Git extension for versioning large files
This report summarizes scanner evidence for git-lfs/git-lfs, a Go project with 14,569 GitHub stars. SynthScan examined 99,385 lines of code across 456 source files, recording 137 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 2.1 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 119 finding(s).
Are imports declared and package/API names verified? 18 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 137 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 137 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/iotools.go | 101 | // | COMMENT |
| LOW | tools/dir_walker.go | 41 | COMMENT | |
| LOW | tools/filetools.go | 241 | return nil | COMMENT |
| LOW | tools/humanize/package.go | 1 | // package humanize is designed to parse and format "humanized" versions of | COMMENT |
| LOW | config/config.go | 521 | COMMENT | |
| LOW | config/environment.go | 21 | // Bool returns the boolean state associated with a given key, or the | COMMENT |
| LOW | config/environment.go | 41 | // then it will be returned wholesale. | COMMENT |
| LOW | config/fetcher.go | 1 | package config | COMMENT |
| LOW | locking/lockable.go | 61 | // FixAllLockableFileWriteFlags recursively scans the repo looking for files which | COMMENT |
| LOW | locking/api.go | 41 | // Lock is the Lock that was optionally created in response to the | COMMENT |
| LOW | locking/api.go | 141 | return unlockRes, res.StatusCode, nil | COMMENT |
| LOW | locking/api.go | 241 | // client would like a list of locks to verify a Git push. | COMMENT |
| LOW | docs/man/asciidoctor-extensions/manpage-extension.rb | 21 | # only added when in "n" (i.e., "nroff") mode, which by default | COMMENT |
| LOW | docs/proposals/locking.md | 181 | // the Expired flag. | COMMENT |
| LOW | docs/proposals/locking.md | 241 | // like to obtain the lock, for instance: "rick@github.com". | COMMENT |
| LOW | docs/proposals/locking.md | 341 | } `json:"filters"` | COMMENT |
| LOW | docs/proposals/locking.md | 361 | Locks []Lock `json:"locks"` | COMMENT |
| LOW | t/t-path.sh | 41 | GITPATH="$(dirname "$(command -v git)")" | COMMENT |
| LOW | t/t-path.sh | 61 | # refresh the Git index (assuming Git was compiled with USE_NSEC=0, as | COMMENT |
| LOW | t/t-path.sh | 101 | # We could ignore errors from clone_repo() and then search for the output | COMMENT |
| LOW | t/t-path.sh | 121 | pushd .. | COMMENT |
| LOW | t/t-path.sh | 161 | # Go on Windows always looks in the current directory first when creating | COMMENT |
| LOW | t/t-clone.sh | 201 | # used until we set the "http.sslCertPasswordProtected" option to "true" | COMMENT |
| LOW | t/t-clone.sh | 321 | cp "$LFS_CLIENT_KEY_FILE" "$HOME/lfs-client-key-file" | COMMENT |
| LOW | t/t-clone.sh | 341 | # specified by the "http.<url>.sslKey" option is encrypted, and so will | COMMENT |
| LOW | t/t-batch-storage-retries.sh | 201 | git commit -m "add a.dat" | COMMENT |
| LOW | t/t-ssh.sh | 261 | log_match_path="$remote_repo_path" | COMMENT |
| LOW | t/t-ssh.sh | 321 | # We expect the lfs-ssh-echo utility to simulate a JSON response from the | COMMENT |
| LOW | t/t-attributes.sh | 121 | contents2="other data" | COMMENT |
| LOW | t/t-attributes.sh | 141 | # our ability to parse macro attribute references with a "!" | COMMENT |
| LOW | t/t-progress.sh | 101 | max_pointer_size="$(lfstest-getlimit --max-pointer-size)" | COMMENT |
| LOW | t/t-progress.sh | 141 | git commit -m "add a.dat" | COMMENT |
| LOW | t/t-progress.sh | 161 | GIT_LFS_PROGRESS="$progress_log" GIT_TRACE=1 \ | COMMENT |
| LOW | t/t-progress.sh | 221 | # of tq.TransferQueue reports the final object size in the progress log. | COMMENT |
| LOW | t/t-progress.sh | 241 | grep -c "decompressed gzipped response" pull.log | COMMENT |
| LOW | t/t-fetch.sh | 781 | printf "%s" "$contents" >test.bin | COMMENT |
| LOW | t/t-pull.sh | 1261 | refute_local_object "$contents_oid" | COMMENT |
| LOW | t/t-pull.sh | 1281 | # | COMMENT |
| LOW | t/testlib.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | t/testenv.sh | 101 | TRASHDIR="$TMPDIR/$(basename "$0")-$$" | COMMENT |
| LOW | t/cmd/lfs-ssh-echo.go | 141 | os.Exit(1) | COMMENT |
| LOW | t/cmd/git-credential-lfstest.go | 201 | // Each line in a file is of the following form: | COMMENT |
| LOW | t/cmd/lfstest-count-tests.go | 21 | // lockFile is the path to a file (relative to the $LFSTEST_DIR) who's | COMMENT |
| LOW | tq/transfer_queue.go | 81 | return time.Now().Add(time.Duration(delay) * time.Millisecond) | COMMENT |
| LOW | tq/transfer_queue.go | 421 | // is open, read one item from the `q.incoming` channel. | COMMENT |
| LOW | tq/transfer.go | 221 | } | COMMENT |
| LOW | tq/basic_upload.go | 101 | if errors.IsUnprocessableEntityError(err) { | COMMENT |
| LOW | script/lib/distro.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | subprocess/path_windows.go | 1 | // Copyright 2010 The Go Authors. All rights reserved. | COMMENT |
| LOW | subprocess/path.go | 1 | // Copyright 2010 The Go Authors. All rights reserved. | COMMENT |
| LOW | subprocess/path_nix.go | 1 | // Copyright 2010 The Go Authors. All rights reserved. | COMMENT |
| LOW | lfshttp/endpoint.go | 61 | COMMENT | |
| LOW | lfshttp/ssh.go | 21 | // exits with this status, we treat the `git-lfs-authenticate` command as | COMMENT |
| LOW | lfsapi/auth.go | 141 | return c.doWithAuth("", access, redirectedReq, via) | COMMENT |
| LOW | lfs/scanner_git_test.go | 161 | // Previous commits excludes final state of each file, which is: | COMMENT |
| LOW | lfs/diff_index_scanner.go | 81 | // octal. | COMMENT |
| LOW | lfs/diff_index_scanner.go | 101 | } | COMMENT |
| LOW | lfs/diff_index_scanner.go | 121 | // tree. | COMMENT |
| LOW | lfs/gitscanner_refs.go | 121 | // and invokes the provided callback for each pointer file, valid or invalid, | COMMENT |
| LOW | commands/run.go | 21 | commandMu sync.Mutex | COMMENT |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | t/t-push.sh | 855 | # Create a tag. Normally this would cause the entire history to be traversed | COMMENT |
| MEDIUM | t/testhelpers.sh | 1131 | # Create a pkt-line message from s, which is an argument string to printf(1). | COMMENT |
| MEDIUM | t/t-duplicate-oids.sh | 26 | # Create a pointer with the old "http://git-media.io" spec | COMMENT |
| MEDIUM | t/t-duplicate-oids.sh | 28 | # Create a pointer with the latest spec to create a modification, but leave | COMMENT |
| MEDIUM | t/t-fsck.sh | 13 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-fsck.sh | 59 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-fsck.sh | 110 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-fsck.sh | 165 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-fsck.sh | 363 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-status.sh | 408 | # Create an unstaged change against a source file that doesn't exist. | COMMENT |
| MEDIUM | t/t-dedup.sh | 28 | # Create a commit with some files tracked by git-lfs | COMMENT |
| MEDIUM | t/t-migrate-info.sh | 881 | # Create an ambiguously named reference sharing the name as the SHA-1 of | COMMENT |
| MEDIUM | t/t-batch-storage-retries.sh | 229 | # Create a corrupt partial download file smaller than the actual object. | COMMENT |
| MEDIUM | t/t-batch-storage-retries.sh | 251 | # Create a corrupt partial download file equal in size to the actual object. | COMMENT |
| MEDIUM | t/t-migrate-import.sh | 798 | # Create an ambiguously named reference sharing the name as the SHA-1 of | COMMENT |
| MEDIUM | t/t-checkout.sh | 1079 | # Create a partial clone with a cone-mode sparse checkout of one directory | COMMENT |
| MEDIUM | t/t-pull.sh | 1358 | # Create a partial clone with a cone-mode sparse checkout of one directory | COMMENT |
| MEDIUM | t/t-pointer.sh | 605 | # Create a pointer WITHOUT extension info | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 119 | # This file contains the URL of the test Git server. See the "Test Suite" | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 123 | # This file contains the SSL URL of the test Git server. See the "Test Suite" | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 127 | # This file contains the client cert SSL URL of the test Git server. See the "Test Suite" | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 131 | # This file contains the self-signed SSL cert of the TLS endpoint of the test Git server. | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 134 | # This file contains the client certificate of the client cert endpoint of the test Git server. | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 137 | # This file contains the client key of the client cert endpoint of the test Git server. | COMMENT |
| MEDIUM⚡ | t/testenv.sh | 140 | # This file contains the encrypted client key of the client cert endpoint of the test Git server. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config/config_test.go | 273 | "user.email": []string{"pdoe@example.org"}, | CODE |
| LOW | config/config_test.go | 282 | assert.Equal(t, email, "pdoe@example.org") | CODE |
| LOW | config/config_test.go | 300 | "user.email": []string{"pdoe@example.org"}, | CODE |
| LOW | config/config_test.go | 316 | "user.email": []string{"pdoe@example.org"}, | CODE |
| LOW | config/config_test.go | 327 | assert.Equal(t, email, "pdoe@example.org") | CODE |
| LOW | docs/api/locking.md | 81 | "name": "Jane Doe" | CODE |
| LOW | docs/api/locking.md | 196 | "name": "Jane Doe" | CODE |
| LOW | docs/api/locking.md | 312 | "name": "Jane Doe" | CODE |
| LOW | docs/api/locking.md | 427 | "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_notes.md | 46 | < "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_notes.md | 76 | < "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_notes.md | 106 | < "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_notes.md | 146 | < "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_notes.md | 185 | < "name": "Jane Doe" | CODE |
| LOW | docs/proposals/locking_api.md | 22 | > name: "Jane Doe", | CODE |
| LOW | docs/proposals/locking_api.md | 40 | < name: "Jane Doe", | CODE |
| LOW | docs/proposals/locking_api.md | 108 | < name: "Jane Doe", | CODE |
| LOW | docs/proposals/locking_api.md | 159 | < name: "Jane Doe", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | t/t-progress.sh | 168 | # unknown. For a more comprehensive test of gzip-encoding, see the | COMMENT |
| MEDIUM | t/t-progress.sh | 216 | # unknown. For a more comprehensive test of gzip-encoding, see the | COMMENT |
| LOW | t/t-clean.sh | 145 | # but the file on disk should be smaller, so we just create an empty file. | COMMENT |
| MEDIUM | t/t-install.sh | 100 | # more-comprehensive hook update tests are in test-update.sh | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | script/install.sh | 25 | # Check if the user has permission to install in the specified prefix | COMMENT |