1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

20.8K

Stars

Language

271.4K

Lines of Code

1.0K

Files

327

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 290 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 27 finding(s).

Agent Over-Engineering Ratio 0.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 12 finding(s).

PR Review Velocity Impact 6.6/100 · LOW

Which changes need focused human review? 327 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 17LOW 308

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 327 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block278 hits · 276 pts

Severity	File	Line	Snippet	Context
LOW	docs/datasources/scylladb/page.md	21	with ScyllaDB. Any driver implementation that adheres to this interface can be integrated into GoFr using the	COMMENT
LOW	docs/datasources/opentsdb/page.md	21	Implementations adhering to the `OpenTSDB` interface can be registered with `app.AddOpenTSDB()`,	COMMENT
LOW	docs/datasources/opentsdb/page.md	41	//	COMMENT
LOW	docs/datasources/opentsdb/page.md	61	// - res: A pointer to QueryLastResponse, where the server's response will be stored.	COMMENT
LOW	docs/datasources/opentsdb/page.md	81	// Parameters:	COMMENT
LOW	examples/using-migrations/main_test.go	21	"gofr.dev/pkg/gofr/testutil"	COMMENT
LOW	examples/sample-cmd/main_test.go	81	// setArgs replaces os.Args for the duration of the test and restores it	COMMENT
LOW	examples/http-server/main_test.go	1	package main	COMMENT
LOW	examples/using-s3-filestore/main_test.go	201		COMMENT
LOW	examples/using-http-auth-middleware/ReadMe.md	41	a := gofr.New()	COMMENT
LOW	examples/using-http-auth-middleware/main_test.go	61		COMMENT
LOW	examples/using-http-auth-middleware/main_test.go	81	// app := gofr.New()	COMMENT
LOW	examples/using-http-auth-middleware/main_test.go	101	//	COMMENT
LOW	examples/using-http-auth-middleware/main_test.go	121	// app.GET("/basic-auth-failure", func(_ *gofr.Context) (any, error) {	COMMENT
LOW	examples/using-http-auth-middleware/main_test.go	141	// t.Errorf("error while making HTTP request in Test_BasicAuthMiddleware. err: %v", err)	COMMENT
LOW	.github/dependabot.yml	21	schedule:	COMMENT
LOW	.github/workflows/website-prod.yml	101	echo "TAG=$TAG" >> $GITHUB_ENV	COMMENT
LOW	.github/workflows/go.yml	61	go-version: ['1.26','1.25', '1.24']	COMMENT
LOW	.github/workflows/go.yml	301	# Run tests for root gofr package.	COMMENT
LOW	.github/workflows/go.yml	341	echo "::error::Gofr sub-packages tests failed"	COMMENT
LOW	.github/workflows/go.yml	421	echo "Merging ${#submodule_profiles[@]} submodule profile(s) with Example and PKG"	COMMENT
LOW	.github/workflows/go.yml	521	# script text before bash parses it, so an interpolated module path would be	COMMENT
LOW	.github/workflows/go.yml	541	# in the runner and pass, then fail for anyone who clones it —	COMMENT
LOW	.github/workflows/go.yml	561	# figure changes at all and the only one with any testing.Short	COMMENT
LOW	.github/workflows/go.yml	721	# dgo. The stub has to keep implementing migrator, so a change to that	COMMENT
LOW	.github/workflows/go.yml	761	# and the default lint job never sees them -- moving noopResponder and	COMMENT
LOW	.github/workflows/go.yml	781	# another path, leaves every other step in this job green while the tag	COMMENT
LOW	.github/workflows/go.yml	841	echo "gofr.dev/pkg/gofr links $full packages by default and $slim with all three tags"	COMMENT
LOW	.github/workflows/website-stage.yml	101	run: \|	COMMENT
LOW	.github/workflows/website-pr.yml	1	name: Website Build Check	COMMENT
LOW	.github/workflows/website-pr.yml	61	with:	COMMENT
LOW	.github/scripts/check-binaries.sh	1	#!/usr/bin/env bash	COMMENT
LOW	.github/actions/setup-go-toolchain/action.yml	1	name: Set up Go toolchain	COMMENT
LOW	.qlty/qlty.toml	1	# This file was automatically generated by `qlty init`.	COMMENT
LOW	pkg/gofr/crud_helpers.go	61	}	COMMENT
LOW	pkg/gofr/crud_helpers.go	81	// Every other rune -- digits, underscores, punctuation, non-ASCII -- passes through untouched.	COMMENT
LOW	pkg/gofr/handler.go	161	err = gofrHTTP.ErrorClientClosedRequest{}	COMMENT
LOW	pkg/gofr/handler.go	181	// spawned goroutine and is free to reassign it (App.WebSocket does, to	COMMENT
LOW	pkg/gofr/gofr.go	81	// one outside the valid TCP range. It is recorded rather than acted on because EnableMCP runs	COMMENT
LOW	pkg/gofr/gofr.go	101	// exitCodeFailure is the status the process reports when a run failed: startup was abandoned (a	COMMENT
LOW	pkg/gofr/gofr.go	341		COMMENT
LOW	pkg/gofr/gofr.go	521	}	COMMENT
LOW	pkg/gofr/graphql_runner.go	1	package gofr	COMMENT
LOW	pkg/gofr/run.go	61	}	COMMENT
LOW	pkg/gofr/run.go	261	// others' startup rather than cleanly stopping it.	COMMENT
LOW	pkg/gofr/run.go	341	a.Logger().Errorf("Stopping startup: the RBAC route check failed and %s=%s.", rbacRouteCheckKey, rbacRouteCheckFail)	COMMENT
LOW	pkg/gofr/auth.go	101	// and the API key as arguments and should return `true` if the key is valid, `false` otherwise.	COMMENT
LOW	pkg/gofr/grpc.go	41	errFailedCreateServer = errors.New("failed to create gRPC server")	COMMENT
LOW	pkg/gofr/websocket_test.go	81	// context.WithValue(ctx, ...) instead of context.WithValue(ctx.Context, ...).	COMMENT
LOW	pkg/gofr/websocket_test.go	121	_, message, err := ws.ReadMessage()	COMMENT
LOW	pkg/gofr/http_server.go	21	router *gofrHTTP.Router	COMMENT
LOW	pkg/gofr/rbac.go	21	//	COMMENT
LOW	pkg/gofr/rest.go	81		COMMENT
LOW	pkg/gofr/health.go	21	// Kubernetes guide ships readinessProbe.timeoutSeconds: 2, so a slower check is abandoned on every	COMMENT
LOW	pkg/gofr/health.go	41	}	COMMENT
LOW	pkg/gofr/health.go	61	// which dependencies are critical is an application decision.	COMMENT
LOW	pkg/gofr/health.go	121	// and rolling deploys — Kubernetes probes it repeatedly — so it should not flood logs as an error.	COMMENT
LOW	pkg/gofr/health.go	181	return true	COMMENT
LOW	pkg/gofr/shutdown_test.go	161	}	COMMENT
LOW	pkg/gofr/mcp.go	81	// less ambiguous mistake -- an occupied port can be a transient condition of the environment, while	COMMENT
218 more matches not shown…

Fake / Example Data25 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	docs/advanced-guide/authentication/page.md	148	- Subject (`sub`): `jwt.WithSubject("user@example.com")`	CODE
LOW⚡	pkg/gofr/crud_handlers_test.go	332	mockResp: sqlmock.NewRows([]string{"id", "name", "is_employed"}).AddRow(1, "John Doe", true).AddRow(2, "Jane Doe", f	CODE
LOW⚡	pkg/gofr/crud_handlers_test.go	332	mockResp: sqlmock.NewRows([]string{"id", "name", "is_employed"}).AddRow(1, "John Doe", true).AddRow(2, "Jane Doe", f	CODE
LOW⚡	pkg/gofr/crud_handlers_test.go	334	expectedResp: []any{&userEntity{ID: 1, Name: "John Doe", IsEmployed: true},	CODE
LOW⚡	pkg/gofr/crud_handlers_test.go	335	&userEntity{ID: 2, Name: "Jane Doe", IsEmployed: false}},	CODE
LOW	pkg/gofr/crud_handlers_test.go	422	mockRow: sqlmock.NewRows([]string{"id", "name", "is_employed"}).AddRow(1, "John Doe", true),	CODE
LOW	pkg/gofr/crud_handlers_test.go	424	expectedResp: &userEntity{ID: 1, Name: "John Doe", IsEmployed: true},	CODE
LOW	pkg/gofr/context_test.go	329	"name": "John Doe",	CODE
LOW	pkg/gofr/datasource/kv-store/dynamodb/dynamo_test.go	334	"name": "John Doe",	CODE
LOW	pkg/gofr/datasource/kv-store/dynamodb/dynamo_test.go	342	assert.Contains(t, jsonStr, "John Doe")	CODE
LOW⚡	pkg/gofr/datasource/kv-store/dynamodb/dynamo_test.go	357	jsonStr := `{"name":"John Doe","age":30,"email":"john@example.com"}`	CODE
LOW⚡	pkg/gofr/datasource/kv-store/dynamodb/dynamo_test.go	363	assert.Equal(t, "John Doe", result["name"])	CODE
LOW⚡	pkg/gofr/datasource/kv-store/dynamodb/dynamo_test.go	369	invalidJSON := `{"name":"John Doe","age":30,"email":}`	CODE
LOW⚡	pkg/gofr/datasource/sql/query_builder_test.go	27	values: []any{"John Doe", 30},	CODE
LOW⚡	pkg/gofr/datasource/sql/query_builder_test.go	35	values: []any{"John Doe", 30},	CODE
LOW⚡	pkg/gofr/datasource/sql/query_builder_test.go	43	values: []any{1, "John Doe"},	CODE
LOW	pkg/gofr/datasource/sql/query_builder_test.go	54	values: []any{1, "John Doe"},	CODE
LOW	pkg/gofr/container/datasources.go	81	// err := c.Exec("INSERT INTO users VALUES(1, 'John Doe')")	COMMENT
LOW	pkg/gofr/container/datasources.go	85	// name := "John Doe"	COMMENT
LOW	pkg/gofr/container/datasources.go	103	// applied, err := c.ExecCAS(&user, "INSERT INTO users VALUES(1, 'John Doe') IF NOT EXISTS")	COMMENT
LOW	pkg/gofr/container/datasources.go	130	// c.BatchQuery("INSERT INTO users VALUES(1, 'John Doe')")	COMMENT
LOW	pkg/gofr/container/datasources.go	135	// name1 := "John Doe"	COMMENT
LOW	pkg/gofr/http/middleware/oauth_test.go	65	response: jwt.MapClaims{"admin": true, "iat": 1.516239022e+09, "name": "John Doe", "sub": "1234567890"},	CODE
LOW⚡	pkg/gofr/static/swagger-ui.js	1	!function webpackUniversalModuleDefinition(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"fu	CODE
LOW⚡	pkg/gofr/static/swagger-ui.js	1	!function webpackUniversalModuleDefinition(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"fu	CODE

Decorative Section Separators10 hits · 30 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/website-pr.yml	6	# ---------------	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	735	// ─── helpers for signed-URL tests ───────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	782	// ─── parseServiceAccountCredentials ─────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	830	// ─── validatePrivateKey ──────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	857	// ─── buildSignedURLOptions ───────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	903	// ─── sanitizeContentDisposition ─────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	921	// ─── rewriteSignedURLEndpoint ────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	945	// ─── NewWriterWithOptions ────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	1011	// ─── SignedURL ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/gofr/datasource/file/gcs/storage_adapter_test.go	1122	// ─── Connect with credentials caching ────────────────────────────────────────	COMMENT

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	docs/guides/production-tracing/page.md	111	TRACER_HEADERS: "x-honeycomb-team=YOUR_API_KEY,x-honeycomb-dataset=orders"	CODE
HIGH	docs/quick-start/observability/page.md	513	TRACER_HEADERS="X-Honeycomb-Team=your_api_key"	CODE

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/go.yml	48	# Define the jobs that this workflow will run	COMMENT
MEDIUM	.github/workflows/go.yml	58	# Define a matrix strategy to test against multiple Go versions	COMMENT
MEDIUM	.github/workflows/go.yml	509	# Create a directory for coverage reports. Resolve it to an absolute path:	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/go.yml	553	# the mtest harness shipped by the mongo driver calls t.Skip with	COMMENT
MEDIUM	pkg/gofr/datasource/pubsub/kafka/kafka_test.go	794	// stays robust if the order is revisited.	COMMENT
MEDIUM	pkg/gofr/migration/migration.go	34	// ensuring the lock stays robust while still allowing fairly quick recovery if a process crashes.	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/go.yml	349	# admit: it is scaffolding for tests, not shipped behaviour, and at	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/go.yml	937	# Check if any files changed	COMMENT
LOW	.github/workflows/go.yml	958	# Check if this module is not already in the list	COMMENT

Hyper-Verbose Identifiers2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW⚡	pkg/gofr/static/swagger-ui.js	1	!function webpackUniversalModuleDefinition(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"fu	CODE
LOW	pkg/gofr/static/swagger-ui-standalone-preset.js	2	!function webpackUniversalModuleDefinition(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"fu	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	pkg/gofr/gofr.go	532	// Example usage:	COMMENT

gofr-dev/gofr

Open-Source Code Quality, Security and Technical Debt Review