go-admin is a Gin + Vue starter kit for admin applications, supporting Element UI, Arco Design, and Ant Design. Features include multi-tenancy, user management, JWT authentication, RBAC, code generation, a form builder, and scheduled tasks. Build your own admin app in just 3 minutes.
This report summarizes scanner evidence for go-admin-team/go-admin, a Go project with 12,827 GitHub stars. SynthScan examined 56,786 lines of code across 383 source files, recording 168 pattern matches distributed across 2 syntactic categories. The legacy adjusted pattern signal is 3.0 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 167 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 168 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 168 distinct pattern matches across 2 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/migrate/server.go | 141 | COMMENT | |
| LOW | cmd/migrate/server.go | 221 | } | COMMENT |
| LOW | cmd/migrate/status.go | 21 | // stopped partway leaves migrations that all read "applied" and a row that | COMMENT |
| LOW | cmd/migrate/install.go | 41 | Applied []string | COMMENT |
| LOW | cmd/migrate/install.go | 161 | return adminmodels.SysApp{}, false, fmt.Errorf("reading sys_app for %q: %w", code, err) | COMMENT |
| LOW | cmd/migrate/migration/init.go | 81 | type AppRegistrar struct { | COMMENT |
| LOW | cmd/migrate/migration/init.go | 121 | COMMENT | |
| LOW | cmd/migrate/migration/init.go | 141 | if appCode == "" { | COMMENT |
| LOW | cmd/migrate/migration/init.go | 281 | out = append(out, entry) | COMMENT |
| LOW | …tion/version/1786700010000_gen_column_layout_fields.go | 21 | // "unconfigured" two representations instead of one. | COMMENT |
| LOW | …grate/migration/version/1786700011000_gen_menu_apis.go | 21 | // its menus in sys_menu_api_rule. The seed data bound none to the | COMMENT |
| LOW | …/migration/version/1786700003000_soft_delete_marker.go | 241 | return fmt.Errorf("dropping index %s: %w", name, err) | COMMENT |
| LOW | …/migration/version/1786700003000_soft_delete_marker.go | 261 | // symptom was a login rejecting a correct password: the migration had stopped | COMMENT |
| LOW | cmd/migrate/migration/version/schema_coverage_test.go | 181 | // softDeleteConversion is the version at which sys_api, sys_menu and the rest | COMMENT |
| LOW | cmd/migrate/migration/version/schema_coverage_test.go | 201 | // is still nullable. Only a migration added afterwards hits it, which in | COMMENT |
| LOW | …migration/version/1786700009000_job_scheduler_lease.go | 21 | // and nothing else. | COMMENT |
| LOW | …e/migration/version/1786700008000_seed_natural_keys.go | 81 | // drivers this repository registers. | COMMENT |
| LOW | …e/migration/version/1786700008000_seed_natural_keys.go | 121 | // independent, backward-incompatible change of its own - existing NULL | COMMENT |
| LOW | …e/migration/version/1786700008000_seed_natural_keys.go | 141 | // dialect, but MySQL specifically has to be checked by hand, since this | COMMENT |
| LOW | …ration/version/1786700008000_seed_natural_keys_test.go | 221 | var applied common.Migration | COMMENT |
| LOW | …ration/version/1786700008000_seed_natural_keys_test.go | 261 | } | COMMENT |
| LOW | cmd/api/server.go | 101 | // startCronJobs registers the job implementations and starts a scheduler for | COMMENT |
| LOW | cmd/api/server.go | 121 | // | COMMENT |
| LOW | cmd/api/server.go | 261 | } | COMMENT |
| LOW | cmd/api/server.go | 281 | // kill the process outright. | COMMENT |
| LOW | cmd/api/server.go | 301 | // line and the listener closing, the two are microseconds apart and a | COMMENT |
| LOW | cmd/api/server.go | 421 | "were about to finish is lost. It needs at least %ds more, or %ds less budget.", | COMMENT |
| LOW | cmd/api/server.go | 441 | // so at start-up. | COMMENT |
| LOW | cmd/api/server.go | 461 | func armStopSignals() (<-chan os.Signal, func()) { | COMMENT |
| LOW | cmd/api/server.go | 481 | // | COMMENT |
| LOW | cmd/api/server.go | 541 | // stops waiting and returns; a callback that never looks at its context carries | COMMENT |
| LOW | cmd/api/server.go | 561 | sdk.Runtime.RunPhase(runtime.BeforeRouter) | COMMENT |
| LOW | cmd/api/server.go | 621 | // probePaths are the two routes the rate limiter must not answer for. | COMMENT |
| LOW | cmd/api/shutdown_test.go | 41 | } | COMMENT |
| LOW | cmd/api/signal_test.go | 21 | otherrouter "go-admin/app/other/router" | COMMENT |
| LOW | cmd/api/signal_test.go | 441 | // once SIGTERM is registered, a shutdown that hangs could not be interrupted by | COMMENT |
| LOW | cmd/api/signal_test.go | 561 | if err := cmd.Wait(); err != nil { | COMMENT |
| LOW | cmd/api/schema.go | 21 | // | COMMENT |
| LOW | cmd/api/schema.go | 41 | // Any one of them, rather than only the tenant being served: migrations are | COMMENT |
| LOW | cmd/api/phase_test.go | 101 | } | COMMENT |
| LOW | tools/checksilent/datascope.go | 41 | // the context it hands back a zero value, whose DataScope is the empty string - | COMMENT |
| LOW | tools/checksilent/checks.go | 101 | // | COMMENT |
| LOW | tools/checksilent/checks.go | 161 | " Use the runtime models under app/ instead.", | COMMENT |
| LOW | tools/checksilent/checks.go | 341 | // contractRoots are the trees that may not depend on a business module. core/ | COMMENT |
| LOW | tools/checksilent/checks.go | 421 | coreModulePrefix = "github.com/go-admin-team/go-admin-core/" | COMMENT |
| LOW | tools/checksilent/checks.go | 441 | // error, but only in code that actually uses the method set. | COMMENT |
| LOW | tools/checksilent/checks.go | 561 | // the two shapes it is written in. | COMMENT |
| LOW | tools/checksilent/menuname.go | 21 | defineOptionsName = regexp.MustCompile(`defineOptions\(\s*\{[^}]*?name:\s*['"` + "`" + `]([^'"` + "`" + `]+)['"` + "`" | COMMENT |
| LOW | tools/checksilent/shutdownbudget.go | 21 | pkgHostConfig = "config" | COMMENT |
| LOW | tools/checksilent/shutdownbudget.go | 41 | // | COMMENT |
| LOW | tools/checksilent/shutdownbudget.go | 141 | // | COMMENT |
| LOW | tools/checksilent/shutdownbudget.go | 301 | }) | COMMENT |
| LOW | tools/checksilent/snapshot.go | 41 | // isTest reports whether this file is a _test.go. | COMMENT |
| LOW | tools/checksilent/main.go | 1 | // Command checksilent reports the failures in this repository that do not | COMMENT |
| LOW | app/other/apis/tools/gen.go | 561 | return out, nil | COMMENT |
| LOW | app/other/apis/tools/column_width.go | 21 | // e.g. "varchar(255)", "int(11)", "decimal(10,2)", "tinyint(1)" - and | COMMENT |
| LOW | app/other/apis/tools/sys_tables.go | 141 | } | COMMENT |
| LOW | app/other/apis/tools/sys_tables.go | 201 | COMMENT | |
| LOW | app/other/apis/tools/sys_tables_validate.go | 21 | // importer from the column name (sys_tables.go's namelist/JsonField loop) - | COMMENT |
| LOW | app/other/apis/tools/sys_tables_validate.go | 41 | colWidthMin = 40 | COMMENT |
| 107 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | static/form-generator/js/index.8e6d9f8f.js | 1 | (function(e){function t(t){for(var o,n,c=t[0],r=t[1],s=t[2],u=0,d=[];u<c.length;u++)n=c[u],Object.prototype.hasOwnProper | CODE |