1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

9.0K

Stars

Language

288.7K

Lines of Code

1.1K

Files

246

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 233 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 13 finding(s).

Agent Over-Engineering Ratio 2.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 129 finding(s).

PR Review Velocity Impact 4.2/100 · LOW

Which changes need focused human review? 246 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 246

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 246 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers129 hits · 137 pts

Severity	File	Line	Snippet	Context
LOW	frontend/tests/playwright/playwright-auth.ts	17	export async function fillPlaywrightAdminPasswordPrompt(	CODE
LOW	frontend/tests/playwright/test-setup.ts	7	export function isExactSettingsApiResponse(	CODE
LOW	frontend/tests/playwright/test-setup.ts	47	export async function expectLockTooltipOnRowHover(	CODE
LOW	frontend/tests/playwright/test-setup.ts	223	export async function getOrCreateShareViaApi(	CODE
LOW	frontend/tests/playwright/test-setup.ts	330	export async function disableAndCloseHalloweenPrompt(page: Page): Promise<void> {	CODE
LOW	frontend/tests/playwright/test-setup.ts	596	export async function openAdvancedProfileSettings(	CODE
LOW	frontend/tests/playwright/test-setup.ts	724	export async function selectExpandDropdownOption(	CODE
LOW	frontend/tests/playwright/settings/0-migration.spec.ts	85	function sourcePermissionsForAllSources(	CODE
LOW	frontend/tests/playwright/settings/0-migration.spec.ts	92	function sourcePermissionsForSources(	CODE
LOW⚡	frontend/tests/playwright/settings/0-migration.spec.ts	269	async function expectSourceSidebarLinkWorks(page: Page, sourceName: string) {	CODE
LOW⚡	frontend/tests/playwright/settings/0-migration.spec.ts	278	function userRowInSettingsUsersTable(page: Page, username: string): Locator {	CODE
LOW⚡	frontend/tests/playwright/settings/0-migration.spec.ts	284	function shareRowInSettingsSharesTable(page: Page, hash: string): Locator {	CODE
LOW	frontend/tests/playwright/settings/user-edit-helpers.ts	6	export function userRowInSettingsUsersTable(page: Page, usernameText: string): Locator {	CODE
LOW	frontend/tests/playwright/settings/user-edit-helpers.ts	23	function globalPermissionContainer(modal: Locator, label: string): Locator {	CODE
LOW	frontend/tests/playwright/settings/user-edit-helpers.ts	37	export async function expandUserEditAccountDefaults(prefsModal: Locator): Promise<void> {	CODE
LOW⚡	frontend/tests/playwright/settings/user-edit-helpers.ts	60	export async function expandUserEditSourceScope(modal: Locator, sourceName: string) {	CODE
LOW⚡	frontend/tests/playwright/settings/user-edit-helpers.ts	66	export function userEditSourcePermissionCheckbox(	CODE
LOW⚡	frontend/tests/playwright/settings/user-edit-helpers.ts	76	export function userEditSourcePermissionToggle(	CODE
LOW	frontend/tests/playwright/settings/user-edit-helpers.ts	160	export async function confirmActorPasswordPrompt(page: Page) {	CODE
LOW	frontend/tests/playwright/performance/perf-helpers.ts	282	export async function runWithOptionalChromeTracing(	CODE
LOW	frontend/tests/playwright/performance/perf-frames.ts	201	export function startFrameWindowOnNextNavigation(page: {	CODE
LOW	frontend/src/utils/mimetype.js	41	export function isRichTextPreviewMimeType(mimeType) {	CODE
LOW	frontend/src/utils/playbackQuery.js	135	export function parsePlaybackTimeFromQuery(query) {	CODE
LOW	frontend/src/utils/playbackQuery.js	160	export function parseTranscodeModeFromQuery(query) {	CODE
LOW	frontend/src/utils/playbackQuery.js	244	export function formatPlaybackTimeQueryValue(seconds) {	CODE
LOW	frontend/src/utils/activityDetails.js	115	export function activityEventTypeBadgeClass(eventType) {	CODE
LOW	frontend/src/utils/activityDetails.js	200	export function defaultActivityOptionalRows() {	CODE
LOW	frontend/src/utils/activityDetails.js	205	export function allActivityOptionalRowsEnabled(rowsState) {	CODE
LOW	frontend/src/utils/activityDetails.js	217	export function optionalColumnsFromRowsState(rowsState) {	CODE
LOW⚡	frontend/src/utils/activityDetails.js	244	export function rowsStateFromOptionalColumns(columns) {	CODE
LOW⚡	frontend/src/utils/activityDetails.js	252	export function allOptionalColumnsSelected(columns) {	CODE
LOW⚡	frontend/src/utils/activityDetails.js	260	export function formatOptionalColumnsParam(columns) {	CODE
LOW	frontend/src/utils/activityDetails.js	290	export function normalizeActivityTableRow(row) {	CODE
LOW	frontend/src/utils/activityDetails.js	324	function formatActivityFieldChange(change, eventType) {	CODE
LOW	frontend/src/utils/activityDetails.js	465	export function buildActivityDetailBadges(row) {	CODE
LOW	frontend/src/utils/pdfPreview.js	16	export function shouldUsePdfPreviewFallback() {	CODE
LOW	frontend/src/utils/sidebarCategory.ts	28	export function isRootOnlySidebarCategory(category?: string): boolean {	CODE
LOW	frontend/src/utils/appNotifications.js	22	export function getNotificationPermission() {	CODE
LOW	frontend/src/utils/appNotifications.js	29	export async function requestNotificationPermission() {	CODE
LOW	frontend/src/utils/appNotifications.js	42	export function isAppNotificationsEnabled() {	CODE
LOW	frontend/src/utils/appNotifications.js	52	export function setAppNotificationsEnabled(enabled) {	CODE
LOW	frontend/src/utils/appNotifications.js	173	export function extractMoveCopyErrorMessage(error, fallback) {	CODE
LOW	frontend/src/utils/auth.js	37	function setSessionExpiresAtFromToken(token) {	CODE
LOW	frontend/src/utils/auth.js	58	export function shouldRefreshBeforeExpiry(expiresAtSeconds, refreshBeforeMs) {	CODE
LOW	frontend/src/utils/metadataCache.js	51	export function invalidateDirMetadataCache(opts = {}) {	CODE
LOW	frontend/src/utils/shareDefaultsForm.js	3	export function emptyShareDefaultsEnforced() {	CODE
LOW	frontend/src/utils/shareDefaultsForm.js	113	export function shareDefaultsToApiPayload(form) {	CODE
LOW	frontend/src/utils/shareDefaultsForm.js	170	export function defaultSidebarLinksForShareType(shareType) {	CODE
LOW⚡	frontend/src/utils/i18nLabels.js	52	export function downloadFilesPermissionLabel($t) {	CODE
LOW⚡	frontend/src/utils/i18nLabels.js	60	export function createFilesPermissionLabel($t) {	CODE
LOW⚡	frontend/src/utils/i18nLabels.js	64	export function deleteFilesPermissionLabel($t) {	CODE
LOW⚡	frontend/src/utils/i18nLabels.js	68	export function shareFilesPermissionLabel($t) {	CODE
LOW	frontend/src/utils/subtitles.js	11	export function getSubtitleFormatExtension(filename) {	CODE
LOW	frontend/src/utils/notificationActions.js	7	export function goToItemNotificationButton(label, source, path, isShare) {	CODE
LOW	frontend/src/utils/notificationActions.js	19	export function restoreNotificationButtonAction(button) {	CODE
LOW	frontend/src/utils/notificationActions.js	33	export function resolveHistoryNotificationButtons(buttons, activeButtons) {	CODE
LOW	frontend/src/utils/activityChartTime.js	71	export function clampActivityChartInterval(interval, rangeSecs) {	CODE
LOW	frontend/src/utils/activityChartTime.js	90	export function activityChartIntervalAllowed(rangeSecs) {	CODE
LOW	frontend/src/utils/activityChartTime.js	106	export function resolveActivityChartInterval(from, to, preferred, maxBuckets = DEFAULT_MAX_CHART_BUCKETS) {	CODE
LOW	frontend/src/utils/tooltipHelp.js	15	function ensureGlobalDismissListeners() {	CODE
69 more matches not shown…

Over-Commented Block67 hits · 67 pts

Severity	File	Line	Snippet	Context
LOW	frontend/tests/playwright-files/files/for testing.md	1	# this is a test	COMMENT
LOW	frontend/src/api/index.js	1	// Backend route organization:	COMMENT
LOW	backend/config.playwright.yaml	61		COMMENT
LOW	backend/internal/database/sql/tempdb.go	61	// Synchronous controls the synchronous mode. OFF is fastest but less safe.	COMMENT
LOW	backend/internal/database/sql/tempdb.go	81		COMMENT
LOW	backend/internal/database/sql/tempdb.go	101	// this threshold and cache_size, SQLite will spill dirty pages to disk.	COMMENT
LOW	backend/internal/auth/json_timing_test.go	1	// Package auth_test contains timing attack tests for authentication.	COMMENT
LOW	backend/internal/web/users.go	101	}	COMMENT
LOW	backend/internal/web/users.go	341	}	COMMENT
LOW	backend/internal/web/media.go	21	// @Accept json	COMMENT
LOW	backend/internal/web/media.go	141	}	COMMENT
LOW	backend/internal/web/media.go	221	}, d.ShareUser)	COMMENT
LOW	backend/internal/web/media.go	301	// @Failure 404 {object} map[string]string "Not found"	COMMENT
LOW	backend/internal/web/duplicates.go	101	if s.checksumOperations >= maxChecksumOperations {	COMMENT
LOW	backend/internal/web/duplicates.go	121	// 5. Progressive Checksum Verification (2-pass):	COMMENT
LOW	backend/internal/web/auth.go	201		COMMENT
LOW	backend/internal/web/auth.go	301	LoginMethod: string(d.User.LoginMethod),	COMMENT
LOW	backend/internal/web/totp.go	41	}	COMMENT
LOW	backend/internal/web/preview.go	41	// previewHandler handles the preview request for images.	COMMENT
LOW	backend/internal/web/oidc.go	241	authURL := oauth2Config.AuthCodeURL(state)	COMMENT
LOW	backend/internal/web/stream.go	181	// @Description Mints or extends a source-scoped view token for inline viewing. Authenticated routes require a web sessi	COMMENT
LOW	backend/internal/web/stream.go	621	// @Description Returns raw file bytes for inline UI viewing in capped byte ranges on a share link. Requires viewToken f	COMMENT
LOW	backend/internal/web/resource.go	121	}	COMMENT
LOW	backend/internal/web/resource.go	201		COMMENT
LOW	backend/internal/web/resource.go	221	}	COMMENT
LOW	backend/internal/web/resource.go	361	// MoveCopyResponse represents the response from a move/copy operation	COMMENT
LOW	backend/internal/web/resource.go	681	pauseCache.Set(pauseUploadCacheKey(source, fullIndexPath), "1")	COMMENT
LOW	backend/internal/web/resource.go	701	src, ok := settings.Config.Server.SourceMap[d.Share.SourcePath]	COMMENT
LOW	backend/internal/web/resource.go	1161	// @Description Handles file and directory uploads to an upload-only public share. Supports chunked uploads, conflict re	COMMENT
LOW	backend/internal/web/resource.go	1201	}	COMMENT
LOW	backend/internal/web/resource.go	1261	status, err := putResourceWithQuota(w, r, d, source, userScope, fullIndexPath)	COMMENT
LOW	backend/internal/web/resource.go	1681	// @Tags Resources	COMMENT
LOW	backend/internal/web/resource.go	1841	return	COMMENT
LOW	backend/internal/web/resource.go	1881	}	COMMENT
LOW	backend/internal/web/access.go	41		COMMENT
LOW	backend/internal/web/access.go	101	}	COMMENT
LOW	backend/internal/web/access.go	181	activity.RecordAccessCreate(r, toActor(d), sourceName, parsedPath.String(), activity.AccessRuleCreateChanges(body.Allow	COMMENT
LOW	backend/internal/web/access.go	321	resp.Members = state.GetGroupMembers()	COMMENT
LOW	backend/internal/web/access.go	361	}	COMMENT
LOW	backend/internal/web/access.go	421	}	COMMENT
LOW	backend/internal/web/access.go	461	// @Summary Replace a user's group memberships	COMMENT
LOW	backend/internal/web/access.go	501	if len(unknown) > 0 {	COMMENT
LOW	backend/internal/web/download.go	101	// @Description Multiple Files:	COMMENT
LOW	backend/internal/web/download.go	141	// @Produce octet-stream	COMMENT
LOW	backend/internal/web/search.go	41	//	COMMENT
LOW	backend/internal/web/search.go	61	// @Description Searches for files matching the provided query. Returns file paths and metadata based on the user's sess	COMMENT
LOW	backend/internal/web/onlyOffice.go	121	Users []string `json:"users"`	COMMENT
LOW	backend/internal/web/onlyOffice.go	741	// complete: retire the document key so it cannot be reused.	COMMENT
LOW	backend/internal/web/archive.go	181	// @Description - fromSource (string, required): Source name where the paths to archive live. Example: `"default"`	COMMENT
LOW	backend/internal/web/archive.go	381	}	COMMENT
LOW	backend/internal/web/archive.go	401	// @Description - preview (boolean, optional): Return ZIP encoding candidates and sample filenames without extractin	COMMENT
LOW	backend/internal/web/webdav_uploads.go	21	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"	COMMENT
LOW	backend/internal/web/share.go	221	}	COMMENT
LOW	backend/internal/web/share.go	501	Token: token,	COMMENT
LOW	backend/internal/web/share.go	721	}	COMMENT
LOW	backend/internal/web/view.go	21	}	COMMENT
LOW	backend/internal/web/view.go	61		COMMENT
LOW	backend/internal/web/api.go	21	// @Description Create an API token with specified name, duration, and permissions.	COMMENT
LOW	backend/internal/web/api.go	121	}	COMMENT
LOW	backend/internal/web/api.go	241		COMMENT
7 more matches not shown…

Verbosity Indicators18 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW⚡	frontend/src/components/files/ExtendedImage.vue	179	// Step 1: Cache check happens automatically via thumbnailUrl computed property	COMMENT
LOW⚡	frontend/src/components/files/ExtendedImage.vue	181	// Step 2: Always start loading the real image	COMMENT
LOW	frontend/src/components/files/ExtendedImage.vue	278	// Step 3: Real image loaded - hide thumbnail and show image	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	771	// Step 1: Add some rules	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	779	// Step 2: Call GetAllRules to populate the cache	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	807	// Step 4: Delete a rule	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	816	// Step 5: Call GetAllRules again - should return fresh data (not cached)	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	833	// Step 6: Delete the remaining rule	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	842	// Step 7: Call GetAllRules again - should return empty result	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	893	// Step 2: Populate cache	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	902	// Step 3: Remove all rules for user1 (bulk operation)	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	908	// Step 4: Verify cache is cleared and rules are gone	COMMENT
LOW	backend/internal/database/access/access_test.go	796	// Step 3: Call GetAllRules again - should return cached result	COMMENT
LOW	backend/internal/database/access/access_test.go	882	// Step 1: Add multiple rules for user1	COMMENT
LOW	backend/internal/web/duplicates.go	274	// Step 1: Query IndexDB for size groups with 2+ files (already sorted by SQL)	COMMENT
LOW	backend/internal/web/duplicates.go	285	// Step 2: Process sizes in batches using bulk queries to minimize SQL round-trips	COMMENT
LOW⚡	backend/pkg/indexing/iteminfo/mediaMeta.go	27	// Step 1: Perform a small initial read to identify file type signature (magic bytes)	COMMENT
LOW⚡	backend/pkg/indexing/iteminfo/mediaMeta.go	35	// Step 2: Fast Path Exit & Format-Specific Handling	COMMENT

Structural Annotation Overuse18 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW⚡	frontend/src/components/files/ExtendedImage.vue	179	// Step 1: Cache check happens automatically via thumbnailUrl computed property	COMMENT
LOW⚡	frontend/src/components/files/ExtendedImage.vue	181	// Step 2: Always start loading the real image	COMMENT
LOW	frontend/src/components/files/ExtendedImage.vue	278	// Step 3: Real image loaded - hide thumbnail and show image	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	771	// Step 1: Add some rules	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	779	// Step 2: Call GetAllRules to populate the cache	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	807	// Step 4: Delete a rule	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	816	// Step 5: Call GetAllRules again - should return fresh data (not cached)	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	833	// Step 6: Delete the remaining rule	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	842	// Step 7: Call GetAllRules again - should return empty result	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	893	// Step 2: Populate cache	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	902	// Step 3: Remove all rules for user1 (bulk operation)	COMMENT
LOW⚡	backend/internal/database/access/access_test.go	908	// Step 4: Verify cache is cleared and rules are gone	COMMENT
LOW	backend/internal/database/access/access_test.go	796	// Step 3: Call GetAllRules again - should return cached result	COMMENT
LOW	backend/internal/database/access/access_test.go	882	// Step 1: Add multiple rules for user1	COMMENT
LOW	backend/internal/web/duplicates.go	274	// Step 1: Query IndexDB for size groups with 2+ files (already sorted by SQL)	COMMENT
LOW	backend/internal/web/duplicates.go	285	// Step 2: Process sizes in batches using bulk queries to minimize SQL round-trips	COMMENT
LOW⚡	backend/pkg/indexing/iteminfo/mediaMeta.go	27	// Step 1: Perform a small initial read to identify file type signature (magic bytes)	COMMENT
LOW⚡	backend/pkg/indexing/iteminfo/mediaMeta.go	35	// Step 2: Fast Path Exit & Format-Specific Handling	COMMENT

Fake / Example Data13 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW⚡	frontend/src/components/LoadingSpinner.vue	17	<div v-if="mode === 'placeholder'" class="placeholder-item placeholder-item-1"></div>	CODE
LOW⚡	frontend/src/components/LoadingSpinner.vue	18	<div v-if="mode === 'placeholder'" class="placeholder-item placeholder-item-2"></div>	CODE
LOW⚡	frontend/src/components/LoadingSpinner.vue	19	<div v-if="mode === 'placeholder'" class="placeholder-item placeholder-item-3"></div>	CODE
LOW	frontend/src/components/LoadingSpinner.vue	30	validator: (value) => ["spinner", "pulse", "bounce", "placeholder"].includes(value),	CODE
LOW	frontend/src/components/settings/Table.vue	39	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/prompts/Archive.vue	4	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/prompts/MoveCopy.vue	6	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/prompts/Unarchive.vue	4	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/files/FileTree.vue	5	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/files/FileTree.vue	65	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/files/FileList.vue	28	<LoadingSpinner size="small" mode="placeholder" />	CODE
LOW	frontend/src/components/files/ListingHeader.vue	95	<span v-if="quickDownloadEnabled" class="placeholder"></span>	CODE
LOW	backend/internal/database/users/username_test.go	31	for _, username := range []string{"alice", "first.last", "j.r.r", "a-b_c", "user@example.com", "José", "李雷", ".alice",	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	backend/pkg/indexing/indexing_test.go	46	// TODO: Add test cases.	COMMENT

gtsteffaniak/filebrowser

Open-Source Code Quality, Security and Technical Debt Review