HarfBuzz text shaping engine
This report summarizes scanner evidence for harfbuzz/harfbuzz, a C++ project with 6,187 GitHub stars. SynthScan examined 165,531 lines of code across 366 source files, recording 146 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 2.1 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 61 finding(s).
Are imports declared and package/API names verified? 22 finding(s).
Are wrappers, guards, and repeated structures necessary? 80 finding(s).
Which changes need focused human review? 146 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 146 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 14 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 16 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 24 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 30 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 35 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 40 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 45 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 50 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 56 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 62 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 69 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 70 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 72 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 73 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 131 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 136 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 141 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 147 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 187 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 192 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 202 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 208 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 213 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 214 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 216 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 217 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 225 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 231 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 241 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 251 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 256 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 261 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 266 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicSyllabicCategory-Additional.txt | 271 | # ================================================ | COMMENT |
| MEDIUM | src/ms-use/IndicSyllabicCategory-Additional.txt | 160 | # ================================================ | COMMENT |
| MEDIUM | src/ms-use/IndicSyllabicCategory-Additional.txt | 172 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 16 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 17 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 19 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 20 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 37 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 42 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 50 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 61 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 67 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 68 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 70 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 71 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 116 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 121 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 122 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 124 | # ================================================ | COMMENT |
| MEDIUM⚡ | src/ms-use/IndicPositionalCategory-Additional.txt | 125 | # ================================================ | COMMENT |
| MEDIUM | src/ms-use/IndicPositionalCategory-Additional.txt | 94 | # ================================================ | COMMENT |
| MEDIUM | src/ms-use/IndicPositionalCategory-Additional.txt | 99 | # ================================================ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/gen-tag-table.py | 1048 | print (' tags.push(%s); // %s' % (hb_tag_rust (tags[0]), sanitize_comment (ot.names[tags[0]]))) | CODE |
| HIGH | src/gen-tag-table.py | 1089 | print (' tags.push(%s); // %s' % (hb_tag_rust (tags[0]), sanitize_comment (ot.names[tags[0]]))) | CODE |
| HIGH | src/gen-tag-table.py | 1309 | print (" if (!p || p >= limit || limit - p < %i) goto out;" % min_subtag_len) | CODE |
| HIGH | src/gen-tag-table.py | 1337 | print (' for (i = 0; i < %s && i < *count; i++)' % len (tags)) | CODE |
| HIGH | src/gen-tag-table.py | 1389 | print (' for (i = 0; i < %s && i < *count; i++)' % len (tags)) | CODE |
| HIGH | src/gen-vowel-constraints.py | 308 | print (' for (buffer->idx = 0; buffer->idx + 1 < count && buffer->successful;)') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/fuzzing/decode-seed.py | 56 | except UnicodeDecodeError: | CODE |
| HIGH | src/gen-hb-version.py | 23 | except IOError: | CODE |
| HIGH | src/gen-harfbuzz-world.py | 61 | except FileNotFoundError: | CODE |
| HIGH | src/gen-tag-table.py | 501 | except ValueError: | CODE |
| HIGH | src/gen-emoji-table.py | 133 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/api/test-c.c | 41 | #include <hb-coretext.h> | COMMENT |
| LOW | test/api/test-c.c | 61 | #include <hb-graphite2.h> | COMMENT |
| LOW | test/api/test-ot-layout.c | 21 | * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO | COMMENT |
| LOW | util/hb-fc-list.c | 21 | * PERFORMANCE OF THIS SOFTWARE. | COMMENT |
| LOW | util/hb-fc-list.c | 41 | #define HAVE_GETOPT 1 | COMMENT |
| LOW | util/gpu/demo-common.h | 21 | #include <algorithm> | COMMENT |
| LOW | util/gpu/web/config-override.h | 1 | /* Re-enable features that HB_LEAN disables but the GPU demo needs. */ | COMMENT |
| LOW | util/gpu/web/gl-stub.h | 21 | /* Constants */ | COMMENT |
| LOW | util/gpu/web/gl-stub.h | 61 | #define GLFW_REPEAT 2 | COMMENT |
| LOW | util/gpu/web/gl-stub.h | 81 | #define GLFW_KEY_F 70 | COMMENT |
| LOW | src/hb-common.h | 41 | # ifdef __cplusplus | COMMENT |
| LOW | src/hb-common.h | 61 | typedef unsigned __int64 uint64_t; | COMMENT |
| LOW | src/hb-ot.h | 21 | * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO | COMMENT |
| LOW | src/hb-wasm-api.h | 41 | # define HB_WASM_END_DECLS } | COMMENT |
| LOW | src/hb-wasm-api.h | 61 | #define HB_WASM_EXEC_ENV | COMMENT |
| LOW | src/hb.h | 21 | * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO | COMMENT |
| LOW | src/hb.h | 41 | #include "hb-shape.h" | COMMENT |
| LOW | src/gen-ucd-table.py | 41 | # General_Category (gc), Canonical_Combining_Class (ccc), | COMMENT |
| LOW | src/ms-use/IndicSyllabicCategory-Additional.txt | 1 | # Override values For Indic_Syllabic_Category | COMMENT |
| LOW | src/ms-use/IndicPositionalCategory-Additional.txt | 1 | # Override values For Indic_Positional_Category | COMMENT |
| LOW | src/ms-use/IndicPositionalCategory-Additional.txt | 121 | # ================================================ | COMMENT |
| LOW | src/rust/hb.rs | 1 | #![allow(non_camel_case_types)] | COMMENT |
| LOW | src/wasm/rust/harfbuzz-wasm/src/lib.rs | 1 | #![warn(missing_docs)] | COMMENT |
| LOW | src/wasm/rust/harfbuzz-wasm/src/lib.rs | 61 | /// variation. It is equivalent to the `hb_font_t` pointer | COMMENT |
| LOW | src/wasm/rust/harfbuzz-wasm/src/lib.rs | 241 | COMMENT | |
| LOW | src/wasm/rust/harfbuzz-wasm/src/lib.rs | 401 | #[derive(Debug, Clone, Copy)] | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/subset/subset_test_suite.py | 123 | CODE | |
| LOW | test/shape/hb_test_tools.py | 79 | CODE | |
| LOW | test/shape/hb_test_tools.py | 135 | CODE | |
| LOW | test/shape/hb_test_tools.py | 225 | CODE | |
| LOW | test/shape/hb_test_tools.py | 347 | CODE | |
| LOW | test/shape/hb_test_tools.py | 444 | CODE | |
| LOW | test/fuzzing/decode-seed.py | 115 | CODE | |
| LOW | test/fuzzing/record-subset-test.py | 173 | CODE | |
| LOW | src/justify.py | 164 | CODE | |
| LOW | src/gen-arabic-table.py | 150 | CODE | |
| LOW | src/gen-tag-table.py | 1419 | CODE | |
| LOW | src/gen-tag-table.py | 414 | CODE | |
| LOW | src/gen-tag-table.py | 478 | CODE | |
| LOW | src/gen-tag-table.py | 527 | CODE | |
| LOW | src/gen-tag-table.py | 625 | CODE | |
| LOW | src/gen-vowel-constraints.py | 92 | CODE | |
| LOW | src/gen-vowel-constraints.py | 134 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/subset/run-tests.py | 191 | def open_subset_batch_process(): | CODE |
| LOW | test/shape/hb_test_tools.py | 293 | def filter_printer_function_no_newline (filter_callback): | CODE |
| LOW | test/shape/hb_test_tools.py | 347 | def filter_multiple_strings_or_stdin (callback, mnemonic, \ | CODE |
| LOW | test/fuzzing/hb_fuzzing_tools.py | 102 | def emit_pin_all_axes_to_default(ops: bytearray) -> None: | CODE |
| LOW | test/fuzzing/record-subset-test.py | 163 | def handle_file_backed_set_option(ops: bytearray, name: str, path: str) -> None: | STRING |
| LOW | test/vector/run-tests.py | 36 | def open_vector_batch_process(): | CODE |
| LOW | test/vector/run-tests.py | 52 | def close_vector_batch_process(vector_process): | CODE |
| LOW | src/gen-tag-table.py | 527 | def inherit_from_macrolanguages (self): | CODE |
| LOW | src/gen-tag-table.py | 708 | def remove_extra_macrolanguages (self): | CODE |
| LOW | src/gen-tag-table.py | 957 | def language_name_intersection_rust (a, b): | CODE |
| LOW | src/gen-tag-table.py | 960 | def get_matching_language_name_rust (intersection, candidates): | CODE |
| LOW | src/gen-tag-table.py | 1017 | def print_subtag_matches_rust (subtag, new_line): | CODE |
| LOW | src/gen-tag-table.py | 1153 | def language_name_intersection (a, b): | CODE |
| LOW | src/gen-tag-table.py | 1167 | def get_matching_language_name (intersection, candidates): | CODE |
| LOW | src/gen-tag-table.py | 1419 | def verify_disambiguation_dict (): | CODE |
| LOW | src/hb-unicode.h | 354 | typedef hb_unicode_combining_class_t (*hb_unicode_combining_class_func_t) (hb_unicode_funcs_t *ufuncs, | CODE |
| LOW | src/hb-unicode.h | 372 | typedef hb_unicode_general_category_t (*hb_unicode_general_category_func_t) (hb_unicode_funcs_t *ufuncs, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/subset/run-repack-tests.py | 6 | CODE | |
| LOW | test/subset/run-repack-tests.py | 8 | CODE | |
| LOW | test/subset/run-repack-tests.py | 13 | CODE | |
| LOW | test/subset/run-tests.py | 8 | CODE | |
| LOW | test/shape/hb_test_tools.py | 4 | CODE | |
| LOW | test/shape/data/text-rendering-tests/update.py | 3 | CODE | |
| LOW | test/shape/data/text-rendering-tests/update.py | 3 | CODE | |
| LOW | test/fuzzing/decode-seed.py | 8 | CODE | |
| LOW | util/gpu/gen-default-texts.py | 5 | CODE | |
| LOW | src/gen-arabic-joining-list.py | 10 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | util/gpu/default-text.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuada. Mauris sit amet me | CODE |
| LOW | util/gpu/default-text.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuada. Mauris sit amet me | CODE |
| LOW | util/gpu/web/dom.html | 26 | scene.textContent = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuad | CODE |
| LOW | util/gpu/web/dom.html | 26 | scene.textContent = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuad | CODE |
| LOW | perf/texts/en-paragraph.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuada. Mauris sit amet me | CODE |
| LOW | perf/texts/en-paragraph.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam tincidunt nibh quis semper malesuada. Mauris sit amet me | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/subset/run-repack-tests.py | 80 | except Exception as e: | CODE |
| LOW | test/subset/run-tests.py | 130 | except Exception as e: | CODE |
| LOW | test/subset/run-tests.py | 139 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/usermanual-clusters.xml | 262 | As mentioned earlier, client programs using HarfBuzz often | CODE |