AI Slop Code Risk Monitor

goreleaser/goreleaser

SlopCodeMonitor badge for goreleaser/goreleaser Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Release engineering, simplified

1.8 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for goreleaser/goreleaser, a Go project with 16,127 GitHub stars. SynthScan examined 153,355 lines of code across 832 source files, recording 277 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 1.8 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.8
Adjusted Signal
1.8
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
16.1K
Stars
Go
Language
153.4K
Lines of Code
832
Files
277
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 250 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 27 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 8.7/100 · LOW

Which changes need focused human review? 277 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 1LOW 276

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 277 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block249 hits · 249 pts
SeverityFileLineSnippetContext
LOW.svu.yml1# svu configuration.COMMENT
LOWinternal/pipeline/pipeline.go61// BuildPipeline contains all build-related pipe implementations in order.COMMENT
LOWinternal/pipe/brew/doc.go1// Package brew implements the Pipe, providing formula generation andCOMMENT
LOWinternal/pipe/sign/sign_docker_test.go81func TestDockerSignArtifacts(t *testing.T) {COMMENT
LOWinternal/builders/node/build.go1// Package node builds Node.js Single Executable Application (SEA)COMMENT
LOWinternal/static/config.go21// DenoExampleConfig is the config used within goreleaser init --language deno.COMMENT
LOWinternal/static/config.go41// PoetryExampleConfig is the config used within goreleaser init --language poetry.COMMENT
LOWinternal/testlib/path.go81func Exit(status int) string {COMMENT
LOWinternal/artifact/artifact.go61 // Signature is a signature file.COMMENT
LOWinternal/artifact/artifact.go881 }COMMENT
LOWinternal/nodedist/dist.go1// Package nodedist is a small client for the official Node.jsCOMMENT
LOWinternal/nodedist/dist.go21//nolint:gochecknoglobalsCOMMENT
LOWwww/content/customization/sbom.md21COMMENT
LOWwww/content/customization/sbom.md41 #COMMENT
LOWwww/content/customization/sbom.md61 args: ["$artifact", "--output", "cyclonedx-json=$document"]COMMENT
LOWwww/content/customization/sbom.md81 # - binary: binaries output from the build stageCOMMENT
LOWwww/content/customization/verify.md41 #COMMENT
LOWwww/content/customization/verify.md61 args: ["-c", "{{ .ProjectName }}_{{ .Version }}_checksums.txt"]COMMENT
LOWwww/content/customization/announce/discourse.md41 #COMMENT
LOWwww/content/customization/announce/smtp.md41 # Default: '$SMTP_USERNAME'.COMMENT
LOWwww/content/customization/announce/slack.md41 #COMMENT
LOWwww/content/customization/announce/reddit.md21COMMENT
LOWwww/content/customization/announce/webhook.md21 #COMMENT
LOWwww/content/customization/announce/webhook.md41 # Headers to send with the webhook.COMMENT
LOWwww/content/customization/announce/telegram.md21announce:COMMENT
LOWwww/content/customization/announce/teams.md21COMMENT
LOWwww/content/customization/announce/mattermost.md21 # Title to use while publishing.COMMENT
LOWwww/content/customization/announce/discord.md21 enabled: trueCOMMENT
LOWwww/content/customization/general/templatefiles.md21 # Source path of the template file.COMMENT
LOWwww/content/customization/general/metadata.md21 # {{< g_inline_pro >}}COMMENT
LOWwww/content/customization/general/metadata.md41 # Your app's description.COMMENT
LOWwww/content/customization/general/metadata.md61 headers:COMMENT
LOWwww/content/customization/general/metadata.md81 # Templates: allowed.COMMENT
LOWwww/content/customization/ci/gitlab.md81 # Optionally use GitLab's built-in image registry.COMMENT
LOWwww/content/customization/builds/universalbinaries.md21 # Notice that you shouldn't include different apps' IDs here.COMMENT
LOWwww/content/customization/builds/builders/bun.md21 # Use bun.COMMENT
LOWwww/content/customization/builds/builders/bun.md41 #COMMENT
LOWwww/content/customization/builds/builders/bun.md61COMMENT
LOWwww/content/customization/builds/builders/uv.md41COMMENT
LOWwww/content/customization/builds/builders/uv.md61 command: buildCOMMENT
LOWwww/content/customization/builds/builders/go.md21 #COMMENT
LOWwww/content/customization/builds/builders/go.md41 # Templates: allowed.COMMENT
LOWwww/content/customization/builds/builders/go.md61 - all=-trimpath={{.Env.GOPATH}}COMMENT
LOWwww/content/customization/builds/builders/go.md121 goarch:COMMENT
LOWwww/content/customization/builds/builders/go.md141 # When using `ignore`, match the exact form: `goarm: 7` ignores only a bareCOMMENT
LOWwww/content/customization/builds/builders/go.md161 #COMMENT
LOWwww/content/customization/builds/builders/go.md181 # Default: [ 'sse2' ].COMMENT
LOWwww/content/customization/builds/builders/go.md221 # applicable: `_{goarm}`, `_{goamd64}`, `_{gomips}`, `_{go386}`,COMMENT
LOWwww/content/customization/builds/builders/go.md241 # Default: "go".COMMENT
LOWwww/content/customization/builds/builders/go.md261 # Hooks can be used to customize the final binary,COMMENT
LOWwww/content/customization/builds/builders/go.md281 # created, you can set this property.COMMENT
LOWwww/content/customization/builds/builders/zig.md21 # Use zig.COMMENT
LOWwww/content/customization/builds/builders/zig.md41COMMENT
LOWwww/content/customization/builds/builders/rust.md21 # Use rust.COMMENT
LOWwww/content/customization/builds/builders/rust.md41COMMENT
LOWwww/content/customization/builds/builders/node.md41 # win-arm64, win-x64.COMMENT
LOWwww/content/customization/builds/builders/deno.md41 # Path to project's (sub)directory containing the code.COMMENT
LOWwww/content/customization/builds/builders/deno.md61 # Default: 'compile'.COMMENT
LOWwww/content/customization/builds/builders/poetry.md41COMMENT
LOWwww/content/customization/builds/builders/poetry.md61 command: buildCOMMENT
189 more matches not shown…
Fake / Example Data27 hits · 27 pts
SeverityFileLineSnippetContext
LOWinternal/pipe/scoop/scoop_test.go54 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/scoop/scoop_test.go930 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/scoop/scoop_test.go1198 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/opencollective/opencollective_test.go108 return client{endpoint: srv.URL, token: "fake-token"}CODE
LOWinternal/pipe/chocolatey/chocolatey_test.go71 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/chocolatey/chocolatey_test.go196 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/chocolatey/chocolatey_test.go235 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/chocolatey/chocolatey_test.go267 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/chocolatey/skip_test.go22 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/pipe/git/git_test.go219 require.NoError(t, os.WriteFile(dummy.Name(), []byte("lorem ipsum"), 0o644))CODE
LOWinternal/tmpl/tmpl_test.go360 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/builders/node/sea_test.go33 "placeholder": machoSignaturePlaceholder(t, original),CODE
LOWinternal/exec/exec_test.go50 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/exec/testdata/a.txt1lorem ipsumCODE
LOWinternal/artifact/artifact_test.go558 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/artifact/artifact_test.go591 require.NoError(t, os.WriteFile(file, []byte("lorem ipsum"), 0o644))CODE
LOWinternal/client/gitea_test.go824 FullName: "John Doe",CODE
LOWinternal/client/gitea_test.go866 Name: "John Doe",CODE
LOWinternal/client/gitea_test.go870 AuthorName: "John Doe",CODE
LOWinternal/client/gitea_test.go1219 err = client.CreateFile(ctx, config.CommitAuthor{Name: "test", Email: "test@test.com"}, repo, []byte("content"), "newfiCODE
LOWinternal/client/git_test.go23 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go324 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go414 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go448 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go484 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go516 Email: "foo@bar.com",CODE
LOWinternal/client/git_test.go611 Email: "foo@bar.com",CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMinternal/builders/golang/gomain/gomain.go40// to use [All] instead, which is more robust and works on modules.COMMENT