Brotli compression format
This report summarizes scanner evidence for google/brotli, a TypeScript project with 15,070 GitHub stars. SynthScan examined 112,352 lines of code across 275 source files, recording 136 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 1.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 120 finding(s).
Are imports declared and package/API names verified? 7 finding(s).
Are wrappers, guards, and repeated structures necessary? 43 finding(s).
Which changes need focused human review? 136 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 136 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | research/brotli_decoder.c | 1 | /* Copyright 2018 Google Inc. All Rights Reserved. | COMMENT |
| LOW | research/brotlidump.py | 1341 | #chop it up, and check if the colon is properly placed | COMMENT |
| LOW | python/_brotli.c | 1 | #include <assert.h> | COMMENT |
| LOW | scripts/dictionary/step-04-generate-java-literals.py | 1 | # Step 04 - generate Java literals. | COMMENT |
| LOW | .github/workflows/fuzz.yml | 41 | # fuzz-seconds: 600 | COMMENT |
| LOW | .github/workflows/scorecard.yml | 41 | with: | COMMENT |
| LOW | csharp/org/brotli/dec/BrotliInputStream.cs | 21 | private int remainingBufferBytes; | COMMENT |
| LOW | csharp/org/brotli/dec/BrotliInputStream.cs | 41 | /// <exception cref="System.IO.IOException">in case of corrupted data or source stream problems</exception> | COMMENT |
| LOW | csharp/org/brotli/dec/BrotliInputStream.cs | 61 | /// </param> | COMMENT |
| LOW | csharp/org/brotli/dec/Dictionary.cs | 1 | /* Copyright 2015 Google Inc. All Rights Reserved. | COMMENT |
| LOW | csharp/org/brotli/dec/Context.cs | 41 | // UTF8 continuation byte range. | COMMENT |
| LOW | c/tools/brotli.c | 21 | #include <sys/types.h> | COMMENT |
| LOW | c/tools/brotli.c | 41 | #define S_IWUSR S_IWRITE | COMMENT |
| LOW | c/tools/brotli.c | 81 | #define HAVE_UTIMENSAT 1 | COMMENT |
| LOW | c/include/brotli/port.h | 21 | #define BROTLI_GNUC_VERSION \ | COMMENT |
| LOW | c/include/brotli/port.h | 41 | BROTLI_MAKE_VERSION((_MSC_FULL_VER / 1000000), \ | COMMENT |
| LOW | c/include/brotli/port.h | 61 | COMMENT | |
| LOW | c/include/brotli/port.h | 81 | #define BROTLI_PGI_VERSION \ | COMMENT |
| LOW | c/include/brotli/port.h | 121 | #endif | COMMENT |
| LOW | c/include/brotli/port.h | 141 | COMMENT | |
| LOW | c/include/brotli/port.h | 161 | #if defined(__TI_COMPILER_VERSION__) | COMMENT |
| LOW | c/include/brotli/port.h | 181 | #else | COMMENT |
| LOW | c/include/brotli/port.h | 201 | #else | COMMENT |
| LOW | c/include/brotli/port.h | 221 | #if defined(__has_feature) | COMMENT |
| LOW | c/include/brotli/port.h | 261 | #define BROTLI_ARRAY_PARAM(name) (name) | COMMENT |
| LOW | c/include/brotli/port.h | 281 | #define BROTLI_ENC_API __declspec(dllexport) | COMMENT |
| LOW | c/enc/backward_references_hq.c | 1 | /* Copyright 2013 Google Inc. All Rights Reserved. | COMMENT |
| LOW | c/enc/block_splitter.c | 81 | static BROTLI_INLINE double BitCost(size_t count) { | COMMENT |
| LOW | c/enc/hash_longest_match_quickly_inc.h | 261 | } | COMMENT |
| LOW | c/enc/encode.c | 1 | /* Copyright 2013 Google Inc. All Rights Reserved. | COMMENT |
| LOW | c/enc/encode.c | 21 | #include "compound_dictionary.h" | COMMENT |
| LOW | c/enc/encoder_dict.c | 1 | /* Copyright 2017 Google Inc. All Rights Reserved. | COMMENT |
| LOW | c/enc/cluster.c | 41 | #undef FN | COMMENT |
| LOW | c/enc/backward_references.c | 141 | #define EXPAND_CAT(a, b) CAT(a, b) | COMMENT |
| LOW | c/enc/backward_references.c | 161 | #include "backward_references_inc.h" | COMMENT |
| LOW | c/enc/backward_references.c | 181 | #include "backward_references_inc.h" | COMMENT |
| LOW | c/enc/backward_references.c | 201 | #include "backward_references_inc.h" | COMMENT |
| LOW | c/enc/backward_references.c | 221 | /* NOLINTNEXTLINE(build/include) */ | COMMENT |
| LOW | c/enc/backward_references.c | 241 | #include "backward_references_inc.h" | COMMENT |
| LOW | c/enc/backward_references.c | 261 | #include "backward_references_inc.h" | COMMENT |
| LOW | c/enc/histogram.h | 21 | COMMENT | |
| LOW | c/enc/memory.h | 21 | #endif | COMMENT |
| LOW | c/enc/bit_cost.c | 41 | } | COMMENT |
| LOW | c/enc/state.h | 1 | /* Copyright 2022 Google Inc. All Rights Reserved. | COMMENT |
| LOW | c/enc/hash.h | 241 | COMMENT | |
| LOW | c/enc/hash.h | 261 | #define HASH_LEN 5 | COMMENT |
| LOW | c/enc/hash.h | 281 | #include "hash_longest_match_quickly_inc.h" /* NOLINT(build/include) */ | COMMENT |
| LOW | c/enc/hash.h | 301 | #define HASHER() H59 | COMMENT |
| LOW | c/enc/hash.h | 321 | #define HASHER() H41 | COMMENT |
| LOW | c/enc/hash.h | 341 | #define BUCKET_BITS 20 | COMMENT |
| LOW | c/enc/hash.h | 361 | #undef HASHER | COMMENT |
| LOW | c/enc/hash.h | 381 | #define HASHER() H55 | COMMENT |
| LOW | c/common/static_init.h | 21 | #define THIRD_PARTY_BROTLI_COMMON_STATIC_INIT_H_ | COMMENT |
| LOW | c/common/static_init.h | 41 | (BROTLI_STATIC_INIT != BROTLI_STATIC_INIT_EARLY) && \ | COMMENT |
| LOW | c/common/version.h | 41 | #endif | COMMENT |
| LOW | c/common/platform.h | 21 | * BROTLI_ENABLE_DUMP overrides default "dump" behaviour | COMMENT |
| LOW | c/common/platform.h | 121 | #elif BROTLI_MSVC_VERSION_CHECK(12, 0, 0) | COMMENT |
| LOW | c/common/platform.h | 141 | #elif BROTLI_PGI_VERSION_CHECK(10, 2, 0) | COMMENT |
| LOW | c/common/platform.h | 161 | #define BROTLI_ALIGNED(N) __attribute__((aligned(N))) | COMMENT |
| LOW | c/common/platform.h | 181 | #endif /* ARMv8 */ | COMMENT |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | csharp/transpile.sh | 25 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 33 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 42 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 49 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 64 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 73 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 83 | #------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | csharp/transpile.sh | 90 | #------------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/tests/decompressor_test.py | 37 | def test_decompress_with_limit(compressed_name, original_name): | CODE |
| LOW⚡ | python/tests/decompressor_test.py | 114 | def _thread_concurrent_process(decompressor, results): | CODE |
| LOW⚡ | python/tests/decompressor_test.py | 122 | def _thread_concurrent_can_accept_more_data(decompressor, results): | CODE |
| LOW⚡ | python/tests/decompressor_test.py | 130 | def _thread_concurrent_is_finished(decompressor, results): | CODE |
| LOW | python/tests/compressor_test.py | 45 | def test_multiple_process_and_flush(quality, text_name): | CODE |
| LOW | python/tests/compressor_test.py | 97 | def _thread_concurrent_process(compressor, results): | CODE |
| LOW | python/tests/compressor_test.py | 113 | def _thread_concurrent_finish(compressor, results): | CODE |
| LOW | js/decode.ts | 39 | function calculateDistanceAlphabetSize(npostfix: number, ndirect: number, maxndistbits: number): number { | CODE |
| LOW | js/decode.ts | 42 | function calculateDistanceAlphabetLimit(s: State, maxDistance: number, npostfix: number, ndirect: number): number { | CODE |
| LOW | js/decode.ts | 277 | function inverseMoveToFrontTransform(v: Int8Array, vLen: number): void { | CODE |
| LOW | js/decode.ts | 581 | function decodeDistanceBlockSwitch(s: State): void { | CODE |
| LOW | js/decode.ts | 585 | function maybeReallocateRingBuffer(s: State): void { | CODE |
| LOW | js/decode.ts | 704 | function readMetablockHuffmanCodesAndContextMaps(s: State): number { | CODE |
| LOW | js/decode.ts | 856 | function huffmanTreeGroupAllocSize(alphabetSizeLimit: number, n: number): number { | CODE |
| LOW | js/decode.ts | 921 | function initializeCompoundDictionary(s: State): void { | CODE |
| LOW | js/decode.ts | 939 | function initializeCompoundDictionaryCopy(s: State, address: number, length: number): number { | CODE |
| LOW | js/decode.ts | 959 | function copyFromCompoundDictionary(s: State, fence: number): number { | CODE |
| LOW | js/decode.js | 67 | function calculateDistanceAlphabetSize(npostfix, ndirect, maxndistbits) { | CODE |
| LOW | js/decode.js | 77 | function calculateDistanceAlphabetLimit(s, maxDistance, npostfix, ndirect) { | CODE |
| LOW | js/decode.js | 371 | function inverseMoveToFrontTransform(v, vLen) { | CODE |
| LOW | js/decode.js | 736 | function decodeDistanceBlockSwitch(s) { | CODE |
| LOW | js/decode.js | 744 | function maybeReallocateRingBuffer(s) { | CODE |
| LOW | js/decode.js | 882 | function readMetablockHuffmanCodesAndContextMaps(s) { | CODE |
| LOW | js/decode.js | 1047 | function huffmanTreeGroupAllocSize(alphabetSizeLimit, n) { | CODE |
| LOW | js/decode.js | 1133 | function initializeCompoundDictionary(s) { | CODE |
| LOW | js/decode.js | 1157 | function initializeCompoundDictionaryCopy(s, address, length) { | CODE |
| LOW | js/decode.js | 1182 | function copyFromCompoundDictionary(s, fence) { | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 98 | def test_modes_propagate_on_compress_and_decompress(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 121 | def test_special_mode_bits_are_masked(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 138 | def test_no_copy_stat_flag_suppresses_mode_copy(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 168 | def test_stdin_input_has_no_path_to_copy_from(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 178 | def test_stdout_path_skips_copystat(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 214 | def test_fclose_swap_does_not_redirect_copystat(self): | CODE |
| LOW | tests/regression/t01/copystat_regression_test.py | 224 | def test_fclose_swap_with_no_copy_stat_leaves_target_unchanged(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | csharp/org/brotli/dec/Dictionary.cs | 61 | string[] chunks = new string[] { Org.Brotli.Dec.Dictionary.DataHolder0.GetData(), Org.Brotli.Dec.Dictionary.DataHold | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | research/brotlidump.py | 25 | CODE | |
| LOW | research/brotlidump.py | 1217 | CODE | |
| LOW | research/brotlidump.py | 1390 | CODE | |
| LOW | research/brotlidump.py | 1463 | CODE | |
| LOW | research/brotlidump.py | 1786 | CODE | |
| LOW | python/tests/compressor_test.py | 59 | CODE | |
| LOW | tests/regression/t01/copystat_regression_test.py | 186 | CODE | |
| LOW | scripts/dictionary/step-04-generate-java-literals.py | 50 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dictionary/step-01-download-rfc.py | 1 | # Step 01 - download RFC7932. | COMMENT |
| LOW | scripts/dictionary/step-04-generate-java-literals.py | 1 | # Step 04 - generate Java literals. | COMMENT |
| LOW | scripts/dictionary/step-02-rfc-to-bin.py | 1 | # Step 02 - parse RFC. | COMMENT |
| LOW | scripts/dictionary/step-03-validate-bin.py | 1 | # Step 03 - validate raw dictionary file. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | research/brotlidump.py | 2366 | except ImportError: pass | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | python/brotli.py | 26 | Compress a byte string. Args: string (bytes): The input data. mode (int, optional): The compression mod | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | research/brotlidump.py | 12 | CODE | |
| LOW | research/brotlidump.py | 13 | CODE | |
| LOW | research/brotlidump.py | 13 | CODE | |
| LOW | research/brotlidump.py | 14 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/cli_test.sh | 16 | echo "Lorem ipsum dolor sit amet. " > ipsum.orig | CODE |
| LOW | tests/cli_test.sh | 16 | echo "Lorem ipsum dolor sit amet. " > ipsum.orig | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | research/brotlidump.py | 352 | """Don't forget to set either alphabetSize or decodeTable | STRING |