Home / gitpod-io / gitpod
AI Slop Code RIsk Monitor

gitpod-io/gitpod

The developer platform for on-demand cloud development environments to create software faster and more securely.

22.3 Elevated pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for gitpod-io/gitpod, a TypeScript project with 13,794 GitHub stars. SynthScan examined 907,908 lines of code across 3698 source files, recording 3278 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 22.3 (Elevated pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

22.3
Adjusted Signal
22.3
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
13.8K
Stars
TypeScript
Language
907.9K
Lines of Code
3.7K
Files
3.3K
Pattern Hits
2026-10-12
Scan Date
0.79
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 2.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 326 finding(s).

Hallucinated Dependency & Supply Chain Risk 66.4/100 · HIGH

Are imports declared and package/API names verified? 2937 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 164 finding(s).

PR Review Velocity Impact 80.3/100 · CRITICAL

Which changes need focused human review? 3278 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2901HIGH 4MEDIUM 33LOW 340

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3278 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators2901 hits · 19775 pts
SeverityFileLineSnippetContext
CRITICALinstall/installer/pkg/components/minio/helm.go28 if cfg.Config.ObjectStorage.Resources != nil && cfg.Config.ObjectStorage.Resources.Requests.Memory() != nil {CODE
CRITICALinstall/installer/pkg/components/minio/helm.go29 memoryRequests := resource.MustParse(cfg.Config.ObjectStorage.Resources.Requests.Memory().String())CODE
CRITICALcomponents/ide/gha-update-image/lib/code-pin-version.ts33 image: !ideConfigmapJson.ideOptions.options.code.image.includes(latestBuildImage.code),CODE
CRITICALcomponents/ide/gha-update-image/lib/code-pin-version.ts53 const previousCodeVersion = await getIDEVersionOfImage("eu.gcr.io/gitpod-core-dev/build/" + ideConfigmapJson.ideOptiCODE
CRITICALcomponents/ide/gha-update-image/lib/code-pin-version.ts54 const installationCodeVersion = await getIDEVersionOfImage("eu.gcr.io/gitpod-core-dev/build/" + newJson.ideOptions.oCODE
CRITICALcomponents/ide/gha-update-image/lib/code-pin-version.ts66 newJson.ideOptions.options.code.versions.unshift({CODE
CRITICAL…in/io/gitpod/jetbrains/gateway/GitpodWorkspacesView.kt272 if (info.latestInstance.status.conditions.failed.isNullOrBlank()) {CODE
CRITICAL…/jetbrains/remote/GitpodClientProjectSessionTracker.kt105 p.visibility = io.gitpod.gitpodprotocol.api.entities.PortVisibility.PUBLIC.toString()CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java403 // Construct using io.gitpod.publicapi.v1.Pagination.PaginationRequest.newBuilder()COMMENT
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java431 return io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance();CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java445 io.gitpod.publicapi.v1.Pagination.PaginationRequest result = new io.gitpod.publicapi.v1.Pagination.PaginationReqCODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java475 if (other == io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance()) return this;CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java751 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Pagination.PaginationRequest();CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java1125 // Construct using io.gitpod.publicapi.v1.Pagination.PaginationResponse.newBuilder()COMMENT
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java1152 return io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance();CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java1166 io.gitpod.publicapi.v1.Pagination.PaginationResponse result = new io.gitpod.publicapi.v1.Pagination.PaginationReCODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java1193 if (other == io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance()) return this;CODE
CRITICAL…a/src/main/java/io/gitpod/publicapi/v1/Pagination.java1408 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Pagination.PaginationResponse();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java327 // Construct using io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenRequest.newBuilder()COMMENT
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java353 return io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenRequest.getDefaultInstance();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java367 io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenRequest result = new io.gitpod.publicapi.v1.CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java391 if (other == io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenRequest.getDefaultInstance()) rCODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java543 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenRequest();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java873 // Construct using io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenResponse.newBuilder()COMMENT
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java899 return io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenResponse.getDefaultInstance();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java913 io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenResponse result = new io.gitpod.publicapi.v1CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java937 if (other == io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenResponse.getDefaultInstance()) CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java1089 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Verification.SendPhoneNumberVerificationTokenResponse();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java1589 // Construct using io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenRequest.newBuilder()COMMENT
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java1617 return io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenRequest.getDefaultInstance();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java1631 io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenRequest result = new io.gitpod.publicapi.vCODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java1661 if (other == io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenRequest.getDefaultInstance())CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2017 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenRequest();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2306 // Construct using io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenResponse.newBuilder()COMMENT
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2332 return io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenResponse.getDefaultInstance();CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2346 io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenResponse result = new io.gitpod.publicapi.CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2370 if (other == io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenResponse.getDefaultInstance()CODE
CRITICAL…src/main/java/io/gitpod/publicapi/v1/Verification.java2472 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Verification.VerifyPhoneNumberVerificationTokenResponse();CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java737 // Construct using io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsRequest.newBuilder()COMMENT
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2190 // Construct using io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsResponse.newBuilder()COMMENT
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java3594 // Construct using io.gitpod.publicapi.v1.Auditlogs.AuditLog.newBuilder()COMMENT
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java252 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance() : paginationCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java263 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance() : paginationCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java788 return io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsRequest.getDefaultInstance();CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java802 io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsRequest result = new io.gitpod.publicapi.v1.Auditlogs.ListAuditLogCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java852 if (other == io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsRequest.getDefaultInstance()) return this;CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java980 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance() : paginaCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java1034 pagination_ != io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance()) {CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java1089 io.gitpod.publicapi.v1.Pagination.PaginationRequest.getDefaultInstance() : pagination_;CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java1737 DEFAULT_INSTANCE = new io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsRequest();CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java1920 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance() : paginatioCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java1931 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance() : paginatioCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2234 return io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsResponse.getDefaultInstance();CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2248 io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsResponse result = new io.gitpod.publicapi.v1.Auditlogs.ListAuditLoCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2290 if (other == io.gitpod.publicapi.v1.Auditlogs.ListAuditLogsResponse.getDefaultInstance()) return this;CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2356 io.gitpod.publicapi.v1.Auditlogs.AuditLog.parser(),CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2407 return pagination_ == null ? io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance() : paginCODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2461 pagination_ != io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance()) {CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2516 io.gitpod.publicapi.v1.Pagination.PaginationResponse.getDefaultInstance() : pagination_;CODE
CRITICAL…va/src/main/java/io/gitpod/publicapi/v1/Auditlogs.java2721 com.google.protobuf.AbstractMessageLite.Builder.addAll(CODE
2841 more matches not shown…
Hyper-Verbose Identifiers149 hits · 151 pts
SeverityFileLineSnippetContext
LOWcomponents/ide/gha-update-image/lib/code-pin-version.ts21export async function updateCodeIDEConfigMapJson() {CODE
LOW…onents/ide/gha-update-image/lib/jb-helper/jb-helper.ts70export function parseGradlePropertiesFromTaskConfig(CODE
LOWcomponents/gitpod-protocol/src/workspace-cluster.ts92 export function isHasPermissionConstraint(o: any): o is AdmissionConstraintHasPermission {CODE
LOW…ents/gitpod-protocol/src/frontend-dashboard-service.ts113 export function isFeatureFlagsUpdateEventData(obj: any): obj is FeatureFlagsUpdateEventData {CODE
LOW…ents/gitpod-protocol/src/frontend-dashboard-service.ts117 export function isFeatureFlagsRequestEventData(obj: any): obj is FeatureFlagsRequestEventData {CODE
LOWcomponents/gitpod-protocol/src/env.ts20export function filePathTelepresenceAware(filePath: string): string {CODE
LOW…s/gitpod-protocol/src/encryption/encryption-service.ts58export function getGlobalEncryptionService() {CODE
LOWcomponents/gitpod-protocol/src/util/analytics.ts11export function newAnalyticsWriterFromEnv(): IAnalyticsWriter {CODE
LOWcomponents/gitpod-protocol/src/util/nice-grpc.ts43export function prometheusClientMiddleware(metrics: IClientCallMetrics): ClientMiddleware {CODE
LOWcomponents/gitpod-protocol/src/util/timeutil.ts80export function durationLongerThanSeconds(time: number, durationSeconds: number, now: number = Date.now()): boolean {CODE
LOWcomponents/gitpod-protocol/src/util/timeutil.ts92export function goDurationToHumanReadable(goDuration: string): string {CODE
LOWcomponents/gitpod-protocol/src/util/grpc.ts64export function createClientCallMetricsInterceptor(metrics: IClientCallMetrics): grpc.Interceptor {CODE
LOWcomponents/gitpod-protocol/src/util/grpc.ts113export function createDebugLogInterceptor(additionalContextF: (() => object) | undefined): grpc.Interceptor {CODE
LOW…ts/gitpod-protocol/src/experiments/configcat-server.ts32export function getExperimentsClientForBackend(): Client {CODE
LOW…ents/gitpod-protocol/src/experiments/always-default.ts22export function newAlwaysReturningDefaultValueClient(): Client {CODE
LOW…ts/gitpod-protocol/src/messaging/browser/connection.ts131function createWebSocketConnection(resocket: ReconnectingWebSocket, logger: Logger) {CODE
LOW…od-protocol/src/messaging/browser/window-connection.ts73export function createWindowMessageConnection(CODE
LOW…nents/gitpod-protocol/src/messaging/node/connection.ts50export function createWebSocketConnection(socket: IWebSocket, logger: Logger) {CODE
LOWcomponents/gitpod-db/src/wait-for-db.ts38function rescheduleConnectionAttempt(attempt: number, err: unknown) {CODE
LOWcomponents/gitpod-db/src/typeorm/metrics.ts30export function reportPrebuiltWorkspacePurged(count: number) {CODE
LOWcomponents/gitpod-db/src/typeorm/metrics.ts48export function reportWorkspaceInstancePurged(count: number) {CODE
LOWcomponents/gitpod-db/src/typeorm/metrics.ts57export function reportPrebuiltWorkspaceUpdatablePurged(count: number) {CODE
LOWcomponents/ws-manager-bridge/src/bridge.ts518function mergeWorkspaceInstanceMetrics(CODE
LOW…nts/public-api/typescript-common/src/auth-providers.ts112export function getScopesForAuthProviderType(type: AuthProviderType | string) {CODE
LOW…ponents/public-api/typescript-common/src/user-utils.ts85export function isAllowedToCreateOrganization(CODE
LOWcomponents/spicedb/typescript/src/impl/v1/impl.pb.ts415function createBaseDecodedZedToken(): DecodedZedToken {CODE
LOWcomponents/spicedb/typescript/src/impl/v1/impl.pb.ts827function createBaseRelationMetadata(): RelationMetadata {CODE
LOWcomponents/spicedb/typescript/src/impl/v1/impl.pb.ts888function createBaseNamespaceAndRevision(): NamespaceAndRevision {CODE
LOWcomponents/server/src/express-util.ts174function validateReturnToUrlWithPatterns(CODE
LOWcomponents/server/src/express-util.ts231export function validateAuthorizeReturnToUrl(returnTo: string, hostUrl: GitpodHostUrl): boolean {CODE
LOWcomponents/server/src/prometheus-metrics.ts98export function increaseApiConnectionCounter() {CODE
LOWcomponents/server/src/prometheus-metrics.ts126export function increaseApiConnectionClosedCounter() {CODE
LOWcomponents/server/src/prometheus-metrics.ts157export function increaseHttpRequestCounter(method: string, route: string, statusCode: number) {CODE
LOWcomponents/server/src/prometheus-metrics.ts168export function observeHttpRequestDuration(CODE
LOWcomponents/server/src/prometheus-metrics.ts193export function increaseSuccessfulInstanceStartCounter(retries: number = 0) {CODE
LOW⚡components/server/src/prometheus-metrics.ts213export function increaseFailedInstanceStartCounter(reason: FailedInstanceStartReason) {CODE
LOW⚡components/server/src/prometheus-metrics.ts222export function increasePrebuildsStartedCounter() {CODE
LOW⚡components/server/src/prometheus-metrics.ts232export function observeStripeClientRequestsCompleted(operation: string, outcome: string, durationInSeconds: number) {CODE
LOW⚡components/server/src/prometheus-metrics.ts241export function increaseImageBuildsStartedTotal() {CODE
LOW⚡components/server/src/prometheus-metrics.ts251export function increaseImageBuildsCompletedTotal(outcome: "succeeded" | "failed") {CODE
LOWcomponents/server/src/prometheus-metrics.ts266export function observeSpicedbClientLatency(operation: string, outcome: Error | undefined, durationInSeconds: number) {CODE
LOWcomponents/server/src/prometheus-metrics.ts331export function reportRedisUpdateReceived(channel: string) {CODE
LOWcomponents/server/src/prometheus-metrics.ts341export function reportRedisUpdateCompleted(channel: string, err?: Error) {CODE
LOWcomponents/server/src/prometheus-metrics.ts374export function incSpiceDBRequestsCheckTotal(consistency: SpiceDBCheckConsistency) {CODE
LOWcomponents/server/src/prometheus-metrics.ts384export function reportAuthorizerSubjectId(match: AuthorizerSubjectIdMatch) {CODE
LOWcomponents/server/src/prometheus-metrics.ts402export function reportScmTokenRefreshRequest(CODE
LOW…/server/src/oauth-server/oauth-authorization-server.ts20export function createAuthorizationServer(CODE
LOWcomponents/server/src/util/featureflags.ts11export async function getFeatureFlagEnableExperimentalJBTB(userId: string): Promise<boolean> {CODE
LOWcomponents/server/src/util/featureflags.ts17export async function getClassicPaygSunsetConfig(userId: string): Promise<ClassicPaygSunsetConfig> {CODE
LOWcomponents/server/src/util/featureflags.ts38export async function isWorkspaceStartBlockedBySunset(CODE
LOWcomponents/server/src/util/featureflags.ts63export async function isUserLoginBlockedBySunset(user: User, isDedicatedInstallation: boolean): Promise<boolean> {CODE
LOWcomponents/server/src/util/featureflags.ts89export async function isUserSignupBlockedBySunset(userId: string, isDedicatedInstallation: boolean): Promise<boolean> {CODE
LOWcomponents/server/src/util/grpc-web-ws-transport.ts123function constructWebSocketAddress(url: string) {CODE
LOWcomponents/server/src/express/ws-connection-handler.ts150function getOrSetClosingTimestamp(ws: websocket, timestamp: number = Date.now()): number {CODE
LOWcomponents/server/src/auth/jwt.ts141export function decodeWithoutVerification(encoded: string, options?: jsonwebtoken.DecodeOptions): jsonwebtoken.Jwt {CODE
LOW…ponents/server/src/auth/api-subdomain-redirect.spec.ts11 function isApiSubdomainOfConfiguredHost(hostname: string, configuredHost: string): boolean {CODE
LOWcomponents/server/src/auth/function-access.ts29export function isWithFunctionAccessGuard(obj: any): obj is WithFunctionAccessGuard {CODE
LOWcomponents/server/src/auth/auth-provider.ts39export function parseAuthProviderParamsFromEnv(json: object): AuthProviderParams[] {CODE
LOWcomponents/server/src/auth/auth-provider.ts45export function normalizeAuthProviderParams(CODE
LOWcomponents/server/src/auth/resource-access.ts393 export function marshalResourceScopeFromResource(resource: GuardedResource, ops: ResourceAccessOp[]): string {CODE
89 more matches not shown…
Over-Commented Block138 hits · 138 pts
SeverityFileLineSnippetContext
LOWtest/report.sh1#!/usr/bin/env bashCOMMENT
LOWtest/run.sh1#!/usr/bin/env bashCOMMENT
LOWcomponents/proxy/plugins/analytics/analytics.go81func newSegmentProxy(segmentEndpoint *url.URL, errorLog *log.Logger) http.Handler {COMMENT
LOWcomponents/proxy/plugins/logif/caddyfile.go1// Copyright (c) 2021 Gitpod GmbH. All rights reserved.COMMENT
LOWcomponents/gitpod-cli/cmd/credential-helper.go221 }COMMENT
LOWcomponents/gitpod-protocol/go/gitpod-service.go2301 Label string `json:"label,omitempty"`COMMENT
LOWcomponents/gitpod-protocol/src/protocol.ts441 }COMMENT
LOW…b/src/typeorm/migration/1643986994402-OAuthRevision.ts21 );COMMENT
LOWcomponents/image-builder-bob/ide-startup.sh1#!/bin/bashCOMMENT
LOWcomponents/image-builder-bob/pkg/proxy/proxy.go241COMMENT
LOWcomponents/image-builder-bob/pkg/proxy/proxy.go361 }COMMENT
LOWcomponents/public-api/go/v1/scm_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/user_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/user_grpc.pb.go141 return out, nilCOMMENT
LOWcomponents/public-api/go/v1/ssh_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/error.pb.go181// Deprecated: Use NeedsVerificationError.ProtoReflect.Descriptor instead.COMMENT
LOWcomponents/public-api/go/v1/installation_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/envvar_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/envvar_grpc.pb.go41 // ListConfigurationEnvironmentVariables returns all environment variables inCOMMENT
LOWcomponents/public-api/go/v1/envvar_grpc.pb.go201 // authenticated user.COMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go301 // Preparing means that we haven't actually started the workspace instanceCOMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go321 WorkspacePhase_PHASE_INITIALIZING WorkspacePhase_Phase = 5COMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go1161 sizeCache protoimpl.SizeCacheCOMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go2021 // Git configures the Git user in the workspaceCOMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go2181 // workspace is in its lifecycleCOMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go2361 unknownFields protoimpl.UnknownFieldsCOMMENT
LOWcomponents/public-api/go/v1/workspace.pb.go4961 unknownFields protoimpl.UnknownFieldsCOMMENT
LOWcomponents/public-api/go/v1/workspace_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/workspace_grpc.pb.go41 ListWorkspaceSessions(ctx context.Context, in *ListWorkspaceSessionsRequest, opts ...grpc.CallOption) (*ListWorkspaceSeCOMMENT
LOWcomponents/public-api/go/v1/workspace_grpc.pb.go281 GetWorkspace(context.Context, *GetWorkspaceRequest) (*GetWorkspaceResponse, error)COMMENT
LOWcomponents/public-api/go/v1/workspace_grpc.pb.go301 // When the workspace is running, it will be stopped as well.COMMENT
LOWcomponents/public-api/go/v1/authprovider_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/user.pb.go1121 // last_verification_time is the last time this account was verified.COMMENT
LOWcomponents/public-api/go/v1/user.pb.go1141 // +optionalCOMMENT
LOWcomponents/public-api/go/v1/user.pb.go1881 // the user's company nameCOMMENT
LOWcomponents/public-api/go/v1/user.pb.go1901 // what user hopes to accomplish when they signed upCOMMENT
LOWcomponents/public-api/go/v1/organization_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOWcomponents/public-api/go/v1/organization_grpc.pb.go41 // JoinOrganization makes the caller a OrganizationMember of the Organization.COMMENT
LOWcomponents/public-api/go/v1/organization_grpc.pb.go261 // UpdateOrganizationMember updates organization membership properties.COMMENT
LOWcomponents/public-api/go/v1/organization.pb.go901 AllowedWorkspaceClasses []string `protobuf:"bytes,5,rep,name=allowed_workspace_classes,json=allowedWorkspaceClasses,proCOMMENT
LOWcomponents/public-api/go/v1/v1connect/scm.connect.go21// compatible. If you get a compiler error that this constant is not defined, this code wasCOMMENT
LOWcomponents/public-api/go/v1/v1connect/user.connect.go41 // DeleteUser deletes the specified user.COMMENT
LOWcomponents/public-api/go/v1/v1connect/user.connect.go181 UpdateUser(context.Context, *connect_go.Request[v1.UpdateUserRequest]) (*connect_go.Response[v1.UpdateUserResponse], erCOMMENT
LOWcomponents/public-api/go/v1/v1connect/ssh.connect.go21// compatible. If you get a compiler error that this constant is not defined, this code wasCOMMENT
LOW…nts/public-api/go/v1/v1connect/installation.connect.go41 // DeleteBlockedRepository deletes a blocked repository.COMMENT
LOWcomponents/public-api/go/v1/v1connect/envvar.connect.go21// compatible. If you get a compiler error that this constant is not defined, this code wasCOMMENT
LOWcomponents/public-api/go/v1/v1connect/envvar.connect.go41 UpdateUserEnvironmentVariable(context.Context, *connect_go.Request[v1.UpdateUserEnvironmentVariableRequest]) (*connect_COMMENT
LOWcomponents/public-api/go/v1/v1connect/envvar.connect.go61 // an organization.COMMENT
LOWcomponents/public-api/go/v1/v1connect/envvar.connect.go241COMMENT
LOWcomponents/public-api/go/v1/v1connect/envvar.connect.go261 // authenticated user.COMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go21// compatible. If you get a compiler error that this constant is not defined, this code wasCOMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go41 // workspace_id +return NOT_FOUND Workspace does not existCOMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go61 // ListWorkspaceClasses enumerates all available workspace classes.COMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go301type WorkspaceServiceHandler interface {COMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go321 // UpdateWorkspace updates the workspace.COMMENT
LOW…onents/public-api/go/v1/v1connect/workspace.connect.go341 // GetWorkspaceEditorCredentials returns an credentials that is used in editorCOMMENT
LOW…nts/public-api/go/v1/v1connect/organization.connect.go61 // ListOrganizationWorkspaceClasses lists workspace classes of aCOMMENT
LOW…nts/public-api/go/v1/v1connect/organization.connect.go321 // ListOrganizationWorkspaceClasses lists workspace classes of aCOMMENT
LOW…ts/public-api/go/experimental/v1/workspaces_grpc.pb.go21// is compatible with the grpc package it is being compiled against.COMMENT
LOW…ts/public-api/go/experimental/v1/workspaces_grpc.pb.go201 CreateAndStartWorkspace(context.Context, *CreateAndStartWorkspaceRequest) (*CreateAndStartWorkspaceResponse, error)COMMENT
78 more matches not shown…
Decorative Section Separators14 hits · 47 pts
SeverityFileLineSnippetContext
MEDIUMcomponents/ide/jetbrains/launcher/main_test.go93 platformProperties := `#---------------------------------------------------------------------CODE
MEDIUMcomponents/ide/jetbrains/launcher/main_test.go95 #---------------------------------------------------------------------COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh114# ====================================COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh116# ====================================COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh142# =============COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh144# =============COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh495# ===============COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh497# ===============COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh534# ===============COMMENT
MEDIUMdev/preview/workflow/preview/deploy-gitpod.sh536# ===============COMMENT
MEDIUM⚡dev/preview/workflow/preview/deploy-gitpod.sh560# =========================COMMENT
MEDIUM⚡dev/preview/workflow/preview/deploy-gitpod.sh562# =========================COMMENT
MEDIUM⚡dev/preview/workflow/preview/deploy-gitpod.sh567# =====================COMMENT
MEDIUM⚡dev/preview/workflow/preview/deploy-gitpod.sh569# =====================COMMENT
Modern AI Meta-Vocabulary14 hits · 46 pts
SeverityFileLineSnippetContext
MEDIUMcomponents/node-labeler/cmd/run_test.go125 //+kubebuilder:scaffold:schemeCOMMENT
MEDIUMcomponents/ws-daemon/pkg/controller/suite_test.go26 //+kubebuilder:scaffold:importsCOMMENT
MEDIUMcomponents/ws-daemon/pkg/controller/suite_test.go74 //+kubebuilder:scaffold:schemeCOMMENT
MEDIUM…ponents/ws-manager-api/go/crd/v1/webhook_suite_test.go21 //+kubebuilder:scaffold:importsCOMMENT
MEDIUM…ponents/ws-manager-api/go/crd/v1/webhook_suite_test.go79 //+kubebuilder:scaffold:schemeCOMMENT
MEDIUM…ponents/ws-manager-api/go/crd/v1/webhook_suite_test.go103 //+kubebuilder:scaffold:webhookCOMMENT
MEDIUMcomponents/ws-manager-mk2/main.go53 //+kubebuilder:scaffold:importsCOMMENT
MEDIUMcomponents/ws-manager-mk2/main.go74 //+kubebuilder:scaffold:schemeCOMMENT
MEDIUMcomponents/ws-manager-mk2/main.go235 //+kubebuilder:scaffold:builderCOMMENT
MEDIUM⚡components/ws-manager-mk2/config/crd/kustomization.yaml11#+kubebuilder:scaffold:crdkustomizeresourceCOMMENT
MEDIUM⚡components/ws-manager-mk2/config/crd/kustomization.yaml18#+kubebuilder:scaffold:crdkustomizewebhookpatchCOMMENT
MEDIUM⚡components/ws-manager-mk2/config/crd/kustomization.yaml24#+kubebuilder:scaffold:crdkustomizecainjectionpatchCOMMENT
MEDIUMcomponents/ws-manager-mk2/controllers/suite_test.go28 //+kubebuilder:scaffold:importsCOMMENT
MEDIUMcomponents/ws-manager-mk2/controllers/suite_test.go76 //+kubebuilder:scaffold:schemeCOMMENT
Fake / Example Data36 hits · 40 pts
SeverityFileLineSnippetContext
LOWcomponents/local-app/pkg/telemetry/telemetry.go54 opts.client, _ = segment.NewWithConfig("untrusted-dummy-key", segment.Config{CODE
LOWcomponents/proxy/plugins/analytics/analytics.go28 dummyUntrustedSegmentKey = "untrusted-dummy-key"CODE
LOWcomponents/gitpod-protocol/src/util/scrubbing.spec.ts18 expect(scrubber.scrub("foo@bar.com")).to.equal("[redacted:email]");CODE
LOW⚡components/gitpod-protocol/src/util/scrubbing.spec.ts51 expect(scrubber.scrub([["foo@bar.com"]])).to.deep.equal([["[redacted:email]"]]);CODE
LOW⚡components/gitpod-protocol/src/util/scrubbing.spec.ts55 expect(scrubber.scrub([["foo@bar.com"]], false)).to.deep.equal(["[redacted:nested:array]"]);CODE
LOW⚡components/gitpod-protocol/src/util/scrubbing.spec.ts59 const scrubbedValue = new TrustedValue(scrubber.scrubValue("foo@bar.com"));CODE
LOWcomponents/gitpod-db/src/user-db.spec.db.ts336 export const primaryEmail = "foo@bar.com";CODE
LOWcomponents/scrubber/example_test.go19 var someJSONData = json.RawMessage(`{"email": "foo@bar.com", "username": "foobar", "orgID": "112233", "desc": "the emaiCODE
LOWcomponents/scrubber/example_test.go24 Email: "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go23 {Name: "email", Value: "foo@bar.com", Expectation: "[redacted:email]"},CODE
LOWcomponents/scrubber/scrubber_test.go121 }{Username: "foo", Email: "foo@bar.com", Password: "foobar", WorkspaceID: "gitpodio-gitpod-uesaddev73c", ContextURL: CODE
LOWcomponents/scrubber/scrubber_test.go139 "email": "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go150 }{Slice: []string{"foo", "bar", "foo@bar.com"}},CODE
LOWcomponents/scrubber/scrubber_test.go184 Email: "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go201 Email: "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go260 Input: `{"ok": true, "email": "foo@bar.com", "workspaceID": "gitpodio-gitpod-uesaddev73c"}`,CODE
LOWcomponents/scrubber/scrubber_test.go280 Input: `"foo@bar.com"`,CODE
LOWcomponents/scrubber/scrubber_test.go285 Input: `["foo@bar.com"]`,CODE
LOWcomponents/scrubber/scrubber_test.go326 }{Username: "foo", Email: "foo@bar.com", Password: "foobar", WorkspaceID: "gitpodio-gitpod-uesaddev73c", LeaveMeAloneCODE
LOWcomponents/scrubber/scrubber_test.go345 }{Username: "foo", Email: "foo@bar.com", Password: "foobar", WorkspaceID: "gitpodio-gitpod-uesaddev73c", LeaveMeAloneCODE
LOWcomponents/scrubber/scrubber_test.go362 "email": "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go373 }{Slice: []string{"foo", "bar", "foo@bar.com"}},CODE
LOWcomponents/scrubber/scrubber_test.go407 Email: "foo@bar.com",CODE
LOWcomponents/scrubber/scrubber_test.go424 Email: "foo@bar.com",CODE
LOW⚡components/scrubber/sanitisation_test.go22 {Func: SanitiseRedact, Name: "redact sensitive string", Input: "foo@bar.com", Expectation: "[redacted]"},CODE
LOW⚡components/scrubber/sanitisation_test.go23 {Func: SanitiseRedact, Name: "redact key name", Opts: []SanitiserOption{SanitiseWithKeyName("foo")}, Input: "foo@bar.cCODE
LOW⚡components/scrubber/sanitisation_test.go25 {Func: SanitiseHash, Name: "hash sensitive string", Input: "foo@bar.com", Expectation: "[redacted:md5:f3ada405ce890b6fCODE
LOW⚡components/scrubber/sanitisation_test.go26 {Func: SanitiseHash, Name: "hash key name", Opts: []SanitiserOption{SanitiseWithKeyName("foo")}, Input: "foo@bar.com",CODE
LOWcomponents/server/src/workspace/config-provider.spec.ts25 name: "John Doe",CODE
LOWcomponents/server/src/workspace/context-parser.spec.ts19 name: "John Doe",CODE
LOWcomponents/content-service/pkg/git/git_test.go491 "user.email": "foo@bar.com",CODE
LOWcomponents/content-service/pkg/git/git_test.go506 if err := remote.Git(ctx, "config", "--local", "user.email", "foo@bar.com"); err != nil {CODE
LOWcomponents/content-service/pkg/git/git_test.go526 if err := c.Git(ctx, "config", "--local", "user.email", "foo@bar.com"); err != nil {CODE
LOWcomponents/ws-manager-mk2/controllers/create_test.go39 Email: "foo@bar.com",CODE
LOWcomponents/ws-manager-mk2/controllers/create_test.go55 {Name: "GITPOD_GIT_USER_EMAIL", Value: "foo@bar.com"},CODE
LOWmemory-bank/components/scrubber.md84scrubbedValue := scrubber.Default.Value("user@example.com")CODE
Synthetic Comment Markers4 hits · 30 pts
SeverityFileLineSnippetContext
HIGH…ts/server/src/bitbucket-server/bitbucket-server-api.ts368 // Ensure we only load as many pages as requestedCOMMENT
HIGH…nts/image-builder-mk3/pkg/orchestrator/orchestrator.go736 // If the error is a context.DeadlineExceeded, we return nil (OK) as requested.COMMENT
HIGH…nts/image-builder-mk3/pkg/orchestrator/orchestrator.go745 // Return nil (OK) for DeadlineExceeded as requestedCOMMENT
HIGHcomponents/ws-manager-mk2/pkg/proxy/imagebuilder.go94 // Return nil (OK) for DeadlineExceeded as requestedCOMMENT
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMinstall/preview/entrypoint.sh15# Create a USER_ID to be used everywhereCOMMENT
MEDIUM…ponents/ws-manager-mk2/config/crd/kustomizeconfig.yaml5# This file is for teaching kustomize how to substitute name and namespace reference in CRDCOMMENT
MEDIUMscripts/trivy/trivy-scan-images.sh117 # Create a JSON object for the current scanCOMMENT
Redundant / Tautological Comments5 hits · 8 pts
SeverityFileLineSnippetContext
LOWinstall/preview/entrypoint.sh10# Set Domain to `preview.gitpod-self-hosted.com` if not setCOMMENT
LOWcomponents/gitpod-db/BUILD.yaml76 # Check if a DB is present. If not: start one and wait until it's upCOMMENT
LOWscripts/trivy/trivy-scan-images.sh8# Check if VERSION and FAIL_ON are providedCOMMENT
LOWscripts/trivy/trivy-scan-images.sh119 # Check if trivy_output is valid JSONCOMMENT
LOWscripts/trivy/trivy-scan-images.sh174# Check if we should fail based on vulnerability countsCOMMENT
Structural Annotation Overuse4 hits · 6 pts
SeverityFileLineSnippetContext
LOWcve-mitigation/references/ci-scanning.md15### Step 1: Export SBOMsCOMMENT
LOWcve-mitigation/references/ci-scanning.md33### Step 2: Scan SBOMsCOMMENT
LOWcve-mitigation/references/ci-scanning.md45### Step 3: Check for critical vulnerabilities (scheduled runs only)COMMENT
LOWcve-mitigation/references/ci-scanning.md54### Step 4: Upload artifactsCOMMENT
Example Usage Blocks3 hits · 4 pts
SeverityFileLineSnippetContext
LOWtest/report.sh4# Usage:COMMENT
LOWtest/run.sh5# Usage:COMMENT
LOWdev/preview/test/load-test.sh6# Usage:COMMENT
Slop Phrases4 hits · 4 pts
SeverityFileLineSnippetContext
LOWcomponents/local-app/cmd/workspace-up.go251 doneBanner := fmt.Sprintf("\n\n%s\n\nDon't forget to pull your changes to your local working copy before stopping the CODE
LOWcomponents/server/src/auth/login-completion-handler.ts76 // Don't forget to mark a dynamic provider as verifiedCOMMENT
LOWcomponents/supervisor/pkg/supervisor/docker.go269 fmt.Fprintf(logFile, "If it does not help, please reach out to the support. Don't forget to share your workspace ID:CODE
LOWdev/blowtorch/cmd/inject.go68 log.Warn("Note: Don't forget to restart any pod that uses the service you've just replaced.")CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMcomponents/server/src/prebuilds/github-app.ts157 // To implement this in a more robust way, we'd need to store `repository.id` with the project, nextCOMMENT
Excessive Try-Catch Wrapping1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMcomponents/local-app/pkg/prettyprint/errors.go25 fmt.Fprintf(out, "%s%s\n\n", styleError.Sprint("Error: "), err.Error())CODE
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOWcomponents/gitpod-protocol/src/protocol.ts552 export function getData(value: SSHPublicKeyValue) {CODE