AI Slop Code Risk Monitor

google/go-github

SlopCodeMonitor badge for google/go-github Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Go library for accessing the GitHub v3 API

0.9 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for google/go-github, a Go project with 11,330 GitHub stars. SynthScan examined 212,594 lines of code across 551 source files, recording 188 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 0.9 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.9
Adjusted Signal
0.9
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
11.3K
Stars
Go
Language
212.6K
Lines of Code
551
Files
188
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 168 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 20 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 4.4/100 · LOW

Which changes need focused human review? 188 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 0LOW 187

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 188 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block164 hits · 164 pts
SeverityFileLineSnippetContext
LOWtools/paramcheck/paramcheck.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/schemafields/check_test.go281# reports problems that a change introduces, and so that a disagreement can beCOMMENT
LOWtools/schemafields/openapi.go221COMMENT
LOWtools/schemafields/exceptions.txt1# Schema field exceptions for tools/schemafields.COMMENT
LOWtools/schemafields/main.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/structfield/structfield.go1// Copyright 2025 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/list-return-structs/main.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/gen-release-notes/main.go1// Copyright 2025 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/metadata/check.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWtools/metadata/check.go21//COMMENT
LOW…etadata/testdata/golden/TestUpdateGo/valid/github/a.go1package githubCOMMENT
LOW…etadata/testdata/golden/TestUpdateGo/valid/github/a.go21// GitHub API docs: https://docs.github.com/rest/a/a?apiVersion=2022-11-28#update-aCOMMENT
LOWtools/metadata/testdata/update-go/valid/github/a.go1package githubCOMMENT
LOWtools/metadata/testdata/update-go/invalid/github/a.go21//COMMENT
LOWtest/integration/projects_test.go21// discovered dynamically by first listing projects and selecting one. For itemCOMMENT
LOWtest/integration/doc.go1// Copyright 2016 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/newreposecretwithxcrypto/main.go1// Copyright 2021 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/newreposecretwithxcrypto/main.go101 return secretValue, nilCOMMENT
LOWexample/listenvironments/main.go1// Copyright 2022 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/commitpr/main.go1// Copyright 2018 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/codespaces/newreposecretwithxcrypto/main.go1// Copyright 2023 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/codespaces/newreposecretwithxcrypto/main.go101 return secretValue, nilCOMMENT
LOWexample/codespaces/newusersecretwithxcrypto/main.go1// Copyright 2023 The go-github AUTHORS. All rights reserved.COMMENT
LOWexample/codespaces/newusersecretwithxcrypto/main.go101// The actual transmission of the secret value to GitHub using the API requires that the secret value is encryptedCOMMENT
LOWexample/auditlogstream/main.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWscrape/scrape.go1// Copyright 2013 The go-github AUTHORS. All rights reserved.COMMENT
LOWscript/run-check-structfield-settings.sh1#!/bin/bash -eCOMMENT
LOWgithub/users_ssh_signing_keys.go21func (k SSHSigningKey) String() string {COMMENT
LOWgithub/users.go81 // Assignment identifies how a user was assigned to an organization role. ItsCOMMENT
LOWgithub/fuzz_messages_test.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/repos_releases.go321//COMMENT
LOWgithub/private_registries.go121COMMENT
LOWgithub/billing.go81COMMENT
LOWgithub/git.go1// Copyright 2013 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/actions_workflow_jobs.go61 // Filter specifies how jobs should be filtered by their completed_at timestamp.COMMENT
LOWgithub/issues.go381 // Milestone limits issues for the specified milestone. Possible values areCOMMENT
LOWgithub/users_followers.go1// Copyright 2013 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/orgs_actions_allowed.go1// Copyright 2021 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/apps.go61// InstallationTokenListRepoOptions allow restricting a token's access to a list of all repositories in an installation.COMMENT
LOWgithub/apps.go221}COMMENT
LOWgithub/apps.go481// GetEnterpriseInstallation finds the enterprise's installation information.COMMENT
LOWgithub/agents.go1// Copyright 2026 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/gen-stringify-test.go1// Copyright 2019 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/users_attestations.go1// Copyright 2024 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/repos_stats.go81// starting on Sunday.COMMENT
LOWgithub/repos_stats.go101 if err != nil {COMMENT
LOWgithub/repos_stats.go161}COMMENT
LOWgithub/repos_stats.go201}COMMENT
LOWgithub/repos_forks.go61// CreateFork creates a fork of the specified repository.COMMENT
LOWgithub/rules.go121// NOTE: GitHub's API inconsistently uses different casing for the same logical valuesCOMMENT
LOWgithub/orgs_attestations.go1// Copyright 2024 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/enterprise_app_installation.go161// AppInstallationRepositoriesRequest specifies the parameters forCOMMENT
LOWgithub/dependency_graph_snapshots.go21 // - "licenses": license information (e.g., "MIT", "Apache-2.0")COMMENT
LOWgithub/actions.go1// Copyright 2020 The go-github AUTHORS. All rights reserved.COMMENT
LOWgithub/activity.go41 CurrentUserOrganization *FeedLink `json:"current_user_organization,omitempty"`COMMENT
LOWgithub/copilot.go1581// CopilotMetricsCopilotApp represents Copilot app totals in a metrics report.COMMENT
LOWgithub/teams.go181 // Possible values are:COMMENT
LOWgithub/teams.go241COMMENT
LOWgithub/teams.go521 // Permission specifies the permission to grant the team on this repository.COMMENT
LOWgithub/teams.go781 return s.client.Do(req, nil)COMMENT
104 more matches not shown…
Fake / Example Data20 hits · 20 pts
SeverityFileLineSnippetContext
LOWgithub/users_emails_test.go24 "email": "user@example.com",CODE
LOWgithub/users_emails_test.go37 want := []*UserEmail{{Email: new("user@example.com"), Verified: new(false), Primary: new(true)}}CODE
LOWgithub/users_emails_test.go60 "email": "user@example.com",CODE
LOWgithub/users_emails_test.go74 want := []*UserEmail{{Email: new("user@example.com"), Verified: new(true), Primary: new(true), Visibility: new("public"CODE
LOWgithub/users_emails_test.go129 input := []string{"user@example.com"}CODE
LOWgithub/users_emails_test.go158 "email": "user@example.com",CODE
LOWgithub/users_emails_test.go171 want := []*UserEmail{{Email: new("user@example.com"), Verified: new(false), Primary: new(true), Visibility: new("privatCODE
LOWgithub/examples_test.go97 Committer: &github.CommitAuthor{Name: new("FirstName LastName"), Email: new("user@example.com")},CODE
LOWgithub/enterprise_licenses_test.go194 "visual_studio_subscription_email": "user@example.com",CODE
LOWgithub/enterprise_licenses_test.go216 VisualStudioSubscriptionEmail: new("user@example.com"),CODE
LOWgithub/enterprise_licenses_test.go255 "visual_studio_subscription_email": "user@example.com",CODE
LOWgithub/enterprise_licenses_test.go269 VisualStudioSubscriptionEmail: new("user@example.com"),CODE
LOWgithub/enterprise_scim_test.go292 DisplayName: "John Doe",CODE
LOWgithub/enterprise_scim_test.go311 "displayName": "John Doe",CODE
LOWgithub/enterprise_scim_test.go331 DisplayName: "John Doe",CODE
LOWgithub/enterprise_scim_test.go481 "displayName": "John Doe",CODE
LOWgithub/enterprise_scim_test.go505 DisplayName: "John Doe",CODE
LOWgithub/enterprise_scim_test.go656 Formatted: new("John Doe"),CODE
LOWgithub/enterprise_scim_test.go684 "formatted": "John Doe",CODE
LOWgithub/enterprise_scim_test.go714 Formatted: new("John Doe"),CODE
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGH.codecov.yml4 # ignore auto-generated codeCOMMENT
Example Usage Blocks3 hits · 4 pts
SeverityFileLineSnippetContext
LOWgithub/messages.go202// Example usage:COMMENT
LOWgithub/messages.go265// Example usage:COMMENT
LOWgithub/messages.go322// Example usage:COMMENT