Google's officially supported Node.js client library for accessing Google APIs. Support for authorization and authentication with OAuth 2.0, API Keys and JWT (Service Tokens) is included.
This report summarizes scanner evidence for googleapis/google-api-nodejs-client, a TypeScript project with 12,268 GitHub stars. SynthScan examined 5,263,449 lines of code across 3622 source files, recording 4447 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 7.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1442 finding(s).
Are imports declared and package/API names verified? 3005 finding(s).
Are wrappers, guards, and repeated structures necessary? 24 finding(s).
Which changes need focused human review? 4447 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4447 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/apis/dataflow/v1b3.ts | 11350 | * const res = await dataflow.projects.locations.jobs.debug.getConfig({ | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 11507 | * const res = await dataflow.projects.locations.jobs.debug.getWorkerStacktraces( | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 11669 | * const res = await dataflow.projects.locations.jobs.debug.sendCapture({ | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 11892 | * const res = await dataflow.projects.locations.jobs.messages.list({ | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 12091 | * const res = await dataflow.projects.locations.jobs.snapshots.list({ | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 12258 | * const res = await dataflow.projects.locations.jobs.stages.getExecutionDetails( | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 12461 | * const res = await dataflow.projects.locations.jobs.workItems.lease({ | COMMENT |
| CRITICAL | src/apis/dataflow/v1b3.ts | 12622 | * const res = await dataflow.projects.locations.jobs.workItems.reportStatus({ | COMMENT |
| CRITICAL | src/apis/privateca/v1beta1.ts | 1219 | * await privateca.projects.locations.certificateAuthorities.certificateRevocationLists.getIamPolicy( | COMMENT |
| CRITICAL | src/apis/privateca/v1beta1.ts | 1365 | * await privateca.projects.locations.certificateAuthorities.certificateRevocationLists.setIamPolicy( | COMMENT |
| CRITICAL | src/apis/privateca/v1beta1.ts | 1518 | * await privateca.projects.locations.certificateAuthorities.certificateRevocationLists.testIamPermissions( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 3333 | * await privateca.projects.locations.caPools.certificateAuthorities.activate({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 3485 | * await privateca.projects.locations.caPools.certificateAuthorities.create({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 3658 | * await privateca.projects.locations.caPools.certificateAuthorities.delete({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 3805 | * await privateca.projects.locations.caPools.certificateAuthorities.disable({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 3956 | * await privateca.projects.locations.caPools.certificateAuthorities.enable({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 4103 | * await privateca.projects.locations.caPools.certificateAuthorities.fetch({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 4249 | * await privateca.projects.locations.caPools.certificateAuthorities.get({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 4405 | * await privateca.projects.locations.caPools.certificateAuthorities.list({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 4564 | * await privateca.projects.locations.caPools.certificateAuthorities.patch({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 4734 | * await privateca.projects.locations.caPools.certificateAuthorities.undelete({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5030 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.get( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5178 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.getIamPolicy( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5324 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.list( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5486 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.patch( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5648 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.setIamPolicy( | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 5801 | * await privateca.projects.locations.caPools.certificateAuthorities.certificateRevocationLists.testIamPermissio | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 6040 | * const res = await privateca.projects.locations.caPools.certificates.create({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 6222 | * const res = await privateca.projects.locations.caPools.certificates.get({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 6371 | * const res = await privateca.projects.locations.caPools.certificates.list({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 6520 | * const res = await privateca.projects.locations.caPools.certificates.patch({ | COMMENT |
| CRITICAL | src/apis/privateca/v1.ts | 6695 | * const res = await privateca.projects.locations.caPools.certificates.revoke({ | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3103 | * await workstations.projects.locations.workstationClusters.workstationConfigs.create( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3286 | * await workstations.projects.locations.workstationClusters.workstationConfigs.delete( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3433 | * await workstations.projects.locations.workstationClusters.workstationConfigs.get( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3597 | * await workstations.projects.locations.workstationClusters.workstationConfigs.getIamPolicy( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3743 | * await workstations.projects.locations.workstationClusters.workstationConfigs.list( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 3899 | * await workstations.projects.locations.workstationClusters.workstationConfigs.listUsable( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 4056 | * await workstations.projects.locations.workstationClusters.workstationConfigs.patch( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 4237 | * await workstations.projects.locations.workstationClusters.workstationConfigs.setIamPolicy( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 4390 | * await workstations.projects.locations.workstationClusters.workstationConfigs.testIamPermissions( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 4681 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.create( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 4855 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.delete( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5000 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.generateAccessToken | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5157 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.get( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5312 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.getIamPolicy( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5458 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.list( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5609 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.listUsable( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5763 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.patch( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 5935 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.setIamPolicy( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 6088 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.start( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 6239 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.stop( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 6389 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.suspend( | COMMENT |
| CRITICAL | src/apis/workstations/v1.ts | 6542 | * await workstations.projects.locations.workstationClusters.workstationConfigs.workstations.testIamPermissions( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 2905 | * await workstations.projects.locations.workstationClusters.workstationConfigs.create( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 3092 | * await workstations.projects.locations.workstationClusters.workstationConfigs.delete( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 3239 | * await workstations.projects.locations.workstationClusters.workstationConfigs.get( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 3407 | * await workstations.projects.locations.workstationClusters.workstationConfigs.getIamPolicy( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 3553 | * await workstations.projects.locations.workstationClusters.workstationConfigs.list( | COMMENT |
| CRITICAL | src/apis/workstations/v1beta.ts | 3709 | * await workstations.projects.locations.workstationClusters.workstationConfigs.listUsable( | COMMENT |
| 2916 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | owlbot.py | 1 | # Copyright 2021 Google LLC | COMMENT |
| LOW | .mocharc.js | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | .jsdoc.js | 1 | // Copyright 2019 Google LLC | COMMENT |
| LOW | .prettierrc.js | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.apikey.ts | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | test/test.auth.ts | 1 | // Copyright 2013 Google LLC | COMMENT |
| LOW | test/test.options.ts | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | test/test.drive.v2.ts | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | test/test.transporters.ts | 1 | // Copyright 2019 Google LLC | COMMENT |
| LOW | test/test.docs.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/utils.ts | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | test/test.generator.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.query.ts | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | test/test.index.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.media.ts | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | test/test.disclaimer.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.clients.ts | 1 | // Copyright 2013 Google LLC | COMMENT |
| LOW | test/test.synth.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.discover.ts | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | test/test.path.ts | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | test/test.download.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.samplegen.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | test/test.filters.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | system-test/auth.test.ts | 1 | // Copyright 2019 Google LLC | COMMENT |
| LOW | system-test/http2.test.ts | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | system-test/kitchen.test.ts | 1 | // Copyright 2017 Google LLC | COMMENT |
| LOW | samples/multiple.js | 1 | // Copyright 2013 Google LLC | COMMENT |
| LOW | samples/oauth2.js | 1 | // Copyright 2012 Google LLC | COMMENT |
| LOW | samples/accessTokenAuth.js | 1 | // Copyright 2020 Google LLC | COMMENT |
| LOW | samples/jwt.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/defaultauth.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/mediaupload.js | 1 | // Copyright 2013 Google LLC | COMMENT |
| LOW | samples/sheets/insert-column.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/sheets/append.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/sheets/quickstart.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.docs.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.auth.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.analyticsReporting.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.gmail.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.sheets.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.blog.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.compute.samples.js | 1 | // Copyright 2019 Google, LLC | COMMENT |
| LOW | samples/test/common.js | 1 | // Copyright 2025 Google LLC | COMMENT |
| LOW | samples/test/test.samples.youtube.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.webmasters.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.customsearch.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/test/test.samples.drive.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/typescript/typescript.ts | 1 | // Copyright 2021 Google LLC | COMMENT |
| LOW | samples/directory_v1/group-email-insert.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/directory_v1/group-delete.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/directory_v1/group-insert.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/directory_v1/group-email-delete.js | 1 | // Copyright 2014 Google LLC | COMMENT |
| LOW | samples/docs/create.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/docs/get.js | 1 | // Copyright 2018 Google LLC | COMMENT |
| LOW | samples/youtube/upload.js | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | samples/youtube/search.js | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | samples/youtube/playlist.js | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | samples/customsearch/customsearch.js | 1 | // Copyright 2012 Google LLC | COMMENT |
| LOW | samples/webmasters/query.js | 1 | // Copyright 2016 Google LLC | COMMENT |
| LOW | samples/compute/listVMs.js | 1 | // Copyright 2019 Google LLC | COMMENT |
| 1290 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | discovery/androidpublisher-v3.json | 1931 | "description": "Optional. Whether the image was generated by AI. Attested by the developer.", | CODE |
| HIGH⚡ | discovery/androidpublisher-v3.json | 1939 | "The content is not generated by AI.", | CODE |
| HIGH⚡ | discovery/androidpublisher-v3.json | 1940 | "The content is generated by AI and attested by the developer." | CODE |
| HIGH⚡ | discovery/androidpublisher-v3.json | 9513 | "description": "Optional. Whether the image was generated by AI. Attested by the developer.", | CODE |
| HIGH⚡ | discovery/androidpublisher-v3.json | 9521 | "The content is not generated by AI.", | CODE |
| HIGH⚡ | discovery/androidpublisher-v3.json | 9522 | "The content is generated by AI and attested by the developer." | CODE |
| HIGH | discovery/ces-v1beta.json | 6640 | "Voice instruction will be automatically generated by AI from the audio sample.", | CODE |
| HIGH | discovery/ces-v1.json | 4592 | "Voice instruction will be automatically generated by AI from the audio sample.", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | discovery/logging-v2.json | 10596 | "description": "Optional. The ID of the Cloud Trace (https://docs.cloud.google.com/trace/docs) span associated | CODE |
| MEDIUM | discovery/sts-v1.json | 345 | "description": "Fetches the signing keys for an agentic or managed workload identity pool and retu | CODE |
| MEDIUM | discovery/sts-v1.json | 371 | "description": "Gets the OIDC provider configuration for an agentic or managed workload identity p | CODE |
| MEDIUM | discovery/sts-v1.json | 371 | "description": "Gets the OIDC provider configuration for an agentic or managed workload identity p | CODE |
| MEDIUM | discovery/sts-v1.json | 409 | "description": "Fetches the signing keys for an agentic or managed workload identity pool and retu | CODE |
| MEDIUM | discovery/sts-v1.json | 435 | "description": "Gets the OIDC provider configuration for an agentic or managed workload identity p | CODE |
| MEDIUM | discovery/sts-v1.json | 435 | "description": "Gets the OIDC provider configuration for an agentic or managed workload identity p | CODE |
| MEDIUM⚡ | src/apis/ces/v1.ts | 12648 | * // Optional. Filter to be applied when listing the guardrails. See https://google.aip.dev/160 for more detail | COMMENT |
| MEDIUM⚡ | src/apis/ces/v1.ts | 12656 | * // Required. The resource name of the app to list guardrails from. | COMMENT |
| MEDIUM⚡ | src/apis/ces/v1.ts | 12663 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 5829 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 6620 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 7247 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 7283 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 7741 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 7772 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 8072 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 8382 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 8413 | * // "guardrails": [], | COMMENT |
| MEDIUM | src/apis/ces/v1.ts | 12798 | * // Identifier. The unique identifier of the guardrail. Format: `projects/{project\}/locations/{location\}/app | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 426 | * Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWK Set format, def | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 582 | * Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 dis | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 582 | * Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 dis | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 788 | * Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWK Set format, def | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 945 | * Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 dis | COMMENT |
| MEDIUM | src/apis/sts/v1.ts | 945 | * Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 dis | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | discovery/searchads360-v0.json | 14374 | "The plan is not enabled and API cannot provide mutation, forecast or stats.", | CODE |
| LOW | discovery/merchantapi-datasources_v1.json | 994 | "description": "The [supplemental data source](https://developers.google.com/merchant/api/guides/data-sources/api- | CODE |
| MEDIUM | discovery/firebasehosting-v1beta1.json | 228 | "description": "Required. The fully-qualified resource name for the Hosting site, in the format: proje | CODE |
| MEDIUM | discovery/ml-v1.json | 3283 | "description": "Optional. Specifies the type of virtual machine to use for your training job's master worker. | CODE |
| MEDIUM | discovery/dlp-v2.json | 13417 | "description": "Specification of the field containing the timestamp of scanned items. Used for data sources li | CODE |
| MEDIUM | discovery/healthcare-v1beta1.json | 3243 | "description": "Bulk exports a Group resource and resources in the member field, including related | CODE |
| MEDIUM | discovery/healthcare-v1.json | 3058 | "description": "Bulk exports a Group resource and resources in the member field, including related | CODE |
| MEDIUM | discovery/customsearch-v1.json | 920 | "description": "Metadata and refinements associated with the given search engine, including: * The name of the | CODE |
| MEDIUM | discovery/admin-directory_v1.json | 8076 | "description": "Output only. The customer ID to [retrieve all account users](https://developers.google.com/wor | CODE |
| LOW | discovery/merchantapi-datasources_v1beta.json | 1006 | "description": "The [supplemental data source](https://developers.google.com/merchant/api/guides/data-sources/api- | CODE |
| MEDIUM | src/apis/healthcare/v1.ts | 12025 | * Bulk exports a Group resource and resources in the member field, including related resources for each Patient mem | COMMENT |
| MEDIUM | src/apis/admin/directory_v1.ts | 2292 | * Output only. The customer ID to [retrieve all account users](https://developers.google.com/workspace/admin/direct | COMMENT |
| MEDIUM | src/apis/firebasehosting/v1beta1.ts | 1509 | * // Required. The fully-qualified resource name for the Hosting site, in the format: projects/PROJECT_IDENTIFI | COMMENT |
| MEDIUM | src/apis/firebasehosting/v1beta1.ts | 2236 | * Required. The fully-qualified resource name for the Hosting site, in the format: projects/PROJECT_IDENTIFIER/site | COMMENT |
| MEDIUM | src/apis/customsearch/v1.ts | 243 | * Metadata and refinements associated with the given search engine, including: * The name of the search engine that | COMMENT |
| MEDIUM | src/apis/ml/v1.ts | 1263 | * Optional. Specifies the type of virtual machine to use for your training job's master worker. You must specify th | COMMENT |
| LOW | src/apis/merchantapi/datasources_v1.ts | 500 | * The [supplemental data source](https://developers.google.com/merchant/api/guides/data-sources/api-sources#link-supp | COMMENT |
| LOW | src/apis/merchantapi/datasources_v1beta.ts | 500 | * The [supplemental data source](https://developers.google.com/merchant/api/guides/data-sources/api-sources#link-supp | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | discovery/firebaseappcheck-v1.json | 2144 | "description": "Specifies whether your running app is allowed to have the `UNRECOGNIZED_VERSION` [app recognit | CODE |
| MEDIUM | discovery/firebaseappcheck-v1beta.json | 2360 | "description": "Specifies whether your running app is allowed to have the `UNRECOGNIZED_VERSION` [app recognit | CODE |
| MEDIUM | discovery/ml-v1.json | 2085 | "description": "Immutable. Specifies the command that runs when the container starts. This overrides the conta | CODE |
| MEDIUM | discovery/merchantapi-accounts_v1beta.json | 4462 | "description": "The phone number's extension. The extension is not standardized in ITU recommendations, except | CODE |
| MEDIUM | discovery/dlp-v2.json | 12962 | "description": "Message for detecting output from deidentification transformations such as [`CryptoReplaceFfxFpeCo | CODE |
| MEDIUM | discovery/merchantapi-accounts_v1.json | 4585 | "description": "The phone number's extension. The extension is not standardized in ITU recommendations, except | CODE |
| MEDIUM | discovery/admin-directory_v1.json | 7694 | "description": "Optional. The condition associated with this role assignment. Note: Feature is available to En | CODE |
| LOW | .kokoro/populate-secrets.sh | 29 | # For local run, we just use the gcloud command for retrieving the | COMMENT |
| MEDIUM | src/apis/admin/directory_v1.ts | 2035 | * Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, | COMMENT |
| MEDIUM | src/apis/firebaseappcheck/v1.ts | 580 | * Specifies whether your running app is allowed to have the `UNRECOGNIZED_VERSION` [app recognition verdict](https: | COMMENT |
| MEDIUM | src/apis/firebaseappcheck/v1beta.ts | 619 | * Specifies whether your running app is allowed to have the `UNRECOGNIZED_VERSION` [app recognition verdict](https: | COMMENT |
| MEDIUM | src/apis/ml/v1.ts | 475 | * Immutable. Specifies the command that runs when the container starts. This overrides the container's [`ENTRYPOINT | COMMENT |
| MEDIUM | src/apis/merchantapi/accounts_v1.ts | 1507 | * The phone number's extension. The extension is not standardized in ITU recommendations, except for being defined | COMMENT |
| MEDIUM | src/apis/merchantapi/accounts_v1beta.ts | 1457 | * The phone number's extension. The extension is not standardized in ITU recommendations, except for being defined | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/apis/mybusinessaccountmanagement/index.ts | 23 | export function mybusinessaccountmanagement( | CODE |
| LOW | src/apis/mybusinessaccountmanagement/index.ts | 26 | export function mybusinessaccountmanagement( | CODE |
| LOW | src/apis/readerrevenuesubscriptionlinking/index.ts | 23 | export function readerrevenuesubscriptionlinking( | CODE |
| LOW | src/apis/readerrevenuesubscriptionlinking/index.ts | 26 | export function readerrevenuesubscriptionlinking( | CODE |
| LOW | src/apis/paymentsresellersubscription/index.ts | 23 | export function paymentsresellersubscription( | CODE |
| LOW | src/apis/paymentsresellersubscription/index.ts | 26 | export function paymentsresellersubscription( | CODE |
| LOW | src/apis/mybusinessbusinessinformation/index.ts | 23 | export function mybusinessbusinessinformation( | CODE |
| LOW | src/apis/mybusinessbusinessinformation/index.ts | 26 | export function mybusinessbusinessinformation( | CODE |
| LOW | src/apis/androiddeviceprovisioning/index.ts | 23 | export function androiddeviceprovisioning( | CODE |
| LOW | src/apis/androiddeviceprovisioning/index.ts | 26 | export function androiddeviceprovisioning( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 27 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 30 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 33 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 36 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 39 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/authorizedbuyersmarketplace/index.ts | 42 | export function authorizedbuyersmarketplace( | CODE |
| LOW⚡ | src/apis/serviceconsumermanagement/index.ts | 25 | export function serviceconsumermanagement( | CODE |
| LOW⚡ | src/apis/serviceconsumermanagement/index.ts | 28 | export function serviceconsumermanagement( | CODE |
| LOW⚡ | src/apis/serviceconsumermanagement/index.ts | 31 | export function serviceconsumermanagement( | CODE |
| LOW⚡ | src/apis/serviceconsumermanagement/index.ts | 34 | export function serviceconsumermanagement( | CODE |
| LOW | src/apis/businessprofileperformance/index.ts | 23 | export function businessprofileperformance( | CODE |
| LOW | src/apis/businessprofileperformance/index.ts | 26 | export function businessprofileperformance( | CODE |
| LOW | src/generator/download.ts | 128 | export function validateDiscoveryDocFileName(fileName: string) { | CODE |
| LOW | src/generator/download.ts | 159 | function cleanupLibrariesNotInIndexJSON( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | discovery/iam-v1.json | 4088 | "description": "Required. The resource name of the service account key. Use one of the following f | CODE |
| LOW | discovery/iam-v1.json | 4113 | "description": "Required. The resource name of the service account key. Use one of the following f | CODE |
| LOW | discovery/iam-v1.json | 4141 | "description": "Required. The resource name of the service account key. Use one of the following f | CODE |
| LOW | discovery/iam-v1.json | 4169 | "description": "Required. The resource name of the service account key. Use one of the following f | CODE |
| LOW | discovery/androidenterprise-v1.json | 5000 | "placeholder": { | CODE |
| LOW | discovery/monitoring-v1.json | 1503 | "description": "string filtering the events - event dependant. Example values: \"resource.labels.pod_name = 'p | CODE |
| LOW | discovery/slides-v1.json | 1545 | "placeholder": { | CODE |
| LOW | discovery/slides-v1.json | 3441 | "placeholder": { | CODE |
| LOW | samples/people/contacts.js | 56 | displayName: 'John Doe', | CODE |
| LOW | src/apis/factchecktools/v1alpha1.ts | 134 | * A person or organization stating the claim. For instance, "John Doe". | COMMENT |
| LOW | src/apis/factchecktools/v1alpha1.ts | 163 | * A person or organization stating the claim. For instance, "John Doe". Corresponds to `ClaimReview.itemReviewed.au | COMMENT |
| LOW | src/apis/iamcredentials/v1.ts | 216 | * Required. The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: | COMMENT |
| LOW | src/apis/walletobjects/v1.ts | 1101 | * Name of the ticket holder, if the ticket is assigned to a person. E.g. "John Doe" or "Jane Doe". | COMMENT |
| LOW | src/apis/walletobjects/v1.ts | 1101 | * Name of the ticket holder, if the ticket is assigned to a person. E.g. "John Doe" or "Jane Doe". | COMMENT |
| LOW | src/apis/bigquery/v2.ts | 6349 | * // Optional. The version of the access policy schema to fetch. Valid values are 0, 1, and 3. Requests specify | COMMENT |
| LOW | src/apis/bigquery/v2.ts | 7467 | * Optional. The version of the access policy schema to fetch. Valid values are 0, 1, and 3. Requests specifying an | COMMENT |
| LOW | src/apis/iam/v1.ts | 1342 | * Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/ | COMMENT |
| LOW | src/apis/iam/v1.ts | 22747 | * // Required. The resource name of the service account key. Use one of the following formats: * `projects/{PRO | COMMENT |
| LOW | src/apis/iam/v1.ts | 22878 | * // Required. The resource name of the service account key. Use one of the following formats: * `projects/{PRO | COMMENT |
| LOW | src/apis/iam/v1.ts | 23018 | * // Required. The resource name of the service account key. Use one of the following formats: * `projects/{PRO | COMMENT |
| LOW | src/apis/iam/v1.ts | 23155 | * // Required. The resource name of the service account key. Use one of the following formats: * `projects/{PRO | COMMENT |
| LOW | src/apis/iam/v1.ts | 23583 | * Required. The resource name of the service account key. Use one of the following formats: * `projects/{PROJECT_ID | COMMENT |
| LOW | src/apis/iam/v1.ts | 23589 | * Required. The resource name of the service account key. Use one of the following formats: * `projects/{PROJECT_ID | COMMENT |
| LOW | src/apis/iam/v1.ts | 23600 | * Required. The resource name of the service account key. Use one of the following formats: * `projects/{PROJECT_ID | COMMENT |
| LOW | src/apis/iam/v1.ts | 23611 | * Required. The resource name of the service account key. Use one of the following formats: * `projects/{PROJECT_ID | COMMENT |
| LOW | src/apis/vmwareengine/v1.ts | 666 | * Required. The consumer provided user/service account which needs to be granted permission to bind with the intran | COMMENT |
| LOW | src/apis/vmwareengine/v1.ts | 1648 | * Users/Service accounts which have access for DNS binding on the intranet VPC corresponding to the consumer project. | COMMENT |
| LOW | src/apis/vmwareengine/v1.ts | 1818 | * Required. The consumer provided user/service account which needs to be granted permission to bind with the intran | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .kokoro/trampoline.sh | 16 | # This file is not used any more, but we keep this file for making it | COMMENT |
| MEDIUM | .kokoro/populate-secrets.sh | 16 | # This file is called in the early stage of `trampoline_v2.sh` to | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 271 | auth: 'YOUR_API_KEY' // specify your API key here | CODE |