py	532	# Multi-rule file — harness injection isn't safe.	COMMENT
MEDIUM	packages/coccinelle/runner.py	575	# Type-guard: spatch's @script:python harness always emits	COMMENT
MEDIUM	packages/coccinelle/tests/test_runner.py	455	# No harness injection → pass-through to the original rule.	STRING
MEDIUM	packages/fuzzing/harness_generator.py	55	compile_command: str # clang -fsanitize=fuzzer,address ... -o harness	CODE
MEDIUM	packages/fuzzing/harness_generator.py	271	f"# Generated by RAPTOR for {harness.target_function}\n"	CODE
MEDIUM⚡	…ges/code_understanding/dispatch/hunt_cocci_dispatch.py	324	# The runner's harness auto-injection writes the harnessed	COMMENT
MEDIUM	…derstanding/tests/dispatch/test_hunt_cocci_dispatch.py	510	# the runner auto-injects a harness that emits COCCIRESULT JSON	COMMENT
MEDIUM	…derstanding/tests/dispatch/test_hunt_cocci_dispatch.py	560	# the runner auto-injects a harness that emits COCCIRESULT JSON	COMMENT
MEDIUM	packages/llm_analysis/crash_agent.py	397	# the /agentic path stays NOT_RUN until a build harness	COMMENT
MEDIUM	packages/sca/harden.py	549	# superseded (snapshot.debian.org is the robust alternative). When the	COMMENT
MEDIUM	packages/sca/risk.py	268	# silently elevate it past actual exploitation signals.	COMMENT
21 more matches not shown…

Hallucination Indicators14 hits · 150 pts

Severity	File	Line	Snippet	Context
CRITICAL	…7_codeql_java-command-line-injection_d47f527b566d.json	61	"snippet": "org.apache.commons.codec.binary.Base64.decodeBase64(",	CODE
CRITICAL⚡	core/analysis/tests/test_reachability.py	903	"org.springframework.web.bind.annotation.GetMapping(\"/x\")"	CODE
CRITICAL	packages/cve_diff/tests/unit/test_stage_assertions.py	10	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	packages/cve_diff/tests/unit/test_acquisition_layers.py	27	from cve_diff.core.exceptions import AcquisitionError	CODE
CRITICAL	packages/cve_diff/tests/unit/test_commit_resolver.py	8	from cve_diff.core.exceptions import IdenticalCommitsError	CODE
CRITICAL	…es/cve_diff/tests/unit/diffing/test_extract_via_api.py	6	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL⚡	…diff/tests/unit/diffing/test_extract_via_gitlab_api.py	20	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	…es/cve_diff/cve_diff/diffing/extract_via_gitlab_api.py	31	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	packages/cve_diff/cve_diff/diffing/commit_resolver.py	28	from cve_diff.core.exceptions import IdenticalCommitsError	CODE
CRITICAL	packages/cve_diff/cve_diff/diffing/extractor.py	17	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	packages/cve_diff/cve_diff/diffing/extract_via_api.py	30	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	…ages/cve_diff/cve_diff/diffing/extraction_agreement.py	26	from cve_diff.core.exceptions import AnalysisError	CODE
CRITICAL	packages/cve_diff/cve_diff/acquisition/layers.py	44	from cve_diff.core.exceptions import AcquisitionError	CODE
CRITICAL	packages/cve_diff/cve_diff/cli/bench.py	30	from cve_diff.core.exceptions import CveDiffError	CODE

Structural Annotation Overuse78 hits · 150 pts

Severity	File	Line	Snippet	Context
LOW⚡	core/sarif/tests/test_import_e2e.py	232	# Step 1: parse	COMMENT
LOW⚡	core/sarif/tests/test_import_e2e.py	239	# Step 2: dedup (no dupes expected)	COMMENT
LOW⚡	core/sarif/tests/test_import_e2e.py	243	# Step 3: normalize	COMMENT
LOW	core/llm/egress.py	234	# Step 1: bring up / extend the in-process proxy. MUST happen	COMMENT
LOW⚡	core/llm/egress.py	247	# Step 2: only mutate env on the first call. Subsequent	COMMENT
LOW⚡	core/llm/egress.py	253	# Step 3: point HTTPS_PROXY at our in-process proxy so httpx-based	COMMENT
LOW⚡	core/llm/egress.py	260	# Step 4: ensure local-loop hosts (Ollama, vLLM-localhost,	COMMENT
LOW	core/llm/config.py	544	# Step 1: preferred providers via env var (consumer's explicit	COMMENT
LOW	core/llm/config.py	559	# Step 2: operator's thinking-model config (file-based; covers	COMMENT
LOW	core/llm/config.py	584	# Step 3: default-order autodetect via env vars. Skip providers	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	176	# Step 1: split findings into D–S-eligible vs vote-fallback.	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	193	# Step 2: run D–S across all eligible records, partitioned by class.	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	235	# Step 3: vote fallback for everything else.	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	328	# Step 1: probe each model	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	342	# Step 2: select profile based on cached result	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	346	# Step 3: verify passthrough prompt is simpler	COMMENT
LOW⚡	core/sandbox/landlock.py	72	# Step 1: ABI probe — landlock_create_ruleset(NULL, 0, version=1).	COMMENT
LOW⚡	core/sandbox/landlock.py	83	# Step 2: Functional self-test in a child process. Must run in a	COMMENT
LOW⚡	core/sandbox/_spawn.py	1091	# Step 5: tell parent we're ready for newuidmap.	COMMENT
LOW⚡	core/sandbox/_spawn.py	1095	# Step 7: wait for parent 'go' signal — parent has run	COMMENT
LOW⚡	core/sandbox/_spawn.py	1243	# Step 10: Landlock. Must run BEFORE seccomp so seccomp	COMMENT
LOW⚡	core/sandbox/_spawn.py	1248	# Step 11: seccomp.	COMMENT
LOW⚡	core/sandbox/_spawn.py	1255	# Step 12: pid-ns via a second fork. NEWPID only takes	COMMENT
LOW⚡	core/sandbox/_spawn.py	1486	# Step 4: wait for child to signal "unshare done, ready for newuidmap".	COMMENT
LOW⚡	core/sandbox/_spawn.py	1495	# Step 6: newuidmap / newgidmap.	COMMENT
LOW	core/sandbox/_spawn.py	1041	# Step 3: create namespaces. Leaves us as "nobody" in the	COMMENT
LOW	core/sandbox/_spawn.py	1140	# Step 9: mount-ns pivot_root if target/output supplied.	COMMENT
LOW	core/sandbox/_spawn.py	1726	# Step 8: tell child to proceed.	COMMENT
LOW	core/sandbox/_spawn.py	1778	# Step 14: collect output and wait. Everything from here down runs	COMMENT
LOW⚡	core/trajectories/test_store.py	316	# Step 0: initial user prompt	COMMENT
LOW⚡	core/trajectories/test_store.py	320	# Step 1: assistant's find_symbol call	COMMENT
LOW⚡	core/trajectories/test_store.py	324	# Step 2: tool result	COMMENT
LOW⚡	core/trajectories/test_store.py	327	# Step 3: terminal submission	COMMENT
LOW	.claude/commands/create-skill.md	24	### Step 1: Capture Successful Approach	COMMENT
LOW	.claude/commands/create-skill.md	36	### Step 2: Define Skill Parameters	COMMENT
LOW⚡	.claude/commands/create-skill.md	49	### Step 3: Extract Reusable Patterns	COMMENT
LOW⚡	.claude/commands/create-skill.md	57	### Step 4: Validate Token Budget	COMMENT
LOW⚡	.claude/commands/create-skill.md	65	### Step 5: Create Skill File	COMMENT
LOW	.claude/commands/create-skill.md	104	### Step 6: Test Auto-Loading	COMMENT
LOW	.claude/commands/audit.md	45	### Step 0: Choose execution mode	COMMENT
LOW⚡	.claude/commands/audit.md	57	### Step 1: Resolve output directory	COMMENT
LOW⚡	.claude/commands/audit.md	67	### Step 2: Context map	COMMENT
LOW⚡	.claude/commands/audit.md	77	### Step 3: Run the orchestrator	COMMENT
LOW	.claude/commands/audit.md	89	### Step 4: Surface results	COMMENT
LOW⚡	.claude/skills/oss-forensics/github-archive/SKILL.md	328	# Step 1: Dry run estimate	COMMENT
LOW⚡	.claude/skills/oss-forensics/github-archive/SKILL.md	338	# Step 2: Check budget	COMMENT
LOW⚡	.claude/skills/oss-forensics/github-archive/SKILL.md	345	# Step 3: Execute with safety limit	COMMENT
LOW⚡	.claude/skills/crash-analysis/function-tracing/SKILL.md	40	### Step 1: Add to Build	COMMENT
LOW⚡	.claude/skills/crash-analysis/function-tracing/SKILL.md	46	### Step 2: Build Target	COMMENT
LOW⚡	.claude/skills/crash-analysis/function-tracing/SKILL.md	51	### Step 3: Run	COMMENT
LOW⚡	.claude/skills/crash-analysis/function-tracing/SKILL.md	58	### Step 4: Convert to Perfetto	COMMENT
LOW	.claude/skills/audit/review.md	13	### Step 1: Understand	COMMENT
LOW	.claude/skills/audit/review.md	22	### Step 2: Hypothesize	COMMENT
LOW	.claude/skills/audit/review.md	37	### Step 3: Generate mechanical tests	COMMENT
LOW	.claude/skills/audit/review.md	81	### Step 4: Evaluate	COMMENT
LOW	.claude/skills/audit/review.md	87	### Step 5: Annotate	COMMENT
LOW	.claude/skills/audit/review.md	118	### Step 6: Checker synthesis (Mode 2)	COMMENT
LOW	docs/crash-analysis.md	99	### Step 1: Memory Allocation	COMMENT
LOW	docs/crash-analysis.md	111	### Step 2: Pointer Modification	COMMENT
LOW	tiers/analysis-guidance.md	29	### Step 1: Check Mitigations First	COMMENT
18 more matches not shown…

Docstring Block Structure20 hits · 100 pts

Severity	File	Line	Snippet	Context
HIGH	core/dataflow/codeql_augmented_run.py	93	Run ``codeql database analyze`` once. Args: db_path: Path to the CodeQL DB directory. queries: One	STRING
HIGH	core/llm/providers.py	935	Convert dict schema or Pydantic model to Pydantic model class. Supports hybrid approach: - If already Pyda	STRING
HIGH	core/llm/multi_model/dispatch.py	76	Run a task across N models in parallel and merge results. Args: task: Callable that takes one model and ret	STRING
HIGH	core/llm/multi_model/prompt_helpers.py	39	Wrap prior-model output for safe inclusion in a downstream prompt. Args: content: The model's output. Strin	STRING
HIGH	core/project/export.py	206	Zip a project output directory, skipping symlinks. Args: project_output_dir: The project's output directory	STRING
HIGH	core/project/export.py	262	Import a zipped project. Validates the zip, extracts output data to output_base/<name>/, and registers the proj	STRING
HIGH	core/audit/strategy.py	229	Select review strategies for a function. Always includes ``general``. Additional strategies are added based on	STRING
HIGH	core/sandbox/calibrate.py	318	Run a fresh calibration probe and cache the result. Args: bin_path: path to the binary to probe. Resolved v	STRING
HIGH	core/inventory/lookup.py	29	Find the function containing a given file:line in the checklist. Args: checklist: Inventory dict from build	STRING
HIGH	core/run/output.py	110	Resolve the output directory for a command run. Priority: 1. explicit_out (from --out argument) — used as-is, n	STRING
HIGH	core/git/clone.py	470	Run ``git ls-remote --heads --tags`` against ``url``. Read-only operation that returns the refs the remote advertis	STRING
HIGH	…ills/oss-forensics/github-evidence-kit/src/__init__.py	94	Load a previously serialized evidence object from JSON. Args: data: Dictionary from JSON deserializati	STRING
HIGH	packages/sca/discovery.py	254	Walk repo finding manifests + lockfiles. Args: repo: project root (absolute or relative; resolved before wa	STRING
HIGH	packages/autonomous/dialogue.py	260	Ask the LLM a strategic question about fuzzing. Examples: - "Should I continue fuzzing or stop	STRING
HIGH	packages/exploit_feasibility/smt_verbs.py	233	Check whether an arithmetic op can wrap given the visible guards. Use this when the source shows arithmetic that *l	STRING
HIGH	packages/exploit_feasibility/smt_verbs.py	395	Check whether an array index can fall outside its buffer. Use this when the source shows ``arr[index]`` (or ``memcp	STRING
HIGH	packages/exploit_feasibility/smt_verbs.py	487	Check whether a pointer can be NULL when dereferenced. Use this when the source dereferences a pointer that has pri	STRING
HIGH	packages/exploit_feasibility/smt_verbs.py	561	Check CWE-680: integer overflow leading to buffer overflow. The canonical pattern: size_t alloc_size = count	STRING
HIGH	packages/exploit_feasibility/smt_verbs.py	670	Check whether a negative value can bypass a comparison guard. The canonical pattern: if (msg_qbytes > rlim)	STRING
HIGH	packages/exploit_feasibility/under_mitigations.py	243	Rebuild ``target_source`` under each profile, run ``witness_bytes`` against each, return the per-profile outcome	STRING

Verbosity Indicators47 hits · 94 pts

Severity	File	Line	Snippet	Context
LOW⚡	core/sarif/tests/test_import_e2e.py	232	# Step 1: parse	COMMENT
LOW⚡	core/sarif/tests/test_import_e2e.py	239	# Step 2: dedup (no dupes expected)	COMMENT
LOW⚡	core/sarif/tests/test_import_e2e.py	243	# Step 3: normalize	COMMENT
LOW	core/llm/egress.py	234	# Step 1: bring up / extend the in-process proxy. MUST happen	COMMENT
LOW⚡	core/llm/egress.py	247	# Step 2: only mutate env on the first call. Subsequent	COMMENT
LOW⚡	core/llm/egress.py	253	# Step 3: point HTTPS_PROXY at our in-process proxy so httpx-based	COMMENT
LOW⚡	core/llm/egress.py	260	# Step 4: ensure local-loop hosts (Ollama, vLLM-localhost,	COMMENT
LOW	core/llm/config.py	544	# Step 1: preferred providers via env var (consumer's explicit	COMMENT
LOW	core/llm/config.py	559	# Step 2: operator's thinking-model config (file-based; covers	COMMENT
LOW	core/llm/config.py	584	# Step 3: default-order autodetect via env vars. Skip providers	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	176	# Step 1: split findings into D–S-eligible vs vote-fallback.	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	193	# Step 2: run D–S across all eligible records, partitioned by class.	COMMENT
LOW	core/llm/multi_model/calibrated_aggregation.py	235	# Step 3: vote fallback for everything else.	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	328	# Step 1: probe each model	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	342	# Step 2: select profile based on cached result	COMMENT
LOW⚡	core/security/tests/test_envelope_probe.py	346	# Step 3: verify passthrough prompt is simpler	COMMENT
LOW⚡	core/sandbox/landlock.py	72	# Step 1: ABI probe — landlock_create_ruleset(NULL, 0, version=1).	COMMENT
LOW⚡	core/sandbox/landlock.py	83	# Step 2: Functional self-test in a child process. Must run in a	COMMENT
LOW⚡	core/sandbox/_spawn.py	1091	# Step 5: tell parent we're ready for newuidmap.	COMMENT
LOW⚡	core/sandbox/_spawn.py	1095	# Step 7: wait for parent 'go' signal — parent has run	COMMENT
LOW⚡	core/sandbox/_spawn.py	1243	# Step 10: Landlock. Must run BEFORE seccomp so seccomp	COMMENT
LOW⚡	core/sandbox/_spawn.py	1248	# Step 11: seccomp.	COMMENT
LOW⚡	core/sandbox/_spawn.py	1255	# Step 12: pid-ns via a second fork. NEWPID only takes	COMMENT
LOW⚡	core/sandbox/_spawn.py	1486	# Step 4: wait for child to signal "unshare done, ready for newuidmap".	COMMENT
LOW⚡	core/sandbox/_spawn.py	1495	# Step 6: newuidmap / newgidmap.	COMMENT
LOW	core/sandbox/_spawn.py	1041	# Step 3: create namespaces. Leaves us as "nobody" in the	COMMENT
LOW	core/sandbox/_spawn.py	1140	# Step 9: mount-ns pivot_root if target/output supplied.	COMMENT
LOW	core/sandbox/_spawn.py	1726	# Step 8: tell child to proceed.	COMMENT
LOW	core/sandbox/_spawn.py	1778	# Step 14: collect output and wait. Everything from here down runs	COMMENT
LOW⚡	core/trajectories/test_store.py	316	# Step 0: initial user prompt	COMMENT
LOW⚡	core/trajectories/test_store.py	320	# Step 1: assistant's find_symbol call	COMMENT
LOW⚡	core/trajectories/test_store.py	324	# Step 2: tool result	COMMENT
LOW⚡	core/trajectories/test_store.py	327	# Step 3: terminal submission	COMMENT
LOW	packages/exploitation/bootstrap.py	116	# Step 1: Find validation runs	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	130	# Step 2: Pick the best matching run	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	137	# Step 3: Validate schema	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	146	# Step 4: Extract matching findings	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	157	# Step 5: Check source freshness	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	164	# Step 6: Check for feasibility data	COMMENT
LOW⚡	packages/exploitation/bootstrap.py	170	# Step 7: Determine status	COMMENT
LOW⚡	…ges/code_understanding/dispatch/hunt_cocci_dispatch.py	301	# Step 1: translate the pattern into a cocci rule via 1 LLM call.	COMMENT
LOW⚡	…ges/code_understanding/dispatch/hunt_cocci_dispatch.py	323	# Step 2: write the rule to a temp file and hand it to spatch.	COMMENT
LOW⚡	packages/llm_analysis/intent_match.py	538	# Step 1: describe what the exploit does.	COMMENT
LOW	packages/llm_analysis/intent_match.py	581	# Step 2: judge whether description matches finding.	COMMENT
LOW⚡	packages/llm_analysis/dataflow_validation.py	1709	# Step 1: full-path suffix match (preferred — unambiguous)	COMMENT
LOW⚡	packages/llm_analysis/dataflow_validation.py	1713	# Step 2: basename fallback	COMMENT
LOW	packages/codeql/autonomous_analyzer.py	674	# Step 1: cheap-tier prefilter. Asks a small model "is this	COMMENT

Cross-File Repetition16 hits · 80 pts

Severity	File	Snippet	Context
HIGH	core/iris/specs.py	a project-specific taint specification for one function.	STRING
HIGH	core/audit/iris_specs.py	a project-specific taint specification for one function.	STRING
HIGH	core/audit/taint_specs.py	a project-specific taint specification for one function.	STRING
HIGH	core/git/_proxy_hosts.py	return the operator override list, or none when no override is configured. tolerant: malformed json, non-utf-8 bytes, or	STRING
HIGH	packages/cve_diff/cve_diff/agent/tools.py	return the operator override list, or none when no override is configured. tolerant: malformed json, non-utf-8 bytes, or	STRING
HIGH	packages/static-analysis/_proxy_hosts.py	return the operator override list, or none when no override is configured. tolerant: malformed json, non-utf-8 bytes, or	STRING
HIGH	packages/llm_analysis/tests/test_exploit_verify.py	\ #include <stdio.h> int main(void) { printf("ok\\n"); return 0; }	STRING
HIGH	…m_analysis/tests/test_agent_verify_exploit_compiles.py	\ #include <stdio.h> int main(void) { printf("ok\\n"); return 0; }	STRING
HIGH	…/llm_analysis/tests/test_crash_agent_verify_exploit.py	\ #include <stdio.h> int main(void) { printf("ok\\n"); return 0; }	STRING
HIGH	packages/sca/parsers/tests/test_nuget.py	\ <project> <itemgroup> <packagereference include="x" version="1.0.0" versionoverride="2.0.0" /> </itemgroup> </project>	STRING
HIGH	packages/sca/rewriters/tests/test_csproj.py	\ <project> <itemgroup> <packagereference include="x" version="1.0.0" versionoverride="2.0.0" /> </itemgroup> </project>	STRING
HIGH	…es/sca/rewriters/tests/test_directory_build_targets.py	\ <project> <itemgroup> <packagereference include="x" version="1.0.0" versionoverride="2.0.0" /> </itemgroup> </project>	STRING
HIGH	…ages/sca/supply_chain/tests/test_gha_evasion_shapes.py	\ on: push jobs: j: runs-on: ubuntu-latest steps: - run: \| echo "::add-mask::${{ secrets.npm_token }}" echo "tok=${{ sec	STRING
HIGH	packages/sca/supply_chain/tests/test_gha_dos_bounds.py	\ on: push jobs: j: runs-on: ubuntu-latest steps: - run: \| echo "::add-mask::${{ secrets.npm_token }}" echo "tok=${{ sec	STRING
HIGH	packages/sca/supply_chain/tests/test_gha_cross_step.py	\ on: push jobs: j: runs-on: ubuntu-latest steps: - run: \| echo "::add-mask::${{ secrets.npm_token }}" echo "tok=${{ sec	STRING
HIGH	…/sca/supply_chain/tests/test_gha_indirect_redirects.py	\ on: push jobs: j: runs-on: ubuntu-latest steps: - run: \| echo "::add-mask::${{ secrets.npm_token }}" echo "tok=${{ sec	STRING

Redundant / Tautological Comments55 hits · 76 pts

Severity	File	Line	Snippet	Context
LOW⚡	raptor_agentic.py	2295	# Check if we have any findings from source-code scanners.	COMMENT
LOW	raptor_agentic.py	2627	# Check if validation produced enriched findings	COMMENT
LOW	raptor_codeql.py	131	# Check if we should do autonomous analysis	COMMENT
LOW	core/llm/detection.py	334	# Check if any keys need attention	COMMENT
LOW	core/llm/detection.py	561	# Check if model has a key	COMMENT
LOW	core/llm/config.py	917	# Check if any model has a role set	COMMENT
LOW	core/llm/client.py	1569	# Check if last error was quota-related	COMMENT
LOW	core/llm/providers.py	960	# Check if already a Pydantic model class	COMMENT
LOW⚡	core/llm/tests/test_ollama_warning.py	63	# Check if Ollama is available	COMMENT
LOW	core/llm/tests/test_ollama_warning.py	169	# Check if Ollama is available	COMMENT
LOW	core/license/detector.py	636	# Read the file ONCE — classify_text AND extract refs	COMMENT
LOW	core/audit/dispatch_completeness.py	125	# Check if at least one value looks callable (Name, Attribute, Lambda,	COMMENT
LOW	core/audit/ts_extract.py	967	# Check if enclosing function signals truncation	COMMENT
LOW	core/audit/attacker_synthesis.py	503	# Check if the overall chain matches a known high-impact combination.	COMMENT
LOW⚡	core/audit/condition_extraction_python.py	201	# Check if target is in the if-body	COMMENT
LOW⚡	core/audit/condition_extraction_python.py	207	# Check if target is in the else-body	COMMENT
LOW	core/audit/condition_adequacy.py	299	# Check if present guards are all irrelevant	COMMENT
LOW	core/audit/pattern_completeness.py	207	# Check if ANY synonym is also handled in this file.	COMMENT
LOW	core/audit/pattern_completeness.py	276	# Check if the sibling is handled ANYWHERE in this file.	COMMENT
LOW	core/audit/pattern_completeness.py	300	# Check if sibling is ALSO in an exclusion context.	COMMENT
LOW⚡	core/audit/condition_extraction.py	414	# Check if this is a statement-type node that could be consequence	COMMENT
LOW⚡	core/audit/condition_extraction.py	424	# Check if sink is in consequence	COMMENT
LOW⚡	core/audit/condition_extraction.py	429	# Check if sink is in alternative	COMMENT
LOW⚡	core/audit/condition_extraction.py	439	# Check if consequence is just an exit or contains only exits	COMMENT
LOW	core/audit/condition_extraction.py	562	# Check if its body is exit-only (guard clause pattern)	COMMENT
LOW	core/http/tests/test_egress_backend.py	111	# Set no_proxy to its most aggressive form before constructing.	COMMENT
LOW	core/inventory/sink_discovery.py	507	# Check if this is a dangerous call	COMMENT
LOW	packages/binary_analysis/crash_analyser.py	1279	# Check if binary has stack canaries via symbol table (not objdump -d	COMMENT
LOW	packages/binary_analysis/crash_analyser.py	1404	# Check if address is in typical memory regions	COMMENT
LOW	packages/fuzzing/afl_runner.py	231	# Check if we're on macOS	COMMENT
LOW	packages/fuzzing/afl_runner.py	549	# Check if all processes are still running	COMMENT
LOW	packages/fuzzing/afl_runner.py	64	if not self.binary.stat().st_mode & 0o111: # Check if executable	CODE
LOW	packages/sca/transitive.py	107	# Check if this entry is itself a workspace root with a lockfile	COMMENT
LOW	packages/codeql/database_manager.py	355	# Check if database is valid	COMMENT
LOW	packages/codeql/dataflow_validator.py	495	# Check if this is a path-problem (dataflow)	COMMENT
LOW	packages/autonomous/planner.py	220	# Check if we've exceeded target duration (if set)	COMMENT
LOW	packages/autonomous/dialogue.py	568	# Check if we've seen this pattern before	COMMENT
LOW	packages/autonomous/goal_planner.py	245	# Check if crash type matches goal	COMMENT
LOW	packages/autonomous/goal_planner.py	252	# Check if crash is in target code area	COMMENT
LOW	packages/autonomous/goal_planner.py	296	# Check if we found the target vulnerability	COMMENT
LOW	packages/exploit_feasibility/strategies.py	574	# Check if disabled via boot param	COMMENT
LOW	packages/exploit_feasibility/graph.py	320	# Check if goal reached	COMMENT
LOW	packages/exploit_feasibility/graph.py	326	# Check if we can reach the goal with current capabilities	COMMENT
LOW	packages/exploit_feasibility/analyzer.py	180	# Check if blocked by RELRO	COMMENT
LOW	packages/exploit_feasibility/analyzer.py	1921	# Check if PT_GNU_STACK is actually present	STRING
LOW	packages/exploit_feasibility/analyzer.py	2032	# Check if RWE (read-write-execute) - means NX disabled	STRING
LOW	packages/exploit_feasibility/analyzer.py	3875	# Check if size is on this line (old format) or next line (new format)	STRING
LOW	packages/exploit_feasibility/analyzer.py	4435	# Check if stack pivot is possible based on ROP gadgets	STRING
LOW	packages/exploit_feasibility/api.py	74	# Check if it's a web vulnerability	COMMENT
LOW	packages/exploit_feasibility/api.py	1796	# Check if format string write is actually available (verified %n working)	COMMENT
LOW	packages/exploit_feasibility/api.py	2010	# Check if write_count supports necessary multi-writes	COMMENT
LOW	packages/exploit_feasibility/api.py	2113	# Check if we can actually build ROP	COMMENT
LOW	packages/exploitability_validation/orchestrator.py	479	# Check if we should skip remaining stages	COMMENT
LOW	packages/exploitability_validation/orchestrator.py	985	# Check if we have any "not_disproven" findings that need Stage B	COMMENT
LOW	packages/exploitability_validation/orchestrator.py	1262	# Check if any findings need feasibility analysis	COMMENT

Self-Referential Comments16 hits · 58 pts

Severity	File	Line	Snippet	Context
MEDIUM	core/llm/tests/test_llm_callbacks.py	92	# Create a mock AuthenticationError	COMMENT
MEDIUM⚡	core/hash/tests/test_hash.py	77	# Create a small file	COMMENT
MEDIUM⚡	core/hash/tests/test_hash.py	82	# Create a large file (simulate by setting very small limit)	COMMENT
MEDIUM⚡	core/hash/tests/test_hash.py	140	# Create a file that will be skipped	COMMENT
MEDIUM	core/security/_dangerous_env_strip.sh	17	# This file is SOURCED, not executed. It declares the canonical set of	COMMENT
MEDIUM	core/project/tests/test_add.py	86	# Create a subdirectory with just the runs	COMMENT
MEDIUM	core/sandbox/tests/test_sandbox_attack_scenarios.py	282	# Create a socket FD — should be rejected	COMMENT
MEDIUM	core/sandbox/tests/test_sandbox_attack_scenarios.py	625	# Create a real dir with a secret file, a symlink to it.	COMMENT
MEDIUM⚡	core/sandbox/tests/test_e2e_sandbox.py	187	# Create a symlink inside output pointing to /var/tmp	COMMENT
MEDIUM	core/sandbox/tests/test_observe_profile.py	278	# Create the real (would-be-spoofed) data somewhere else.	COMMENT
MEDIUM	core/inventory/tests/test_shared_checklist.py	220	# Create a symlink (not a real file) — should be skipped	COMMENT
MEDIUM⚡	core/orchestration/tests/test_understand_bridge.py	1765	# Create a target dir so on-disk hashing works	COMMENT
MEDIUM⚡	packages/sca/tests/test_verify.py	199	# Create a node_modules dir we don't want copied (would be huge in real life).	COMMENT
MEDIUM⚡	packages/exploit_feasibility/analyzer.py	122	# This module provides FeasibilityReport and FeasibilityAnalyzer classes.	COMMENT
MEDIUM⚡	…ges/exploitability_validation/tests/test_validation.py	1580	# Create a minimal SARIF file	STRING
MEDIUM⚡	.github/tests/test_release_workflow.sh	290	# Create an off-main tag	COMMENT

AI Structural Patterns56 hits · 44 pts

Severity	File	Line	Context
LOW	core/dataflow/barrier_synth.py	565	CODE
LOW	core/dataflow/cvefix_bridge.py	368	CODE
LOW	core/dataflow/cvefix_bridge.py	539	CODE
LOW	core/dataflow/cvefix_walk.py	447	CODE
LOW	core/llm/tool_use/loop.py	190	CODE
LOW	core/llm/scorecard/scorecard.py	394	CODE
LOW	core/analysis/summaries.py	275	CODE
LOW	core/evidence/__init__.py	645	CODE
LOW	core/iris/refine.py	69	CODE
LOW	core/iris/api.py	149	CODE
LOW	core/labeled_attempts/test_retrieval.py	49	CODE
LOW	core/annotations/tests/test_cli.py	34	CODE
LOW	core/audit/strategy.py	213	CODE
LOW	core/audit/priority.py	68	CODE
LOW	core/audit/triage.py	49	CODE
LOW	core/audit/triage.py	155	CODE
LOW	core/audit/orchestrator.py	444	CODE
LOW	core/audit/gaps.py	50	CODE
LOW	core/audit/executor.py	52	CODE
LOW	core/audit/executor.py	271	CODE
LOW	core/audit/executor.py	333	CODE
LOW	core/audit/executor.py	623	CODE
LOW	core/sandbox/proxy.py	379	CODE
LOW	core/sandbox/seatbelt.py	114	CODE
LOW	core/sandbox/_landlock_audit.py	239	CODE
LOW	core/sandbox/context.py	331	CODE
LOW	core/sandbox/context.py	2507	CODE
LOW	core/sandbox/_spawn.py	470	CODE
LOW	core/sandbox/tracer.py	1315	CODE
LOW	core/sandbox/_macos_spawn.py	133	CODE
LOW	core/http/urllib_backend.py	393	CODE
LOW	core/inventory/builder.py	179	CODE
LOW	core/inventory/dead_scope.py	156	CODE
LOW	core/run/tests/test_cli.py	28	CODE
LOW	core/startup/tests/test_doctor.py	18	CODE
LOW	packages/binary_analysis/pipeline.py	1732	CODE
LOW	packages/exploitation/tests/test_bootstrap.py	32	CODE
LOW	packages/fuzzing/libfuzzer_runner.py	72	CODE
LOW	packages/fuzzing/afl_runner.py	39	CODE
LOW	packages/llm_analysis/witness_adapter.py	40	CODE
LOW	packages/llm_analysis/orchestrator.py	513	CODE
LOW	packages/llm_analysis/agent.py	636	CODE
LOW	packages/llm_analysis/prompts/analysis.py	499	CODE
LOW	packages/semgrep/runner.py	98	CODE
LOW	packages/sca/calibration/refit.py	534	CODE
LOW	packages/sca/calibration/project_samples.py	582	CODE
LOW	packages/sca/calibration/tests/test_refit.py	51	CODE
LOW	packages/sca/tests/test_diff.py	13	CODE
LOW	packages/sca/tests/test_risk.py	49	CODE
LOW	packages/sca/tests/test_sarif.py	13	CODE
LOW	packages/sca/transitive_drop/detector.py	54	CODE
LOW	packages/sca/bump/orchestrator.py	121	CODE
LOW	packages/sca/bump/orchestrator.py	683	CODE
LOW	packages/cve_diff/cve_diff/cli/main.py	267	CODE
LOW	packages/static-analysis/scanner.py	623	CODE
LOW	packages/exploit_feasibility/api.py	1639	CODE

Overly Generic Function Names32 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	core/dataflow/tests/test_smt_barrier.py	340	"def helper(x):\n"	CODE
LOW⚡	core/analysis/tests/test_interproc.py	187	"def helper(a, b):\n"	CODE
LOW⚡	core/analysis/tests/test_interproc.py	201	"def helper(a, b):\n"	CODE
LOW⚡	core/analysis/tests/test_interproc.py	287	"def helper(a, b):\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_closure.py	298	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_reachability.py	395	"def helper(): pass\n"	CODE
LOW	core/analysis/tests/test_reachability.py	429	"def helper(): pass\n"	CODE
LOW⚡	core/analysis/tests/test_python_module_callgraph.py	92	"def helper(x): return x\n"	CODE
LOW⚡	core/analysis/tests/test_python_module_callgraph.py	99	"def helper(): pass\n"	CODE
LOW⚡	core/analysis/tests/test_python_module_callgraph.py	263	" def helper(): pass\n"	CODE
LOW	core/analysis/tests/test_taint_multi_lang.py	64	function handleRequest(userInput, res) {	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	157	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	338	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	384	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	441	"def helper():\n" # line 1	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	442	" def helper():\n" # line 2 — nested redefinition	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	940	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_adjacency.py	1117	"def helper():\n"	CODE
LOW	core/analysis/tests/test_reachability_adjacency.py	1375	"def helper(x):\n"	CODE
LOW⚡	core/analysis/tests/test_reachability_evidence.py	58	"def helper():\n"	CODE
LOW⚡	core/analysis/tests/test_taint_summaries.py	130	"def helper(s):\n"	CODE
LOW	core/analysis/tests/test_taint_summaries.py	164	"def helper(a, b):\n"	CODE
LOW	core/audit/tests/test_test_discovery.py	106	source = "def helper():\n pass\n"	CODE
LOW⚡	core/inventory/tests/test_inventory.py	228	code = "function handleRequest(req, res) {\n}\n"	CODE
LOW⚡	core/inventory/tests/test_inventory.py	314	(src / "utils.py").write_text("def helper(x):\n return x\n")	CODE
LOW	core/inventory/tests/test_inventory.py	273	def test_function(self):	CODE
LOW	core/inventory/tests/test_extractors.py	92	code = "def helper(): pass"	CODE
LOW	core/orchestration/tests/test_context_map_callgraph.py	174	"def helper():\n"	CODE
LOW	…orchestration/tests/test_agentic_passes_integration.py	45	"def handle_request(req):\n return req.body\n"	CODE
LOW	…re/orchestration/tests/test_reachability_enrichment.py	612	"def helper(cmd):\n"	CODE
LOW	packages/binary_analysis/tests/test_gdb_injection.py	438	(repo / "lib" / "utils.py").write_text("def helper():\n pass\n")	CODE
LOW⚡	…kages/sca/reachability/tests/test_host_reachability.py	83	"def helper():\n" # line 1	CODE

Fake / Example Data22 hits · 27 pts

Severity	File	Line	Snippet	Context
LOW	core/dataflow/tests/test_barrier_synth.py	281	monkeypatch.setenv("ANTHROPIC_API_KEY", "test-fake-key")	CODE
LOW	core/llm/dispatcher/tests/test_lifecycle.py	26	creds._keys = {"anthropic": "fake-key", "openai": None, "gemini": None}	CODE
LOW⚡	core/llm/tests/test_pinned_model.py	62	monkeypatch.setenv("ANTHROPIC_API_KEY", "test-fake-key")	CODE
LOW⚡	core/llm/tests/test_pinned_model.py	72	monkeypatch.setenv("ANTHROPIC_API_KEY", "test-fake-key")	CODE
LOW⚡	core/llm/tests/test_pinned_model.py	84	monkeypatch.setenv(v, "test-fake-key")	CODE
LOW⚡	core/llm/tests/test_pinned_model.py	117	monkeypatch.setenv("ANTHROPIC_API_KEY", "test-fake-key")	CODE
LOW⚡	core/llm/tests/test_pinned_model.py	133	monkeypatch.setenv("ANTHROPIC_API_KEY", "test-fake-key")	CODE
LOW	core/llm/tests/test_bedrock_live_features.py	331	("Lorem ipsum dolor sit amet, consectetur adipiscing elit, "	CODE
LOW	core/llm/tests/test_bedrock_live_features.py	331	("Lorem ipsum dolor sit amet, consectetur adipiscing elit, "	CODE
LOW⚡	core/audit/tests/test_e2e_block_sink.py	156	ctx = {"source": "placeholder"}	CODE
LOW⚡	core/audit/tests/test_e2e_block_sink.py	173	ctx = {"source": "placeholder"}	CODE
LOW⚡	core/audit/tests/test_e2e_block_sink.py	190	ctx = {"source": "placeholder"}	CODE
LOW⚡	core/audit/tests/test_e2e_block_sink.py	219	ctx = {"source": "placeholder"}	CODE
LOW	core/audit/tests/test_e2e_block_sink.py	398	ctx = {"source": "placeholder"}	CODE
LOW⚡	core/run/tests/test_provenance.py	665	return_value={"name": "Jane Doe", "handle": "@jane"}):	CODE
LOW⚡	core/run/tests/test_provenance.py	667	self.assertEqual(m["who"], {"name": "Jane Doe", "handle": "@jane"})	CODE
LOW⚡	core/run/tests/test_identity.py	21	p = self._write(d, {"name": "Jane Doe", "handle": "@jane",	CODE
LOW⚡	core/run/tests/test_identity.py	25	{"name": "Jane Doe", "handle": "@jane", "url": "https://x"})	CODE
LOW	…ode_understanding/tests/test_libexec_trajectory_e2e.py	114	api_key="fake-key-for-test",	CODE
LOW⚡	…ckages/code_understanding/tests/dispatch/test_tools.py	515	(d / "x.c").write_text("placeholder")	CODE
LOW	…kages/sca/supply_chain/tests/test_registry_metadata.py	421	assert lbf[0].evidence["sole_maintainer"] == "Acme Corp", (	CODE
LOW	.github/tests/test_release_workflow.sh	65	git config user.email "test@test.com"	CODE

Slop Phrases3 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	core/llm/tool_use/tests/test_fallback.py	227	"Let me know if you need anything else."	CODE
LOW⚡	packages/sca/parsers/tests/test_inline_installs.py	861	"# don't forget to pip install requests before running\n",	CODE
LOW⚡	packages/sca/parsers/tests/test_inline_installs.py	861	"# don't forget to pip install requests before running\n",	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	core/progress/__init__.py	484	# Example usage:	COMMENT

Analysis Overview

What These Metrics Mean

Score History

Severity Breakdown

Directory Score Breakdown

Pattern Findings