1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

36.5K

Stars

Language

1.2M

Lines of Code

8.5K

Files

1.1K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 814 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.7/100 · LOW

Are imports declared and package/API names verified? 111 finding(s).

Agent Over-Engineering Ratio 2.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 190 finding(s).

PR Review Velocity Impact 7.2/100 · LOW

Which changes need focused human review? 1092 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 21HIGH 1MEDIUM 222LOW 848

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1092 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block602 hits · 581 pts

Severity	File	Line	Snippet	Context
LOW	ui/.copywrite.hcl	1	# (OPTIONAL) Overrides the copywrite config schema version	COMMENT
LOW	ui/app/utils/openapi-helpers.ts	361	return { attrs: attrsArray, newFields };	COMMENT
LOW	ui/app/utils/openapi-helpers.ts	381	// return !allFields.includes(field) && !excludedFields.includes(field);	COMMENT
LOW	ui/app/utils/metrics-helpers.ts	61	for (const detail of metric.metric_data?.metric_details ?? []) {	COMMENT
LOW	…ls/terraform-mappings/sys-policies-acl-name-mapping.ts	1	/**	COMMENT
LOW	ui/app/macros/lazy-capabilities.js	1	/**	COMMENT
LOW	ui/app/styles/theme/dark-mode/_overrides.scss	341	// Selected radio dot	COMMENT
LOW	ui/app/styles/theme/dark-mode/_overrides.scss	521	// popup-menu.scss sets `background-color: hsl(0,0%,100%)` on	COMMENT
LOW	ui/app/styles/theme/dark-mode/_overrides.scss	601	--token-badge-surface-color-neutral-filled: var(--token-color-surface-strong);	COMMENT
LOW	ui/app/services/permissions.js	181	const currentNs = this.namespace.path;	COMMENT
LOW	ui/app/services/permissions.js	301	}	COMMENT
LOW	ui/app/services/permissions.js	341		COMMENT
LOW	ui/app/services/permissions.js	381	// Resolution rule across matchers:	COMMENT
LOW	ui/app/services/permissions.js	401	// Now check capability satisfaction across the best exact/glob	COMMENT
LOW	ui/app/services/permissions.js	461	return ns ? `${sanitizePath(ns)}/${sanitizeStart(pathName)}` : pathName;	COMMENT
LOW	ui/tests/theme-helper.js	81	// full app boots and ThemeService._resolveInitialTheme() runs before the	COMMENT
LOW	…omponents/kubernetes/page/role/create-and-edit-test.js	181	await click('[data-test-radio-card="full"]');	COMMENT
LOW	ui/tests/acceptance/access/leases-test.js	21	import { overrideResponse } from 'vault/tests/helpers/stubs';	COMMENT
LOW	ui/tests/helpers/index.js	21	//	COMMENT
LOW	ui/tests/helpers/secret-engine/secret-engine-helpers.js	361	// {	COMMENT
LOW	ui/lib/core/addon/types/list-view-config.ts	21	icon?: string;	COMMENT
LOW	ui/lib/core/addon/utils/all-engines-metadata.ts	441	},	COMMENT
LOW	ui/lib/core/addon/utils/all-engines-metadata.ts	461	// {	COMMENT
LOW	ui/lib/kubernetes/addon/utils/generated-role-rules.js	1	/**	COMMENT
LOW	ui/lib/pki/addon/components/pki-issuer-cross-sign.js	181	// before and after. Recovery would be on the operator in this case;	COMMENT
LOW	serviceregistration/service_registration.go	41	// complete. The redirectAddr is an optional parameter for implementations	COMMENT
LOW	serviceregistration/service_registration.go	61	//	COMMENT
LOW	serviceregistration/service_registration.go	81	// If errors are returned, Vault only logs a warning, so it is	COMMENT
LOW	serviceregistration/service_registration.go	101	// configuration has been reloaded.	COMMENT
LOW	…viceregistration/consul/consul_service_registration.go	421	defer checkTimer.Stop()	COMMENT
LOW	serviceregistration/kubernetes/testing/testserver.go	61		COMMENT
LOW	serviceregistration/kubernetes/client/config.go	21	// The client itself does nothing directly with these variables, it's	COMMENT
LOW	serviceregistration/kubernetes/client/config.go	81	// The CACertPool is promoted to the top level from being originally on the TLSClientConfig	COMMENT
LOW	…eregistration/kubernetes/client/cmd/kubeclient/main.go	1	// Copyright IBM Corp. 2016, 2025	COMMENT
LOW	enos/enos.vars.hcl	1	// Copyright IBM Corp. 2016, 2025	COMMENT
LOW	enos/enos.vars.hcl	21	// aws_ssh_private_key_path = "./support/private_key.pem"	COMMENT
LOW	enos/enos.vars.hcl	41	// distro_version_rhel = "10.1" // or "8.10" or "9.7"	COMMENT
LOW	enos/enos.vars.hcl	61	// ui_run_tests sets whether to run the UI tests or not for the ui scenario. If set to false a	COMMENT
LOW	enos/enos.vars.hcl	81	// will be enabled. The netcat program is run in listening mode to provide an endpoint	COMMENT
LOW	enos/enos.vars.hcl	101		COMMENT
LOW	enos/k8s/enos-scenario-k8s.hcl	1	# Copyright IBM Corp. 2016, 2025	COMMENT
LOW	enos/k8s/enos-variables-k8s.hcl	1	# Copyright IBM Corp. 2016, 2025	COMMENT
LOW	enos/modules/start_vault/main.tf	161	# in the KMS it should be able to start. That's normally done via roles associated to the target	COMMENT
LOW	enos/modules/k8s_vault_verify_client_smoke/variables.tf	21	type = string	COMMENT
LOW	…s_vault_verify_client_smoke/scripts/smoke-patch-pod.sh	1	#!/bin/sh	COMMENT
LOW	…es/k8s_vault_verify_client_smoke/scripts/setup-rbac.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…ault_verify_client_smoke/scripts/smoke-invalid-call.sh	1	#!/bin/sh	COMMENT
LOW	…t_verify_client_smoke/scripts/smoke-patch-pod-multi.sh	1	#!/bin/sh	COMMENT
LOW	…k8s_vault_verify_client_smoke/scripts/smoke-get-pod.sh	1	#!/bin/sh	COMMENT
LOW	enos/modules/build_local/main.tf	1	# Copyright IBM Corp. 2016, 2025	COMMENT
LOW	enos/modules/build_local/scripts/build.sh	1	#!/usr/bin/env bash	COMMENT
LOW	enos/modules/target_ec2_spot_fleet/main.tf	381	# max bid price. As we're using spot fleets to save on instance cost, we never	COMMENT
LOW	…lt_verify_client_sidecar/scripts/query-client-proxy.sh	1	#!/bin/sh	COMMENT
LOW	enos/modules/target_ec2_fleet/main.tf	281	# using a spot fleet: our min and max instance requirements, our max bid	COMMENT
LOW	…s/modules/verify_secrets_engines/modules/create/ssh.tf	1	# Copyright IBM Corp. 2016, 2025	COMMENT
LOW	tools/tools.go	1	// Copyright IBM Corp. 2016, 2025	COMMENT
LOW	…s/pipeline/internal/pkg/monday/duplicate_board_test.go	21	// and variables sent on the wire (including the DuplicateBoardType enum type	COMMENT
LOW	…ls/pipeline/internal/pkg/monday/create_subitem_test.go	21	// and variables sent on the wire (ID!, String! and JSON! variable types, with	COMMENT
LOW	tools/pipeline/internal/pkg/monday/update_item_test.go	21	// variables sent on the wire, that the response is mapped into UpdateItemRes	COMMENT
LOW	tools/pipeline/internal/pkg/monday/create_board_test.go	21	// variables sent on the wire (including the BoardKind enum type and the	COMMENT
542 more matches not shown…

Decorative Section Separators167 hits · 542 pts

Severity	File	Line	Snippet	Context
MEDIUM	ui/app/styles/components/radio-card.scss	128	// ── Selected state ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/_token-mappings.scss	7	// ── Foreground ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/_token-mappings.scss	31	// ── Surface ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/_token-mappings.scss	45	// ── Border ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/_token-mappings.scss	55	// ── Page ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/_token-mappings.scss	59	// ── Tooltip ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/_token-mappings.scss	63	// ── Form controls ───────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_variables.scss	7	// ── Primary token colors ────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/dark-mode/_overrides.scss	675	// ── autocomplete-input: text inside the now-dark surface ─────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/dark-mode/_overrides.scss	680	// ── b64-toggle button ─────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/dark-mode/_overrides.scss	690	// ── search-select-list-key <small> ────────────────────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/dark-mode/_overrides.scss	700	// ── jsondiffpatch: property names and pre content ─────────────────────────	COMMENT
MEDIUM⚡	ui/app/styles/theme/dark-mode/_overrides.scss	710	// ── Open API Explorer supplemental overrides ─────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	144	// ── Info / title block ──────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	188	// ── Operation block rows ────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	228	// ── Section tag headings ─────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	286	// ── Unselected card ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	316	// ── Selected card ────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	398	// ── HDS form label: hardcoded foreground token ────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	549	// ── Carbon Charts: all chart holders ─────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	562	// ── Carbon Charts: legend text ────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	626	// ── HDS link-standalone / link-inline on dark alert surfaces ─────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	639	// ── Links on colored surface rows (about-this-engine) ──────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	651	// ── control-group: code, pre, p, label, status divs, and plain text ──────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	722	// ── Expand/collapse arrow ─────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	738	// ── Opblock section header (Parameters / Request body rows) ───────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	751	// ── Parameter name and type text ─────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	768	// ── Parameter / body text inputs ──────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	787	// ── Select / dropdown ─────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	797	// ── Required field marker ("* required") ──────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	809	// ── Tab-item heading ("Example Value" / "Schema") ────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	823	// ── Response status code ("200", "204") ───────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	829	// ── "No links" text ───────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	840	// ── renderedMarkdown (response/parameter description prose) ──────────────	COMMENT
MEDIUM	ui/app/styles/theme/dark-mode/_overrides.scss	876	// ── Dashboard header gradient: opacity boost for dark backgrounds ─────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	51	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	53	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	71	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	73	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	361	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	363	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	759	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/unit/services/permissions-test.js	761	// ───────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	48	// ── Test 1 — page title and breadcrumbs ─────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	62	// ── Test 2 — description ─────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	77	// ── Test 3 — headerActions block ─────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	96	// ── Test 4 — table renders when data exists ──────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	114	// ── Test 5 — no-data empty state ─────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	132	// ── Test 6 — filtered empty state ────────────────────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	176	// ── Test 7 — toolbar renders when toolbarActions block provided ───────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	193	// ── Test 8 — popupMenu block renders once per row ─────────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	212	// ── Test 9 — customTableItem block renders for custom columns ─────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	237	// ── Test 10 — confirmModal block renders when provided ────────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	315	// ── Test 11b — filter on page 1 also does NOT trigger a router transition ──────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	338	// ── Test 12 — filteredData filters by config.filter.filterKey ────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	360	// ── Test 13 — confirmDelete calls deleteAction, shows flash, refreshes ────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	413	// ── Test 14 — row actions honour the per-row capability key ─────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	458	// ── Test 15 — sort sorts the full dataset before pagination ──────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	502	// ── Test 16 — sort state persists across page transitions ────────────────────	COMMENT
MEDIUM	ui/tests/integration/components/page/list-view-test.js	547	// ── Test 16 — natural / numeric alphanumeric sorting ──────────────────────────	COMMENT
107 more matches not shown…

Hallucination Indicators21 hits · 300 pts

Severity	File	Line	Snippet	Context
CRITICAL	ui/tests/acceptance/raft-storage-test.js	32	this.config.data.config.servers.pop();	CODE
CRITICAL	ui/tests/acceptance/raft-storage-test.js	59	this.config.data.config.servers = this.config.data.config.servers.filter(	CODE
CRITICAL	vault/consumption_billing_util_test.go	1470	actualTotalDuration := core.consumptionBilling.SecretEngineCounts.Oidc.MonthlyUnits.Load()	CODE
CRITICAL⚡	vault/consumption_billing.go	307	c.consumptionBilling.SecretEngineCounts.Transit.MonthlyCount.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	308	c.consumptionBilling.SecretEngineCounts.Transform.MonthlyCount.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	309	c.consumptionBilling.SecretEngineCounts.GcpKms.MonthlyCount.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	310	c.consumptionBilling.SecretEngineCounts.Oidc.MonthlyUnits.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	311	c.consumptionBilling.SecretEngineCounts.Spiffe.MonthlyUnits.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	312	c.consumptionBilling.SecretEngineCounts.ExternalCa.MonthlyUnits.Store(0)	CODE
CRITICAL⚡	vault/consumption_billing.go	315	c.consumptionBilling.SecretEngineCounts.Transit.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	317	c.consumptionBilling.SecretEngineCounts.Transit.MountAttributionLock.Unlock()	CODE
CRITICAL⚡	vault/consumption_billing.go	319	c.consumptionBilling.SecretEngineCounts.Transform.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	321	c.consumptionBilling.SecretEngineCounts.Transform.MountAttributionLock.Unlock()	CODE
CRITICAL⚡	vault/consumption_billing.go	323	c.consumptionBilling.SecretEngineCounts.Oidc.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	325	c.consumptionBilling.SecretEngineCounts.Oidc.MountAttributionLock.Unlock()	CODE
CRITICAL⚡	vault/consumption_billing.go	327	c.consumptionBilling.SecretEngineCounts.GcpKms.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	329	c.consumptionBilling.SecretEngineCounts.GcpKms.MountAttributionLock.Unlock()	CODE
CRITICAL⚡	vault/consumption_billing.go	331	c.consumptionBilling.SecretEngineCounts.ExternalCa.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	333	c.consumptionBilling.SecretEngineCounts.ExternalCa.MountAttributionLock.Unlock()	CODE
CRITICAL⚡	vault/consumption_billing.go	335	c.consumptionBilling.SecretEngineCounts.Spiffe.MountAttributionLock.Lock()	CODE
CRITICAL⚡	vault/consumption_billing.go	337	c.consumptionBilling.SecretEngineCounts.Spiffe.MountAttributionLock.Unlock()	CODE

Structural Annotation Overuse59 hits · 115 pts

Severity	File	Line	Snippet	Context
LOW⚡	…ponents/upgrade-path-analyzer/upgrade-path-analyzer.ts	146	// Step 1: drop anything <= current version	COMMENT
LOW⚡	…ponents/upgrade-path-analyzer/upgrade-path-analyzer.ts	149	// Step 2: keep only the highest patch per MAJOR.MINOR group	COMMENT
LOW⚡	ui/app/components/wizard/namespaces/namespace-wizard.ts	80	case 0: // Step 1 - requires security policy choice	CODE
LOW⚡	ui/app/components/wizard/namespaces/namespace-wizard.ts	82	case 1: // Step 2 - requires valid namespace inputs	CODE
LOW⚡	ui/app/components/wizard/namespaces/namespace-wizard.ts	84	case 2: // Step 3 - no validation is needed	CODE
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	55	// Step 1: Choose security policy	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	61	// Step 2: Add namespace data	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	67	// Step 3: Choose implementation method	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	76	// Step 1: Choose flexible policy	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	323	// Step 1: visit the show page for rgp-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	328	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	331	// Step 3: click "Edit policy" on rgp-beta.	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	324	// Step 1: visit the show page for egp-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	329	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	332	// Step 3: click "Edit policy" on egp-beta.	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	361	// Step 1: visit the show page for policy-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	366	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	369	// Step 3: click "Edit policy" on policy-beta.	COMMENT
LOW	…crets_engines/scripts/ldap-library-checkin-specific.sh	28	# Step 1: Check out an account to prepare for check-in test	COMMENT
LOW	…crets_engines/scripts/ldap-library-checkin-specific.sh	41	# Step 2: Check in the specific account by name	COMMENT
LOW	…_secrets_engines/scripts/ldap-library-force-checkin.sh	29	# Step 1: Check out an account to prepare for force check-in test	COMMENT
LOW	…_secrets_engines/scripts/ldap-library-force-checkin.sh	42	# Step 2: Admin force check-in via /manage/ endpoint	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	46	# Step 1: Checkout an account to get initial password	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	61	# Step 2: Check-in the account (this should trigger password rotation)	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	96	# Step 3: Checkout again to get new password	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	111	# Step 4: Verify password rotation	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	124	# Step 5: Check in the second account so it's available for subsequent tests	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	193	# Step 1: Make sure repository is present.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	237	# Step 2: Build generated things.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	268	# Step 3: Add to go path.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	302	# Step 4: Build the binaries.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	319	# Step 5: Explain CGO flags.	COMMENT
LOW⚡	internal/releaseinfo/release_info.go	95	// Step 1: list the directory	COMMENT
LOW⚡	internal/releaseinfo/release_info.go	101	// Step 2: fetch and parse content from each file	COMMENT
LOW⚡	sdk/logical/system_view.go	114	// NOTE: This method is intended for use only by HashiCorp Vault Enterprise plugins.	COMMENT
LOW⚡	sdk/logical/system_view.go	119	// NOTE: This method is intended for use only by HashiCorp Vault Enterprise plugins	COMMENT
LOW⚡	sdk/logical/system_view.go	124	// NOTE: This method is intended for use only by HashiCorp Vault Enterprise plugins.	COMMENT
LOW⚡	sdk/logical/token.go	188	// Step 1: Copy entry policies to a new struct	COMMENT
LOW⚡	sdk/logical/token.go	192	// Step 2: Sort and join copied policies	COMMENT
LOW⚡	sdk/logical/token.go	199	// Step 3: Add namespace ID	COMMENT
LOW⚡	sdk/logical/token.go	206	// Step 4: Remove the first character in the string, as it's an unnecessary delimiter	COMMENT
LOW⚡	sdk/logical/token.go	209	// Step 5: Hash the sum	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	105	// Step 1: Generate a self-signed root CA with the current parameter set.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	115	// Step 2: Generate an intermediate CSR with the same parameter set.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	125	// Step 3: Sign the CSR with the root CA.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	146	// Step 4: Import the signed intermediate (with root chain) via set-signed.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	177	// Step 5: Confirm idempotency — re-importing the same certificate must	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	574	// Step 1: Generate the root CA.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	579	// Step 2: Generate the intermediate CSR.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	585	// Step 3: Sign the intermediate CSR with the root.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	603	// Step 4: Import the signed intermediate (plus the root chain) via set-signed.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	364	// Step 1: Generate an ML-DSA-44 root CA.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	387	// Step 2: Generate an ML-DSA-65 intermediate CSR on the intermediate backend.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	402	// Step 3: Sign the intermediate CSR with the ML-DSA-44 root.	COMMENT
LOW⚡	builtin/logical/pki/path_sign_intermediate_test.go	427	// Step 4: Import the signed intermediate (plus root chain) into the intermediate backend.	COMMENT
LOW⚡	builtin/logical/pki/path_sign_intermediate_test.go	433	// Step 5: Create a role on the intermediate backend and issue a leaf certificate.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	463	// Step 6: Validate the certificate chain: leaf → intermediate → root.	COMMENT
LOW⚡	…ts/blackbox/isolated/verify/ibm_license_update_test.go	49	// Step 1: Verify license get (replicates license-get.sh)	COMMENT
LOW⚡	…ts/blackbox/isolated/verify/ibm_license_update_test.go	55	// Step 2: Verify license inspect and extract customer ID (replicates license-inspect.sh)	COMMENT

Verbosity Indicators55 hits · 106 pts

Severity	File	Line	Snippet	Context
LOW⚡	…ponents/upgrade-path-analyzer/upgrade-path-analyzer.ts	146	// Step 1: drop anything <= current version	COMMENT
LOW⚡	…ponents/upgrade-path-analyzer/upgrade-path-analyzer.ts	149	// Step 2: keep only the highest patch per MAJOR.MINOR group	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	55	// Step 1: Choose security policy	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	61	// Step 2: Add namespace data	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	67	// Step 3: Choose implementation method	COMMENT
LOW⚡	…/integration/components/page/namespaces-wizard-test.js	76	// Step 1: Choose flexible policy	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	323	// Step 1: visit the show page for rgp-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	328	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/rgp/index-test.js	331	// Step 3: click "Edit policy" on rgp-beta.	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	324	// Step 1: visit the show page for egp-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	329	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/egp/index-test.js	332	// Step 3: click "Edit policy" on egp-beta.	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	361	// Step 1: visit the show page for policy-alpha so show.currentModel is set on	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	366	// Step 2: navigate to the list (show deactivates, but currentModel persists).	COMMENT
LOW⚡	ui/tests/acceptance/policies/acl/index-test.js	369	// Step 3: click "Edit policy" on policy-beta.	COMMENT
LOW	…crets_engines/scripts/ldap-library-checkin-specific.sh	28	# Step 1: Check out an account to prepare for check-in test	COMMENT
LOW	…crets_engines/scripts/ldap-library-checkin-specific.sh	41	# Step 2: Check in the specific account by name	COMMENT
LOW	…_secrets_engines/scripts/ldap-library-force-checkin.sh	29	# Step 1: Check out an account to prepare for force check-in test	COMMENT
LOW	…_secrets_engines/scripts/ldap-library-force-checkin.sh	42	# Step 2: Admin force check-in via /manage/ endpoint	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	46	# Step 1: Checkout an account to get initial password	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	61	# Step 2: Check-in the account (this should trigger password rotation)	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	96	# Step 3: Checkout again to get new password	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	111	# Step 4: Verify password rotation	COMMENT
LOW	…rets_engines/scripts/ldap-library-password-rotation.sh	124	# Step 5: Check in the second account so it's available for subsequent tests	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	193	# Step 1: Make sure repository is present.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	237	# Step 2: Build generated things.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	268	# Step 3: Add to go path.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	302	# Step 4: Build the binaries.	COMMENT
LOW	physical/foundationdb/fdb-go-install.sh	319	# Step 5: Explain CGO flags.	COMMENT
LOW⚡	internal/releaseinfo/release_info.go	95	// Step 1: list the directory	COMMENT
LOW⚡	internal/releaseinfo/release_info.go	101	// Step 2: fetch and parse content from each file	COMMENT
LOW⚡	sdk/logical/token.go	188	// Step 1: Copy entry policies to a new struct	COMMENT
LOW⚡	sdk/logical/token.go	192	// Step 2: Sort and join copied policies	COMMENT
LOW⚡	sdk/logical/token.go	199	// Step 3: Add namespace ID	COMMENT
LOW⚡	sdk/logical/token.go	206	// Step 4: Remove the first character in the string, as it's an unnecessary delimiter	COMMENT
LOW⚡	sdk/logical/token.go	209	// Step 5: Hash the sum	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	105	// Step 1: Generate a self-signed root CA with the current parameter set.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	115	// Step 2: Generate an intermediate CSR with the same parameter set.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	125	// Step 3: Sign the CSR with the root CA.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	146	// Step 4: Import the signed intermediate (with root chain) via set-signed.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	177	// Step 5: Confirm idempotency — re-importing the same certificate must	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	574	// Step 1: Generate the root CA.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	579	// Step 2: Generate the intermediate CSR.	COMMENT
LOW⚡	builtin/logical/pki/path_intermediate_test.go	585	// Step 3: Sign the intermediate CSR with the root.	COMMENT
LOW	builtin/logical/pki/path_intermediate_test.go	603	// Step 4: Import the signed intermediate (plus the root chain) via set-signed.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	364	// Step 1: Generate an ML-DSA-44 root CA.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	387	// Step 2: Generate an ML-DSA-65 intermediate CSR on the intermediate backend.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	402	// Step 3: Sign the intermediate CSR with the ML-DSA-44 root.	COMMENT
LOW⚡	builtin/logical/pki/path_sign_intermediate_test.go	427	// Step 4: Import the signed intermediate (plus root chain) into the intermediate backend.	COMMENT
LOW⚡	builtin/logical/pki/path_sign_intermediate_test.go	433	// Step 5: Create a role on the intermediate backend and issue a leaf certificate.	COMMENT
LOW	builtin/logical/pki/path_sign_intermediate_test.go	463	// Step 6: Validate the certificate chain: leaf → intermediate → root.	COMMENT
LOW	vault/core_metrics.go	434	// Therefore, we need to check if c.mounts is nil. If we do not, this will panic when	COMMENT
LOW	vault/core_metrics.go	495	// Therefore, we need to check if c.mounts is nil. If we do not, this will panic when	COMMENT
LOW⚡	…ts/blackbox/isolated/verify/ibm_license_update_test.go	49	// Step 1: Verify license get (replicates license-get.sh)	COMMENT
LOW⚡	…ts/blackbox/isolated/verify/ibm_license_update_test.go	55	// Step 2: Verify license inspect and extract customer ID (replicates license-inspect.sh)	COMMENT

Fake / Example Data90 hits · 98 pts

Severity	File	Line	Snippet	Context
LOW	ui/tests/unit/forms/v2/form-validators-test.js	58	assert.ok(validators.email('user@example.com'), 'simple email is valid');	CODE
LOW	…s/integration/components/filter-input-explicit-test.js	42	.hasAttribute('placeholder', 'Filter roles', 'Placeholder passed to input element');	CODE
LOW	…/tests/integration/components/kv-object-editor-test.js	85	assert.dom('input').hasAttribute('placeholder', 'foo', 'Placeholder applied to key input');	CODE
LOW	…/tests/integration/components/kv-object-editor-test.js	86	assert.dom('textarea').hasAttribute('placeholder', 'bar', 'Placeholder applied to value input');	CODE
LOW	…ests/integration/components/autocomplete-input-test.js	55	assert.dom('input').hasAttribute('placeholder', this.placeholder, 'Input placeholder renders');	CODE
LOW	ui/tests/integration/components/filter-input-test.js	25	.hasAttribute('placeholder', 'Filter roles', 'Placeholder passed to input element');	CODE
LOW	ui/tests/integration/components/form-field-test.js	1041	.hasAttribute('placeholder', 'key', 'renders the default key placeholder');	CODE
LOW	ui/tests/integration/components/form-field-test.js	1045	.hasAttribute('placeholder', 'value', 'renders the default value placeholder');	CODE
LOW	ui/tests/integration/components/form-field-test.js	1261	'placeholder',	CODE
LOW	ui/tests/integration/components/form-field-test.js	1315	.hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options');	CODE
LOW	ui/tests/integration/components/form-field-test.js	1431	.hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options');	CODE
LOW	ui/tests/integration/components/form-field-test.js	1642	.hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options')	CODE
LOW	…tests/integration/components/object-list-input-test.js	47	.hasAttribute('placeholder', firstKey.placeholder, 'it renders placeholder text');	CODE
LOW	…/tests/integration/components/form/v2/override-test.js	203	.hasAttribute('placeholder', 'Updated placeholder text', 'renders updated placeholder text');	CODE
LOW	…tests/integration/components/kv/kv-list-filter-test.js	69	.hasAttribute('placeholder', 'Search secret path', 'Placeholder applied to input.');	CODE
LOW	…tests/integration/components/kv/kv-list-filter-test.js	89	.hasAttribute('placeholder', 'Search secret path', 'Placeholder applied to input.');	CODE
LOW	…tests/integration/components/kv/kv-list-filter-test.js	110	.hasAttribute('placeholder', 'Search secret path', 'Placeholder applied to input.');	CODE
LOW	…integration/components/kv/kv-patch/editor/form-test.js	62	assert.dom(FORM.keyInput('new')).hasAttribute('placeholder', 'key');	CODE
LOW	…n/components/ldap/page/library/create-and-edit-test.js	124	const service_account_names = ['foo@bar.com', 'bar@baz.com'];	CODE
LOW	…ests/integration/components/oidc/provider-form-test.js	69	.hasAttribute('placeholder', 'e.g. https://example.com:8200', 'issuer placeholder text is correct');	CODE
LOW	…gration/components/secret-engine/configure-wif-test.js	279	'placeholder',	CODE
LOW	…gration/components/secret-engine/configure-wif-test.js	336	'placeholder',	CODE
LOW	…gration/components/secret-engine/configure-wif-test.js	480	.hasAttribute('placeholder', 'https://vault-test.com', 'shows issuer placeholder');	CODE
LOW	…onents/config-ui/messages/page/create-and-edit-test.js	119	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	…onents/config-ui/messages/page/create-and-edit-test.js	119	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW⚡	…onents/config-ui/messages/page/create-and-edit-test.js	187	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW⚡	…onents/config-ui/messages/page/create-and-edit-test.js	187	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW⚡	…onents/config-ui/messages/page/create-and-edit-test.js	197	.hasText('Lorem ipsum dolor sit amet, consectetur adipiscing elit.');	CODE
LOW⚡	…onents/config-ui/messages/page/create-and-edit-test.js	197	.hasText('Lorem ipsum dolor sit amet, consectetur adipiscing elit.');	CODE
LOW	…onents/config-ui/messages/page/create-and-edit-test.js	252	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	…onents/config-ui/messages/page/create-and-edit-test.js	252	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	…ion/components/dashboard/widgets/quick-actions-test.js	211	.hasAttribute('placeholder', 'Enter role name', 'Placeholder renders in param input');	CODE
LOW	…ration/components/code-generator/policy/stanza-test.js	39	.hasAttribute('placeholder', 'Enter a resource path')	CODE
LOW	…ion/components/pki/external-pki/config-details-test.js	41	email_contacts: ['admin@example.com', 'security@example.com'],	CODE
LOW	…components/pki/external-pki/page/recent-orders-test.js	46	.hasAttribute('placeholder', 'No orders to filter')	CODE
LOW	…components/pki/external-pki/page/recent-orders-test.js	64	assert.dom(GENERAL.inputSearch('orderId')).exists().hasAttribute('placeholder', '01936d8e-7c3...');	CODE
LOW	…components/pki/external-pki/page/recent-orders-test.js	202	.hasAttribute('placeholder', 'Filter by order ID')	CODE
LOW	…components/pki/external-pki/page/acme-accounts-test.js	50	email_contacts: ['admin@example.com'],	CODE
LOW	…components/pki/external-pki/page/acme-accounts-test.js	73	email_contacts: ['admin@example.com'],	CODE
LOW	ui/tests/acceptance/enterprise-namespaces-test.js	142	assert.dom(GENERAL.inputByAttr('namespace')).hasAttribute('placeholder', '/ (root)');	CODE
LOW	ui/tests/acceptance/managed-namespace-test.js	30	assert.dom('input[name="namespace"]').hasAttribute('placeholder', '/ (default)');	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	54	message = encodeString('Lorem ipsum dolor sit amet, consectetur adipiscing elit.'),	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	54	message = encodeString('Lorem ipsum dolor sit amet, consectetur adipiscing elit.'),	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	101	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	101	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	275	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	275	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	296	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	296	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	375	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	375	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	396	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/config-ui/messages/messages-test.js	396	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	…ptance/config-ui/messages/messages-unauth-auth-test.js	138	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	…ptance/config-ui/messages/messages-unauth-auth-test.js	138	'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'	CODE
LOW	ui/tests/acceptance/pki/external/acme-accounts-test.js	161	email_contacts: ['admin@example.com'],	CODE
LOW⚡	ui/mirage/handlers/custom-messages.js	142	'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus bland	CODE
LOW⚡	ui/mirage/handlers/custom-messages.js	142	'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus bland	CODE
LOW⚡	ui/mirage/handlers/custom-messages.js	152	'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus bland	CODE
LOW⚡	ui/mirage/handlers/custom-messages.js	152	'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus bland	CODE
30 more matches not shown…

AI Slop Vocabulary25 hits · 75 pts

Severity	File	Line	Snippet	Context
MEDIUM	ui/tests/unit/utils/external-plugin-helpers-test.js	207	// This verifies that the reverse lookup algorithm is robust	COMMENT
MEDIUM	ui/tests/acceptance/policy/index-test.js	133	// List of policies can get long quickly -- filter for the policy to make the test more robust	COMMENT
MEDIUM	enos/enos-dev-scenario-single-cluster.hcl	15	// The matrix is where we define all the baseline combinations that enos can utilize to customize	COMMENT
MEDIUM	enos/enos-dev-scenario-pr-replication.hcl	16	// The matrix is where we define all the baseline combinations that enos can utilize to customize	COMMENT
MEDIUM	…pipeline/internal/cmd/releases_list_active_versions.go	88	# Write to GitHub Actions output (comprehensive structure with matrix arrays)	COMMENT
MEDIUM	tools/pipeline/internal/pkg/github/doc.go	4	// Package github contains our implementation of pipeline sub-command requests that utilize Github	COMMENT
MEDIUM	…pipeline/internal/pkg/github/find_workflow_artifact.go	162	// for to utilize the tool, and to find the latest artifact even if other	COMMENT
MEDIUM	tools/pipeline/internal/pkg/git/doc.go	4	// Package git implements various pipeline requests that utilize a local git client	COMMENT
MEDIUM	http/handler.go	150	// tokens provides a robust safeguard against malicious inputs without interfering	COMMENT
MEDIUM	sdk/helper/jsonutil/json_test.go	458	// A robust parser should reject any invalid escape sequence, not just unicode.	COMMENT
MEDIUM	sdk/helper/testcluster/util.go	211	// Be robust to multiple nodes thinking they are active. This is possible in	COMMENT
MEDIUM	sdk/helper/testcluster/util.go	216	// etc. so be robust against it. The best solution would be to have some sort	COMMENT
MEDIUM	scripts/copywrite-exceptions.sh	5	# then runs the copywrite bot to utilize local subdir config	COMMENT
MEDIUM	.github/actions/checkout/action.yml	37	# creates. Essentially, this SHA is the product of merging our PR into the merge target	COMMENT
MEDIUM	command/server/agent_test.go	1417	// Definitely not thread-safe, do not use t.Parallel with this.	COMMENT
MEDIUM	builtin/logical/database/path_roles.go	992	// user specified by Username. The credentials will leverage the existing	COMMENT
MEDIUM	builtin/logical/transit/path_datakey_test.go	15	// TestDataKeyWithPaddingScheme validates that we properly leverage padding scheme	COMMENT
MEDIUM	builtin/logical/pki/acme_wrappers.go	113	// acmeWrapper a basic wrapper that all ACME handlers should leverage as the basis.	COMMENT
MEDIUM	builtin/logical/pki/backend_test.go	2809	// that we will leverage the issuer's configured behavior	COMMENT
MEDIUM	builtin/logical/pki/backend_test.go	6832	// - Definitely will work with sign-verbatim.	COMMENT
MEDIUM	builtin/logical/pki/storage_migrations.go	141	// We always want to write out this log entry as the secondary clusters leverage this path to wake up	COMMENT
MEDIUM	builtin/logical/pki/issuing/context.go	14	// leverage to issue a certificate along with the	COMMENT
MEDIUM	vault/identity_store_injector_testonly.go	31	// Use of these endpoints is a bit nuanced as they are low level and do almost	COMMENT
MEDIUM	vault/token_store.go	1319	// minted service tokens. This function is meant to be robust so as to allow vault	COMMENT
MEDIUM	vault/identity_store_util.go	976	// ConflictResolver implementation, the behavior here is a bit nuanced.	COMMENT

Self-Referential Comments18 hits · 54 pts

Severity	File	Line	Snippet	Context
MEDIUM	enos/enos-dynamic-config.hcl	6	# This file is overwritten in CI as it contains branch specific and sometimes ever-changing values.	COMMENT
MEDIUM	…mark/set_up_telemetry_collector/scripts/run-grafana.sh	86	# Create a function to process each dashboard file	COMMENT
MEDIUM	…mark/set_up_telemetry_collector/scripts/run-grafana.sh	93	# Create a temporary file	COMMENT
MEDIUM	…dules/softhsm_create_vault_keys/scripts/create-keys.sh	27	# Create an HSM slot and return the slot number in decimal value.	COMMENT
MEDIUM	…es/verify_log_secrets/scripts/scan_logs_for_secrets.sh	37	# Create a readable copy of the audit log.	COMMENT
MEDIUM	…es/verify_log_secrets/scripts/scan_logs_for_secrets.sh	46	# Create a radar index file of our KVv2 secret values.	COMMENT
MEDIUM	…rify_secrets_engines/scripts/pki-issue-certificates.sh	39	# Creating a role	COMMENT
MEDIUM	…rify_secrets_engines/scripts/pki-issue-certificates.sh	54	# Creating a intermediate role	COMMENT
MEDIUM	…/verify_secrets_engines/scripts/ldap/verify-secrets.sh	122	# Create the dynamic LDAP role in Vault using the LDIF templates	COMMENT
MEDIUM	…/verify_secrets_engines/scripts/ldap/verify-secrets.sh	167	# Create a different password policy (strong-policy)	COMMENT
MEDIUM	…s/scripts/ldap/Dynamic-roles/dynamic-roles-deletion.sh	121	# Define the check function	COMMENT
MEDIUM	…os/modules/verify_secrets_engines/modules/create/kv.tf	56	# Create a group policy that allows writing to our kv store	COMMENT
MEDIUM	…/modules/verify_secrets_engines/modules/create/auth.tf	76	# Create a default policy for our users that allows them to read and list.	COMMENT
MEDIUM	…les/verify_secrets_engines/modules/create/ldap/ldap.tf	197	# Create a new Library set of service accounts	COMMENT
MEDIUM	…_operation_token/scripts/configure-vault-dr-primary.sh	19	# Define the policy content	COMMENT
MEDIUM	…_operation_token/scripts/configure-vault-dr-primary.sh	49	# Create a token for the failover handler role and output the token only	COMMENT
MEDIUM	.github/workflows/ci.yml	148	# Initialize a variable to collect matched versions	COMMENT
MEDIUM	.github/actions/install-tools/action.yml	31	# Create the tool cache directory if it doesn't exist and add it to the	COMMENT

Hyper-Verbose Identifiers23 hits · 23 pts

Severity	File	Line	Snippet	Context
LOW	ui/app/utils/mfa-login-enforcement-helpers.js	188	export async function fetchMfaLoginEnforcements(api) {	CODE
LOW	ui/app/utils/identity-helpers.js	55	export async function fetchIdentityItemsWithCapabilities({ identityType, api, capabilities }) {	CODE
LOW	ui/app/utils/identity-helpers.js	185	export function buildEntityMergeRequestParams(data) {	CODE
LOW	ui/app/utils/plugin-catalog-helpers.ts	78	export function enhanceEnginesWithCatalogData(	CODE
LOW	ui/app/utils/plugin-catalog-helpers.ts	204	export function categorizeEnginesByStatus(engines: EnhancedEngineDisplayData[]): CategorizedEngines {	CODE
LOW	ui/app/utils/plugin-catalog-helpers.ts	219	export function getPluginVersionsFromEngineType(list: PluginCatalogPlugin[] \| undefined, name: string) {	CODE
LOW	ui/app/utils/plugin-catalog-helpers.ts	258	export function getAllVersionsForEngineType(	CODE
LOW	ui/app/utils/version-utils.ts	120	export function isPluginVersionValidForType(pluginType: string, pluginVersion?: string): boolean {	CODE
LOW	ui/app/utils/preferences.ts	153	export function getOrCreateAnalyticsUserId(): string {	CODE
LOW	ui/app/utils/preferences.ts	153	export function getOrCreateAnalyticsUserId(): string {	CODE
LOW	ui/app/utils/external-plugin-helpers.ts	41	export function getBuiltinTypeFromExternalPlugin(externalPluginName: string): string \| undefined {	CODE
LOW	ui/app/utils/external-plugin-helpers.ts	74	export function getExternalPluginNameFromBuiltin(builtinType: string): string \| null {	CODE
LOW	ui/app/utils/model-helpers/secret-engine-helpers.ts	25	function getTransformModelTypeFromSecretPath(secret: string): string {	CODE
LOW	ui/app/utils/model-helpers/secret-engine-helpers.ts	43	function getTransformModelTypeFromParams(transformType?: string): string {	CODE
LOW	ui/app/helpers/exit-configuration-route.ts	18	function getExitConfigurationRoute(engineType: string, version?: number): string {	CODE
LOW	ui/app/helpers/supported-managed-auth-backends.js	12	export function supportedManagedAuthBackends() {	CODE
LOW	ui/app/services/checklist-state.ts	78	function isChecklistLocalStateData(value: unknown): value is ChecklistLocalStateData {	CODE
LOW	ui/docs/secrets-sync-adding-new-types.md	57	export function getSecretTypeFromAccessor(accessor: string): SecretType \| null {	CODE
LOW	ui/scripts/gen-dep-override-report.js	78	function shouldRetryWithReducedDepth(error) {	CODE
LOW	ui/lib/core/addon/utils/all-engines-metadata.ts	69	export function filterEnginesByMountCategory({	CODE
LOW	…lib/core/addon/helpers/replication-mode-description.js	14	function replicationModeDescription([mode]) {	CODE
LOW	ui/lib/sync/addon/utils/secret-type-config.ts	29	export function getSecretTypeFromAccessor(accessor: string): SecretType \| null {	CODE
LOW	ui/e2e/tests/superuser/sync-destinations.spec.ts	19	async function openCreateDestinationForm(page: Page, type: string) {	CODE

Redundant / Tautological Comments14 hits · 21 pts

Severity	File	Line	Snippet	Context
LOW	…mark/set_up_telemetry_collector/scripts/run-grafana.sh	52	# Check if the response contains the UID	COMMENT
LOW	…ify_billing_start_date/scripts/verify-billing-start.sh	55	# Verify if the billing start date is in the latest billing year	COMMENT
LOW	enos/modules/verify_secrets_engines/scripts/write.sh	23	# Check if PAYLOAD is empty or unset	COMMENT
LOW	…ify_secrets_engines/scripts/ldap/verify-audit-trail.sh	22	# Check if audit log file exists	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	21	# Check if Go is installed	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	35	# Check if gotestsum is installed (required)	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	47	# Check if jq is available (needed for parsing test matrix)	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	52	# Check if git is available (needed for git rev-parse)	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	219	# Check if JSON file was created successfully	COMMENT
LOW	…os/modules/vault_run_blackbox_test/scripts/run-test.sh	224	# Check if JUnit file was created (only when using gotestsum)	COMMENT
LOW	scripts/gen_openapi.sh	92	# Check if vault version contains +ent	COMMENT
LOW	.github/workflows/changelog-checker.yml	32	# Check if there is a diff in the changelog directory.	COMMENT
LOW	.github/workflows/test-go.yml	656	# Check if test results contains offending phrase	COMMENT
LOW	.github/scripts/report-ci-status.sh	31	# Check if the number of failures is greater than the maximum tests to display	COMMENT

Modern AI Meta-Vocabulary6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	…pp/utils/terraform-code-generator/mapping-generator.ts	118	// Generates the full TypeScript scaffold string for interactive mode	COMMENT
MEDIUM	…pp/utils/terraform-code-generator/mapping-generator.ts	176	// Generates the full TypeScript scaffold string for OpenAPI mode	COMMENT
MEDIUM	ui/app/services/version.js	62	// Agent Registry requires either the platform-standard or agentic-iam license module.	COMMENT
MEDIUM	ui/docs/vault-list-view/skill.md	111	### 4. Generate the scaffold	COMMENT
MEDIUM	ui/lib/core/addon/helpers/display-nav-item.ts	80	// agentic security nav items	COMMENT
MEDIUM	ui/lib/core/addon/helpers/display-nav-item.ts	183	// Agent Registry is available only when the license includes platform-standard or agentic-iam.	COMMENT

Slop Phrases8 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	…omponents/kubernetes/page/role/create-and-edit-test.js	184	const expectedInitialValue = `# The below is an example that you can use as a starting point.	CODE
MEDIUM	ui/lib/kubernetes/addon/utils/generated-role-rules.js	6	const example = `# The below is an example that you can use as a starting point.	CODE
MEDIUM	enos/enos-scenario-benchmark.hcl	10	If you've never used Enos before, it's worth noting that the matrix parameters act as filters. You can view a full	CODE
MEDIUM	…database/cassandra/test-fixtures/no_tls/cassandra.yaml	41	# initial_token allows you to specify tokens manually. While you can use it with	COMMENT
MEDIUM	…database/cassandra/test-fixtures/no_tls/cassandra.yaml	629	# you may want to adjust max_value_size_in_mb accordingly.	COMMENT
LOW	…database/cassandra/test-fixtures/no_tls/cassandra.yaml	844	# Warning: before enabling this property make sure to ntp is installed	COMMENT
MEDIUM	builtin/logical/pki/chain_util.go	546	// not sufficient as discussed above -- we also need to find any	COMMENT
LOW	vault/identity_store_entities.go	1167	// Don't forget to insert aliases into alias table that were part of	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	builtin/logical/pki/path_generate_root_test.go	80	// Explicit positive values: pathLenConstraint is set as requested.	COMMENT

Example Usage Blocks3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	ui/tests/helpers/secret-engine/secret-engine-helpers.js	359	// Example usage	COMMENT
LOW	sdk/helper/tpm/doc.go	17	// Example usage:	COMMENT
LOW	scripts/deprecations-checker.sh	6	# Usage:	COMMENT

hashicorp/vault

Open-Source Code Quality, Security and Technical Debt Review