AI Slop Code Risk Monitor

getkin/kin-openapi

SlopCodeMonitor badge for getkin/kin-openapi Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

OpenAPI 3.0 and 3.1 and 3.2 (and Swagger v2) implementation for Go (parsing, converting, validation, and more)

1.2 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for getkin/kin-openapi, a Go project with 3,318 GitHub stars. SynthScan examined 100,616 lines of code across 582 source files, recording 96 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 1.2 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.2
Adjusted Signal
1.2
Raw Pattern Score
100%
Time Factor
2026-11-01
Last Push
3.3K
Stars
Go
Language
100.6K
Lines of Code
582
Files
96
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 88 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.3/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 5.9/100 · LOW

Which changes need focused human review? 96 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 0MEDIUM 4LOW 90

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 96 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block84 hits · 84 pts
SeverityFileLineSnippetContext
LOWrouters/gorillamux/example_test.go61 //COMMENT
LOWopenapi3/validation_error.go1package openapi3COMMENT
LOWopenapi3/validation_error.go21// failure point without string comparison.COMMENT
LOWopenapi3/validation_error.go41// -> RequiredFieldError{Field: "type"}COMMENT
LOWopenapi3/validation_error.go61 t, ok := target.(**ValidationError)COMMENT
LOWopenapi3/validation_error.go81// var ivr *InfoVersionRequiredCOMMENT
LOWopenapi3/validation_error.go101// examples[i], etc. checked against the schema during documentCOMMENT
LOWopenapi3/validation_error.go401// SchemaPatternRegexError clusters "schema pattern failed to compile"COMMENT
LOWopenapi3/validation_error.go681func (e *DuplicateTagError) Error() string {COMMENT
LOWopenapi3/schema_3point0_validator.go441func (schema *Schema) visitJSONBoolean(settings *schemaValidationSettings, value bool) (err error) {COMMENT
LOWopenapi3/schema_3point0_validator.go461//COMMENT
LOWopenapi3/internalize_refs.go21//COMMENT
LOWopenapi3/internalize_refs.go521// InternalizeRefs removes all references to external files from the spec and moves themCOMMENT
LOWopenapi3/doc.go1// Package openapi3 parses and writes OpenAPI 3 specification documents.COMMENT
LOWopenapi3/doc.go21//COMMENT
LOWopenapi3/loader.go21}COMMENT
LOWopenapi3/loader.go161 return resolvedPath, nilCOMMENT
LOWopenapi3/loader.go1701// applyRefSiblings applies the sibling keywords of an OAS 3.1 $ref to itsCOMMENT
LOWopenapi3/content.go61 "multipart/form-data": NewMediaType().WithSchemaRef(schema),COMMENT
LOWopenapi3/validation_error_context.go1// Context wrappers are the 4th category of typed validation errors,COMMENT
LOWopenapi3/validation_error_context.go21// - Document-wide wrappers — SectionValidationError,COMMENT
LOWopenapi3/validation_error_context.go41//COMMENT
LOWopenapi3/validation_error_context.go101}COMMENT
LOWopenapi3/path_item.go401COMMENT
LOWopenapi3/schema.go181// Example OpenAPI 3.0 (single type):COMMENT
LOWopenapi3/schema.go221// Includes returns true if the given type is included in the type array.COMMENT
LOWopenapi3/schema.go241//COMMENT
LOWopenapi3/schema.go261// types.IncludesNull() // trueCOMMENT
LOWopenapi3/schema.go281}COMMENT
LOWopenapi3/schema.go301// var nilTypes *TypesCOMMENT
LOWopenapi3/walk_parameters.go1package openapi3COMMENT
LOWopenapi3/walk_parameters.go21// Returning a non-nil error aborts the walk and is returned byCOMMENT
LOWopenapi3/helpers.go141 s2.Scheme = "file"COMMENT
LOWopenapi3/helpers.go161// ├─ record.yamlCOMMENT
LOWopenapi3/walk_schemas.go21// "/paths/~1pets/get/responses/200/content/application~1json/schema". It isCOMMENT
LOWopenapi3/walk_schemas.go41// through every sub-schema keyword: properties, items, itemSchema,COMMENT
LOWopenapi3/validation_options.go141// and stopping. By default, Validate is fail-fast.COMMENT
LOWopenapi3/native_yaml.go41 }COMMENT
LOWopenapi3/native_yaml.go101//COMMENT
LOWopenapi3/native_yaml.go121// Merge semantics: an explicit key wins over a merged one, and among mergedCOMMENT
LOWopenapi3/native_yaml.go381 if err := normalizeAnyFields(out); err != nil {COMMENT
LOWopenapi3/native_yaml.go541 return nilCOMMENT
LOWopenapi3/validation_code.go1package openapi3COMMENT
LOWopenapi3/origin.go21// so the map was storing information the value repeated. Here Location.NameCOMMENT
LOWopenapi3/error_collector.go1package openapi3COMMENT
LOWopenapi2/doc.go1// Package openapi2 parses and writes OpenAPIv2 specification documents.COMMENT
LOWinternal/nodeindex/nodeindex.go1// Package nodeindex derives, from a YAML node tree and the text it was parsedCOMMENT
LOWinternal/nodeindex/nodeindex.go21// Index answers where the block headed by a key ends.COMMENT
LOWinternal/nodeindex/nodeindex.go141 start = i + 1COMMENT
LOW.github/FUNDING.yml1# These are supported funding model platformsCOMMENT
LOW.github/docs/openapi3.txt1721 // func that reads whatever URI it is handed (e.g. by delegating toCOMMENT
LOWopenapi3filter/middleware_test.go581 // 404 {"message":"Not Found","status":404}COMMENT
LOWopenapi3filter/unpack_errors_test.go81 panic(err)COMMENT
LOWopenapi3filter/unpack_errors_test.go101 // Error at "/status": value is not one of the allowed values ["available","pending","sold"]COMMENT
LOWopenapi3filter/validation_kit.go1package openapi3filterCOMMENT
LOWopenapi3filter/validation_kit.go21// to use, copy, modify, merge, publish, distribute, sublicense, and/or sellCOMMENT
LOWopenapi3filter/validation_test.go281COMMENT
LOWopenapi3conv/openapi3_conv.go21// so the surface stays small and additive — new options are added byCOMMENT
LOWopenapi3conv/doc.go1// Package openapi3conv canonicalizes an OpenAPI 3.x document into the latestCOMMENT
LOWopenapi3conv/doc.go21// - Out of scope: cross-major upgrades (3 → 4 if/when v4 ships). ThoseCOMMENT
24 more matches not shown…
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALopenapi3/origin_test.go303 base.Schema.Value.Origin.Fields.Get("type"))CODE
CRITICALopenapi3/origin_test.go413 base.Flows.Implicit.Origin.Fields.Get("authorizationUrl"))CODE
Slop Phrases4 hits · 8 pts
SeverityFileLineSnippetContext
MEDIUMopenapi3/response_issue224_test.go21 "description": ":dog: :cat: :rabbit: This is a sample server Petstore server. You can find out more about SwaggCODE
MEDIUMopenapi2/testdata/swagger.json1{"swagger":"2.0","info":{"title":"Swagger Petstore","description":"This is a sample server Petstore server. You can finCODE
MEDIUMopenapi3filter/testdata/petstore.yaml3 description: "This is a sample server Petstore server. You can find out more about Swagger at [http://swagger.io]CODE
MEDIUMopenapi2conv/testdata/swagger.json1{"swagger":"2.0","info":{"title":"Swagger Petstore","description":"This is a sample server Petstore server. You can finCODE
Fake / Example Data6 hits · 6 pts
SeverityFileLineSnippetContext
LOWopenapi3/example_jsonschema2020_test.go22 "John Doe",CODE
LOWopenapi3/example_jsonschema2020_test.go45 "name": "John Doe",CODE
LOWopenapi3/example_jsonschema2020_test.go221 "name": "John Doe",CODE
LOWopenapi3/schema_if_then_else_test.go98 "billingAddress": "123 Main St",CODE
LOWopenapi2conv/issue187_test.go45 "email": "test@test.com"CODE
LOWopenapi2conv/issue187_test.go108 const expected = `{"components":{"schemas":{"model.ProductSearchAttributeRequest":{"properties":{"filterField":{"type":CODE