AI Slop Code Risk Monitor

git-lfs/git-lfs

SlopCodeMonitor badge for git-lfs/git-lfs Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Git extension for versioning large files

2.1 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for git-lfs/git-lfs, a Go project with 14,569 GitHub stars. SynthScan examined 99,385 lines of code across 456 source files, recording 137 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 2.1 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.1
Adjusted Signal
2.1
Raw Pattern Score
100%
Time Factor
2026-10-23
Last Push
14.6K
Stars
Go
Language
99.4K
Lines of Code
456
Files
137
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 9.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 119 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 18 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 9.2/100 · LOW

Which changes need focused human review? 137 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 28LOW 109

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 137 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block89 hits · 89 pts
SeverityFileLineSnippetContext
LOWtools/iotools.go101 //COMMENT
LOWtools/dir_walker.go41COMMENT
LOWtools/filetools.go241 return nilCOMMENT
LOWtools/humanize/package.go1// package humanize is designed to parse and format "humanized" versions ofCOMMENT
LOWconfig/config.go521COMMENT
LOWconfig/environment.go21 // Bool returns the boolean state associated with a given key, or theCOMMENT
LOWconfig/environment.go41 // then it will be returned wholesale.COMMENT
LOWconfig/fetcher.go1package configCOMMENT
LOWlocking/lockable.go61// FixAllLockableFileWriteFlags recursively scans the repo looking for files whichCOMMENT
LOWlocking/api.go41 // Lock is the Lock that was optionally created in response to theCOMMENT
LOWlocking/api.go141 return unlockRes, res.StatusCode, nilCOMMENT
LOWlocking/api.go241// client would like a list of locks to verify a Git push.COMMENT
LOWdocs/man/asciidoctor-extensions/manpage-extension.rb21 # only added when in "n" (i.e., "nroff") mode, which by defaultCOMMENT
LOWdocs/proposals/locking.md181// the Expired flag.COMMENT
LOWdocs/proposals/locking.md241 // like to obtain the lock, for instance: "rick@github.com".COMMENT
LOWdocs/proposals/locking.md341 } `json:"filters"`COMMENT
LOWdocs/proposals/locking.md361 Locks []Lock `json:"locks"`COMMENT
LOWt/t-path.sh41 GITPATH="$(dirname "$(command -v git)")"COMMENT
LOWt/t-path.sh61 # refresh the Git index (assuming Git was compiled with USE_NSEC=0, asCOMMENT
LOWt/t-path.sh101 # We could ignore errors from clone_repo() and then search for the outputCOMMENT
LOWt/t-path.sh121 pushd ..COMMENT
LOWt/t-path.sh161 # Go on Windows always looks in the current directory first when creatingCOMMENT
LOWt/t-clone.sh201 # used until we set the "http.sslCertPasswordProtected" option to "true"COMMENT
LOWt/t-clone.sh321 cp "$LFS_CLIENT_KEY_FILE" "$HOME/lfs-client-key-file"COMMENT
LOWt/t-clone.sh341 # specified by the "http.<url>.sslKey" option is encrypted, and so willCOMMENT
LOWt/t-batch-storage-retries.sh201 git commit -m "add a.dat"COMMENT
LOWt/t-ssh.sh261 log_match_path="$remote_repo_path"COMMENT
LOWt/t-ssh.sh321 # We expect the lfs-ssh-echo utility to simulate a JSON response from theCOMMENT
LOWt/t-attributes.sh121 contents2="other data"COMMENT
LOWt/t-attributes.sh141 # our ability to parse macro attribute references with a "!"COMMENT
LOWt/t-progress.sh101 max_pointer_size="$(lfstest-getlimit --max-pointer-size)"COMMENT
LOWt/t-progress.sh141 git commit -m "add a.dat"COMMENT
LOWt/t-progress.sh161 GIT_LFS_PROGRESS="$progress_log" GIT_TRACE=1 \COMMENT
LOWt/t-progress.sh221 # of tq.TransferQueue reports the final object size in the progress log.COMMENT
LOWt/t-progress.sh241 grep -c "decompressed gzipped response" pull.logCOMMENT
LOWt/t-fetch.sh781 printf "%s" "$contents" >test.binCOMMENT
LOWt/t-pull.sh1261 refute_local_object "$contents_oid"COMMENT
LOWt/t-pull.sh1281 #COMMENT
LOWt/testlib.sh1#!/usr/bin/env bashCOMMENT
LOWt/testenv.sh101TRASHDIR="$TMPDIR/$(basename "$0")-$$"COMMENT
LOWt/cmd/lfs-ssh-echo.go141 os.Exit(1)COMMENT
LOWt/cmd/git-credential-lfstest.go201 // Each line in a file is of the following form:COMMENT
LOWt/cmd/lfstest-count-tests.go21 // lockFile is the path to a file (relative to the $LFSTEST_DIR) who'sCOMMENT
LOWtq/transfer_queue.go81 return time.Now().Add(time.Duration(delay) * time.Millisecond)COMMENT
LOWtq/transfer_queue.go421// is open, read one item from the `q.incoming` channel.COMMENT
LOWtq/transfer.go221}COMMENT
LOWtq/basic_upload.go101 if errors.IsUnprocessableEntityError(err) {COMMENT
LOWscript/lib/distro.rb1#!/usr/bin/env rubyCOMMENT
LOWsubprocess/path_windows.go1// Copyright 2010 The Go Authors. All rights reserved.COMMENT
LOWsubprocess/path.go1// Copyright 2010 The Go Authors. All rights reserved.COMMENT
LOWsubprocess/path_nix.go1// Copyright 2010 The Go Authors. All rights reserved.COMMENT
LOWlfshttp/endpoint.go61COMMENT
LOWlfshttp/ssh.go21// exits with this status, we treat the `git-lfs-authenticate` command asCOMMENT
LOWlfsapi/auth.go141 return c.doWithAuth("", access, redirectedReq, via)COMMENT
LOWlfs/scanner_git_test.go161 // Previous commits excludes final state of each file, which is:COMMENT
LOWlfs/diff_index_scanner.go81 // octal.COMMENT
LOWlfs/diff_index_scanner.go101}COMMENT
LOWlfs/diff_index_scanner.go121// tree.COMMENT
LOWlfs/gitscanner_refs.go121// and invokes the provided callback for each pointer file, valid or invalid,COMMENT
LOWcommands/run.go21 commandMu sync.MutexCOMMENT
29 more matches not shown…
Self-Referential Comments25 hits · 86 pts
SeverityFileLineSnippetContext
MEDIUMt/t-push.sh855 # Create a tag. Normally this would cause the entire history to be traversedCOMMENT
MEDIUMt/testhelpers.sh1131# Create a pkt-line message from s, which is an argument string to printf(1).COMMENT
MEDIUMt/t-duplicate-oids.sh26 # Create a pointer with the old "http://git-media.io" specCOMMENT
MEDIUMt/t-duplicate-oids.sh28 # Create a pointer with the latest spec to create a modification, but leaveCOMMENT
MEDIUMt/t-fsck.sh13 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-fsck.sh59 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-fsck.sh110 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-fsck.sh165 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-fsck.sh363 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-status.sh408 # Create an unstaged change against a source file that doesn't exist.COMMENT
MEDIUMt/t-dedup.sh28 # Create a commit with some files tracked by git-lfsCOMMENT
MEDIUMt/t-migrate-info.sh881 # Create an ambiguously named reference sharing the name as the SHA-1 ofCOMMENT
MEDIUMt/t-batch-storage-retries.sh229 # Create a corrupt partial download file smaller than the actual object.COMMENT
MEDIUMt/t-batch-storage-retries.sh251 # Create a corrupt partial download file equal in size to the actual object.COMMENT
MEDIUMt/t-migrate-import.sh798 # Create an ambiguously named reference sharing the name as the SHA-1 ofCOMMENT
MEDIUMt/t-checkout.sh1079 # Create a partial clone with a cone-mode sparse checkout of one directoryCOMMENT
MEDIUMt/t-pull.sh1358 # Create a partial clone with a cone-mode sparse checkout of one directoryCOMMENT
MEDIUMt/t-pointer.sh605 # Create a pointer WITHOUT extension infoCOMMENT
MEDIUM⚡t/testenv.sh119# This file contains the URL of the test Git server. See the "Test Suite"COMMENT
MEDIUM⚡t/testenv.sh123# This file contains the SSL URL of the test Git server. See the "Test Suite"COMMENT
MEDIUM⚡t/testenv.sh127# This file contains the client cert SSL URL of the test Git server. See the "Test Suite"COMMENT
MEDIUM⚡t/testenv.sh131# This file contains the self-signed SSL cert of the TLS endpoint of the test Git server.COMMENT
MEDIUM⚡t/testenv.sh134# This file contains the client certificate of the client cert endpoint of the test Git server.COMMENT
MEDIUM⚡t/testenv.sh137# This file contains the client key of the client cert endpoint of the test Git server.COMMENT
MEDIUM⚡t/testenv.sh140# This file contains the encrypted client key of the client cert endpoint of the test Git server.COMMENT
Fake / Example Data18 hits · 18 pts
SeverityFileLineSnippetContext
LOWconfig/config_test.go273 "user.email": []string{"pdoe@example.org"},CODE
LOWconfig/config_test.go282 assert.Equal(t, email, "pdoe@example.org")CODE
LOWconfig/config_test.go300 "user.email": []string{"pdoe@example.org"},CODE
LOWconfig/config_test.go316 "user.email": []string{"pdoe@example.org"},CODE
LOWconfig/config_test.go327 assert.Equal(t, email, "pdoe@example.org")CODE
LOWdocs/api/locking.md81 "name": "Jane Doe"CODE
LOWdocs/api/locking.md196 "name": "Jane Doe"CODE
LOWdocs/api/locking.md312 "name": "Jane Doe"CODE
LOWdocs/api/locking.md427 "name": "Jane Doe"CODE
LOWdocs/proposals/locking_notes.md46< "name": "Jane Doe"CODE
LOWdocs/proposals/locking_notes.md76< "name": "Jane Doe"CODE
LOWdocs/proposals/locking_notes.md106< "name": "Jane Doe"CODE
LOWdocs/proposals/locking_notes.md146< "name": "Jane Doe"CODE
LOWdocs/proposals/locking_notes.md185< "name": "Jane Doe"CODE
LOWdocs/proposals/locking_api.md22> name: "Jane Doe",CODE
LOWdocs/proposals/locking_api.md40< name: "Jane Doe",CODE
LOWdocs/proposals/locking_api.md108< name: "Jane Doe",CODE
LOWdocs/proposals/locking_api.md159< name: "Jane Doe",CODE
AI Slop Vocabulary4 hits · 10 pts
SeverityFileLineSnippetContext
MEDIUMt/t-progress.sh168 # unknown. For a more comprehensive test of gzip-encoding, see theCOMMENT
MEDIUMt/t-progress.sh216 # unknown. For a more comprehensive test of gzip-encoding, see theCOMMENT
LOWt/t-clean.sh145 # but the file on disk should be smaller, so we just create an empty file.COMMENT
MEDIUMt/t-install.sh100 # more-comprehensive hook update tests are in test-update.shCOMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWscript/install.sh25# Check if the user has permission to install in the specified prefixCOMMENT