3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

40.2K

Stars

Language

245.8K

Lines of Code

505

Files

443

Pattern Hits

2026-10-31

Scan Date

0.06

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 387 finding(s).

Hallucinated Dependency & Supply Chain Risk 7.0/100 · LOW

Are imports declared and package/API names verified? 56 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 13.5/100 · LOW

Which changes need focused human review? 443 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 30HIGH 0MEDIUM 1LOW 412

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 443 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block369 hits · 350 pts

Severity	File	Line	Snippet	Context
LOW	req_interface_gen.go	21	// Per RFC 9110 §12.5.3, a missing Accept-Encoding accepts any coding (the first	COMMENT
LOW	req_interface_gen.go	41	// decodeContentCoding undoes one content coding of src's body within BodyLimit.	COMMENT
LOW	req_interface_gen.go	61	FullURL() string	COMMENT
LOW	req_interface_gen.go	81	// Repeated field lines are combined into one comma-joined list (RFC 9110	COMMENT
LOW	req_interface_gen.go	121	// Defaults to the empty string "" if the cookie doesn't exist.	COMMENT
LOW	req_interface_gen.go	141	FormFile(key string) (*multipart.FileHeader, error)	COMMENT
LOW	req_interface_gen.go	161	// requires If-Modified-Since to be ignored otherwise.	COMMENT
LOW	req_interface_gen.go	181	// first, or nil when the header is absent. Empty lines are skipped, so its	COMMENT
LOW	req_interface_gen.go	201	// Returned value is only valid within the handler. Do not store any references.	COMMENT
LOW	req_interface_gen.go	221	// enabled but only UnixSocket trusted, the first valid IP from the left is returned. With	COMMENT
LOW	req_interface_gen.go	241	// isTrustedProxyIP checks whether the given IP string matches any configured trusted proxy.	COMMENT
LOW	req_interface_gen.go	261	// and therefore available to all following routes that match the request.	COMMENT
LOW	req_interface_gen.go	281	// value directly, so that slice is never built. Boxing a value that is not	COMMENT
LOW	req_interface_gen.go	301	// call. Copy it first if you need it to outlive one.	COMMENT
LOW	req_interface_gen.go	321	Params(key string, defaultValue ...string) string	COMMENT
LOW	req_interface_gen.go	341	// Queries()["field1"] == "value2"	COMMENT
LOW	req_interface_gen.go	361	// Subdomains returns a slice of subdomains from the host, excluding the last `offset` components.	COMMENT
LOW	register.go	41	// return c.Next()	COMMENT
LOW	domain.go	221	// DomainParam returns the value of a domain parameter from the context.	COMMENT
LOW	domain.go	241		COMMENT
LOW	domain.go	421	//	COMMENT
LOW	domain.go	441	// marks the routes of the apps that register no automatic HEAD routes.	COMMENT
LOW	domain.go	461	// the lock of the app they belong to, so reading them unguarded would race	COMMENT
LOW	domain.go	521	// a placeholder route that carries its target app in the unexported group	COMMENT
LOW	domain.go	561	// An app that does not serve HEAD, or that turned the automatic routes off,	COMMENT
LOW	error.go	41	// 400 Bad Request status so propagating it does not surface as a 500.	COMMENT
LOW	color.go	1	// ⚡️ Fiber is an Express inspired web framework written in Go with ☕️	COMMENT
LOW	color.go	21	// Optional. Default: "\u001b[92m"	COMMENT
LOW	router_skip.go	21	// staticSlashes has a bit per '/' count present among staticMethods' keys, so	COMMENT
LOW	res.go	41	// Available compression methods are gzip, br, and zstd.	COMMENT
LOW	res.go	941	// the head inside each index — since "a.for" and "a[b.class]" name properties,	COMMENT
LOW	res.go	1201	resp := &r.c.fasthttp.Response	COMMENT
LOW	res.go	1241	// sendFileIndexName is the file SendFile serves for a directory.	COMMENT
LOW	router_filter.go	61	// candidate they reject costs a sequential read of its head instead of a	COMMENT
LOW	router_filter.go	81	prefix2 uint64	COMMENT
LOW	router_filter.go	101		COMMENT
LOW	router_filter.go	241	// skip returns the index of the first route at or after i that f, the filter	COMMENT
LOW	router_test.go	2121	// Benchmark_Router_Chain_FilteredBucket runs middleware chains in front of an	COMMENT
LOW	router_test.go	4521	c.URI().SetPath(routesFixture.TestRoutes[i].Path)	COMMENT
LOW	router_test.go	4541	//	COMMENT
LOW	router_test.go	4881	strict.Use("/Pre", handler)	COMMENT
LOW	.golangci.yml	261	- revive	COMMENT
LOW	ctx_interface_gen.go	21	App() *App	COMMENT
LOW	ctx_interface_gen.go	41	// context should be canceled. Ctx can never be canceled, so Done always	COMMENT
LOW	ctx_interface_gen.go	61	// ContentLength returns the value of the Content-Length request header. Req and	COMMENT
LOW	ctx_interface_gen.go	81	GetHeaders() map[string][]string	COMMENT
LOW	ctx_interface_gen.go	101	RestartRouting() error	COMMENT
LOW	ctx_interface_gen.go	121	// You can use Redirect().To(), Redirect().Route() and Redirect().Back() for redirection.	COMMENT
LOW	ctx_interface_gen.go	141	// route currently executing, which inside middleware is the middleware itself,	COMMENT
LOW	ctx_interface_gen.go	161	// IsFinal reports whether this is the last handler of a matched non-middleware	COMMENT
LOW	ctx_interface_gen.go	181	// ID returns the connection-unique identifier fasthttp assigned to this request,	COMMENT
LOW	ctx_interface_gen.go	201	// KeepHijackedConns is set, and the handler must not touch the pooled Ctx.	COMMENT
LOW	ctx_interface_gen.go	221	release()	COMMENT
LOW	ctx_interface_gen.go	241	// ScheduleReclaim arms automatic reclamation of an abandoned context, returning	COMMENT
LOW	ctx_interface_gen.go	261	ScheduleReclaim(handlerDone <-chan struct{}, cancel context.CancelFunc)	COMMENT
LOW	ctx_interface_gen.go	301	// Per RFC 9110 §12.5.3, a missing Accept-Encoding accepts any coding (the first	COMMENT
LOW	ctx_interface_gen.go	321	// Reading it consumes the body, so a later Body call will not see it.	COMMENT
LOW	ctx_interface_gen.go	341	// matching what AcceptsLanguages negotiates on.	COMMENT
LOW	ctx_interface_gen.go	361	// MediaType returns the MIME type from the Content-Type header without parameters.	COMMENT
LOW	ctx_interface_gen.go	381	// shadowing AllCookies collapses is detected. The strings are copies.	COMMENT
309 more matches not shown…

Hallucination Indicators30 hits · 330 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	res.go	1574	r.c.fasthttp.Response.Header.SetContentType(mimeType + "; charset=" + charset[0])	CODE
CRITICAL⚡	res.go	1578	r.c.fasthttp.Response.Header.SetContentType(mimeType + "; charset=utf-8")	CODE
CRITICAL⚡	res.go	1580	r.c.fasthttp.Response.Header.SetContentType(mimeType)	CODE
CRITICAL	res.go	193	r.c.fasthttp.Response.Header.Del(field)	CODE
CRITICAL	res.go	293	r.c.fasthttp.Response.Header.Add(key, val)	CODE
CRITICAL	res.go	409	r.c.fasthttp.Response.Header.SetCookie(fcookie)	CODE
CRITICAL	res.go	585	r.c.fasthttp.Response.Header.SetContentType(h.MediaType)	CODE
CRITICAL	res.go	616	r.c.fasthttp.Response.Header.SetContentType(h.MediaType)	CODE
CRITICAL	res.go	680	return r.c.fasthttp.Response.Header.ContentLength()	CODE
CRITICAL	res.go	687	return r.c.app.toString(r.c.fasthttp.Response.Header.ContentType())	CODE
CRITICAL	res.go	819	r.c.fasthttp.Response.Header.SetContentType(MIMETextJavaScriptCharsetUTF8)	CODE
CRITICAL	res.go	1228	r.c.fasthttp.Response.Header.Add("Link", h)	CODE
CRITICAL	res.go	1235	if !r.c.fasthttp.Request.Header.IsHTTP11() {	CODE
CRITICAL	res.go	1532	r.c.fasthttp.Response.Header.Set(key, val)	CODE
CRITICAL	res.go	1536	r.c.fasthttp.Response.Header.SetCanonical(utils.UnsafeBytes(key), utils.UnsafeBytes(val))	CODE
CRITICAL	res.go	1626	r.c.fasthttp.Response.Header.Del(HeaderVary)	CODE
CRITICAL	res.go	1637	r.c.fasthttp.Response.Header.Del(HeaderVary)	CODE
CRITICAL⚡	req.go	362	return r.c.app.toString(r.c.fasthttp.Request.Header.ContentType())	CODE
CRITICAL⚡	req.go	367	return r.c.app.toString(mediatype.StripParams(r.c.fasthttp.Request.Header.ContentType()))	CODE
CRITICAL⚡	req.go	372	for name, v := range mediatype.Params(r.c.fasthttp.Request.Header.ContentType()) {	CODE
CRITICAL	req.go	255	return r.c.fasthttp.Request.Header.ContentLength()	CODE
CRITICAL	req.go	440	return defaultString(r.c.app.toString(r.c.fasthttp.Request.Header.Cookie(key)), defaultValue)	CODE
CRITICAL	req.go	448	for key := range r.c.fasthttp.Request.Header.Cookies() {	CODE
CRITICAL	req.go	459	for key, value := range r.c.fasthttp.Request.Header.Cookies() {	CODE
CRITICAL	req.go	506	if mediatype.IsForm(r.c.fasthttp.Request.Header.ContentType()) {	CODE
CRITICAL	req.go	532	if r.c.fasthttp.Request.IsBodyStream() && mediatype.ParsesPostArgs(r.c.fasthttp.Request.Header.ContentType()) {	CODE
CRITICAL	req.go	1043	ct := mediatype.StripParams(r.c.fasthttp.Request.Header.ContentType())	CODE
CRITICAL	req.go	1321	if mediatype.IsForm(r.c.fasthttp.Request.Header.ContentType()) {	CODE
CRITICAL	req.go	1332	return r.c.app.toString(r.c.fasthttp.Request.Header.RequestURI())	CODE
CRITICAL	req.go	1507	return r.c.app.toString(r.c.fasthttp.Request.Header.Protocol())	CODE

Fake / Example Data26 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	bind_test.go	810	c.Request().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	839	c.Request().Header.Add("Name", "Jane Doe")	CODE
LOW	bind_test.go	852	require.Equal(t, "Jane Doe", h2.Name) // check value get overwritten	CODE
LOW	bind_test.go	881	c.Request().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1068	c.Response().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1097	c.Response().Header.Add("Name", "Jane Doe")	CODE
LOW	bind_test.go	1110	require.Equal(t, "Jane Doe", h2.Name) // check value get overwritten	CODE
LOW	bind_test.go	1139	c.Response().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1300	c.Request().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1321	c.Request().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1348	c.Response().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	1369	c.Response().Header.Add("Name", "John Doe")	CODE
LOW	bind_test.go	2021	c.Request().Header.SetCookie("Name", "John Doe")	CODE
LOW	bind_test.go	2050	c.Request().Header.SetCookie("Name", "Jane Doe")	CODE
LOW	bind_test.go	2063	require.Equal(t, "Jane Doe", h2.Name) // check value get overwritten	CODE
LOW	bind_test.go	2094	c.Request().Header.SetCookie("Name", "John Doe")	CODE
LOW	bind_test.go	2281	c.Request().Header.SetCookie("Name", "John Doe")	CODE
LOW	bind_test.go	2304	c.Request().Header.SetCookie("Name", "John Doe")	CODE
LOW	internal/schemehost/schemehost_test.go	71	"user@example.com", "user:pass@example.com", "example.com/path",	CODE
LOW	docs/middleware/session.md	163	if email == "admin@example.com" && password == "secret" {	CODE
LOW	docs/middleware/session.md	842	if email != "user@example.com" \|\| password != "password" {	CODE
LOW	docs/middleware/session.md	875	return email == "user@example.com" && password == "password"	CODE
LOW	docs/api/ctx.md	3010	user := User{"John Doe"}	CODE
LOW	docs/api/ctx.md	3014	// => {"Name":"John Doe"}	COMMENT
LOW	docs/client/request.md	473	Name: "John Doe",	CODE
LOW	docs/client/request.md	496	"name": "John Doe"	CODE

Structural Annotation Overuse10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	redirect_test.go	1038	// Step 1: Make the initial request to the source route	COMMENT
LOW	redirect_test.go	1056	// Step 2: Make the second request to the target route with the cookie	COMMENT
LOW	redirect_test.go	1104	// Step 1: Make the initial request	COMMENT
LOW	redirect_test.go	1121	// Step 2: Make the second request with the cookie	COMMENT
LOW	helpers.go	403	// Step 2: first subtag must match (or be '*')	COMMENT
LOW	docs/guide/validation.md	13	### Step 1: Install a validator	COMMENT
LOW	docs/guide/validation.md	19	### Step 2: Wire it into the app config	COMMENT
LOW	docs/guide/validation.md	45	### Step 3: Bind and validate in one call	COMMENT
LOW	docs/guide/validation.md	77	### Step 4: Shape the error response	COMMENT
LOW	docs/guide/validation.md	114	### Step 5: Add your own rules	COMMENT

Verbosity Indicators5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	redirect_test.go	1038	// Step 1: Make the initial request to the source route	COMMENT
LOW	redirect_test.go	1056	// Step 2: Make the second request to the target route with the cookie	COMMENT
LOW	redirect_test.go	1104	// Step 1: Make the initial request	COMMENT
LOW	redirect_test.go	1121	// Step 2: Make the second request with the cookie	COMMENT
LOW	helpers.go	403	// Step 2: first subtag must match (or be '*')	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.golangci.yml	279	# time instead so it is robust to cache state.	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	req.go	1566	// Example usage:	COMMENT
LOW	extractors/extractors.go	9	// Example usage:	COMMENT

gofiber/fiber

Open-Source Code Quality, Security and Technical Debt Review