Flexible authentication solution for Rails with Warden.
This report presents the forensic synthetic code analysis of heartcombo/devise, a Ruby project with 24,347 GitHub stars. SynthScan v2.0 examined 19,087 lines of code across 215 source files, recording 189 pattern matches distributed across 7 syntactic categories. The overall adjusted score of 11.9 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 189 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/controllers/devise_controller.rb | 21 | # Override prefixes to consider the scoped view. | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 41 | # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 61 | COMMENT | |
| LOW | test/rails_app/config/environments/test.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 21 | config.mailer_sender = "please-change-me@config-initializers-devise.com" | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 41 | # should be aborted or not if the value is not present. By default is empty. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 61 | # Tell if authentication through request.params is enabled. True by default. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 81 | # When allow_unconfirmed_access_for is zero, the user won't be able to sign in without confirming. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 101 | # Regex to use to validate the email address | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 121 | # :both = Enables both strategies | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 141 | COMMENT | |
| LOW | test/rails_app/config/initializers/devise.rb | 161 | # The default is true, which means any logout action will sign out all active scopes. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 181 | # If you want to use other strategies, that are not supported by Devise, or | COMMENT |
| LOW | test/rails_app/db/schema.rb | 1 | # encoding: UTF-8 | COMMENT |
| LOW | lib/devise.rb | 381 | # +model+ - String representing the load path to a custom *model* for this module (to autoload.) | COMMENT |
| LOW | lib/devise.rb | 441 | COMMENT | |
| LOW | lib/devise/mapping.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 21 | # def configure_permitted_parameters | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 81 | COMMENT | |
| LOW | lib/devise/test/controller_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/test/controller_helpers.rb | 61 | # * +scope+ - An optional +Symbol+ with the scope where the resource | COMMENT |
| LOW | lib/devise/test/integration_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/mailers/helpers.rb | 61 | template_path | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 61 | # | COMMENT |
| LOW | lib/devise/models/omniauthable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 101 | false | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 141 | result | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 21 | # passed to find_for_authentication method and considered in your model lookup. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 41 | # | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 141 | # | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 161 | # end | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 181 | # message = devise_mailer.send(notification, self, *args) | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 241 | http_authenticatable.include?(strategy) : http_authenticatable | COMMENT |
| LOW | lib/devise/models/recoverable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/recoverable.rb | 61 | # reset_password_within is a model configuration, must always be an integer value. | COMMENT |
| LOW | lib/devise/models/timeoutable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 21 | # | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 181 | # in models to map to a nice sign up e-mail. | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 201 | # # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 221 | # Examples: | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 301 | # used to insert your own logic that is only run after the user successfully | COMMENT |
| LOW | lib/devise/models/lockable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/rememberable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/rememberable.rb | 21 | # asking for credentials. After this time the user will be blocked and | COMMENT |
| LOW | lib/devise/models/validatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 21 | # defined for normal mappings. | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 81 | end | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 101 | # authenticate_admin! # Signs admin in or redirect | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 181 | elsif context.respond_to?(:root_path) | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 201 | # namespace :user do | COMMENT |
| LOW | lib/devise/controllers/sign_in_out.rb | 21 | # to the set_user method in warden. | COMMENT |
| LOW | lib/devise/controllers/store_location.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/controllers/url_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/rails/routes.rb | 41 | # | COMMENT |
| LOW | lib/devise/rails/routes.rb | 61 | # # Confirmation routes for Confirmable, if User model has :confirmable configured | COMMENT |
| 41 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/mailers/devise/mailer.rb | 7 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | app/mailers/devise/mailer.rb | 12 | def reset_password_instructions(record, token, opts = {}) | CODE |
| LOW | app/controllers/devise_controller.rb | 215 | def respond_with_navigational(*args, &block) | CODE |
| LOW | app/controllers/devise/omniauth_callbacks_controller.rb | 29 | def after_omniauth_failure_path_for(scope) | CODE |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 55 | def after_resetting_password_path_for(resource) | CODE |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 60 | def after_sending_reset_password_instructions_path_for(resource_name) | CODE |
| LOW | app/controllers/devise/unlocks_controller.rb | 40 | def after_sending_unlock_instructions_path_for(resource) | CODE |
| LOW | app/controllers/devise/confirmations_controller.rb | 38 | def after_resending_confirmation_instructions_path_for(resource_name) | CODE |
| LOW | app/controllers/devise/confirmations_controller.rb | 43 | def after_confirmation_path_for(resource_name, resource) | CODE |
| LOW | app/controllers/devise/registrations_controller.rb | 111 | def after_inactive_sign_up_path_for(resource) | CODE |
| LOW | app/controllers/devise/registrations_controller.rb | 151 | def set_flash_message_for_update(resource, prev_unconfirmed_email) | CODE |
| LOW | test/mailers/mailer_test.rb | 8 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | test/mailers/mailer_test.rb | 26 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | test/integration/http_authenticatable_test.rb | 102 | def sign_in_as_new_user_with_http(username = "user@test.com", password = "12345678") | CODE |
| LOW | test/integration/lockable_test.rb | 7 | def visit_user_unlock_with_token(unlock_token) | CODE |
| LOW | test/integration/confirmable_test.rb | 7 | def visit_user_confirmation_with_token(confirmation_token) | CODE |
| LOW | test/integration/confirmable_test.rb | 291 | def visit_admin_confirmation_with_token(confirmation_token) | CODE |
| LOW | test/models/confirmable_test.rb | 321 | def confirm_user_by_token_with_confirmation_sent_at(confirmation_sent_at) | CODE |
| LOW | test/support/helpers.rb | 49 | def create_user_without_email(attributes = {}) | CODE |
| LOW | test/support/helpers.rb | 53 | def create_user_with_validations(attributes = {}) | CODE |
| LOW | test/support/assertions.rb | 25 | def assert_raise_with_message(exception_klass, message, &block) | CODE |
| LOW | lib/devise/parameter_filter.rb | 19 | def filtered_hash_by_method_for_given_keys(conditions, method, condition_keys) | CODE |
| LOW | lib/devise/strategies/authenticatable.rb | 157 | def parse_authentication_key_values(hash, keys) | CODE |
| LOW | lib/devise/models/database_authenticatable.rb | 198 | def find_for_database_authentication(conditions) | CODE |
| LOW | lib/devise/models/authenticatable.rb | 180 | # def render_and_send_devise_message(notification, *args) | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 206 | def apply_to_attribute_or_variable(attr, method) | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 267 | def find_first_by_auth_conditions(tainted_conditions, opts = {}) | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 272 | def find_or_initialize_with_error_by(attribute, value, error = :invalid) #:nodoc: | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 277 | def find_or_initialize_with_errors(required_attributes, attributes, error = :invalid) #:nodoc: | CODE |
| LOW | lib/devise/models/recoverable.rb | 98 | def send_reset_password_instructions_notification(token) | CODE |
| LOW | lib/devise/models/recoverable.rb | 114 | def with_reset_password_token(token) | CODE |
| LOW | lib/devise/models/recoverable.rb | 123 | def send_reset_password_instructions(attributes = {}) | CODE |
| LOW | lib/devise/models/confirmable.rb | 318 | def send_confirmation_instructions(attributes = {}) | CODE |
| LOW | lib/devise/models/confirmable.rb | 359 | def find_by_unconfirmed_email_with_errors(attributes = {}) | CODE |
| LOW | lib/devise/controllers/store_location.rb | 56 | def extract_path_from_location(location) | CODE |
| LOW | lib/devise/controllers/store_location.rb | 71 | def add_fragment_back_to_path(uri, path) | CODE |
| LOW | lib/devise/rails/routes.rb | 460 | def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc: | CODE |
| LOW | …templates/controllers/omniauth_callbacks_controller.rb | 27 | # def after_omniauth_failure_path_for(scope) | COMMENT |
| LOW | …nerators/templates/controllers/passwords_controller.rb | 26 | # def after_resetting_password_path_for(resource) | COMMENT |
| LOW | …nerators/templates/controllers/passwords_controller.rb | 31 | # def after_sending_reset_password_instructions_path_for(resource_name) | COMMENT |
| LOW | …generators/templates/controllers/unlocks_controller.rb | 22 | # def after_sending_unlock_instructions_path_for(resource) | COMMENT |
| LOW | …tors/templates/controllers/confirmations_controller.rb | 22 | # def after_resending_confirmation_instructions_path_for(resource_name) | COMMENT |
| LOW | …tors/templates/controllers/confirmations_controller.rb | 27 | # def after_confirmation_path_for(resource_name, resource) | COMMENT |
| LOW | …tors/templates/controllers/registrations_controller.rb | 59 | # def after_inactive_sign_up_path_for(resource) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 64 | # Check if a reset_password_token is provided in the request | COMMENT |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 72 | # Check if the user should be signed in automatically after resetting the password. | COMMENT |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 77 | # Check if proper Lockable module methods are present & unlock strategy | COMMENT |
| LOW | app/controllers/devise/sessions_controller.rb | 57 | # Check if there is no signed in user before doing the sign out. | COMMENT |
| LOW | app/controllers/devise/registrations_controller.rb | 130 | # Check if the user should be signed in automatically after updating the password. | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 67 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | lib/devise/failure_app.rb | 263 | # Check if flash messages should be emitted. Default is to do it on | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 60 | # Check if this is a valid strategy for http authentication by: | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 70 | # Check if this is a valid strategy for params authentication by: | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 82 | # Check if the model accepts this strategy as http authenticatable. | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 87 | # Check if the model accepts this strategy as params authenticatable. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 75 | # Check if the current object is valid for authentication. This method and | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 270 | # Check if flash messages should be emitted. Default is to do it on | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/integration/omniauthable_test.rb | 10 | "email" => 'user@example.com', | CODE |
| LOW | test/integration/recoverable_test.rb | 51 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/recoverable_test.rb | 63 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 76 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 81 | assert_have_selector "input[type=email][value='foo@bar.com']" | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 87 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/recoverable_test.rb | 99 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 10 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 21 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 32 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 40 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 107 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 62 | swap Devise, strip_whitespace_keys: [:fake_key] do | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 68 | swap Devise, case_insensitive_keys: [:fake_key] do | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 74 | conditions = { "login" => "foo@bar.com", "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 76 | assert_equal( { "login" => "foo@bar.com", "bool1" => "true", "bool2" => "false", "fixnum" => "123", "will_be_convert | CODE |
| LOW | …st/controllers/custom_registrations_controller_test.rb | 17 | post :create, params: { user: { email: "user@example.org", password: "password", password_confirmation: "password" } | CODE |
| LOW | guides/bug_report_templates/integration_test.rb | 95 | login_as User.create!(email: 'test@test.com', password: 'test123456', password_confirmation: 'test123456') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/rails_app/db/schema.rb | 4 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| MEDIUM | test/support/webrat/integrations/rails.rb | 21 | # This method is private within webrat gem and after Ruby 2.4 we get a lot of warnings because | COMMENT |
| MEDIUM | lib/devise.rb | 289 | # Define a set of modules that are called when a mapping is added. | COMMENT |
| MEDIUM | lib/devise/models/database_authenticatable.rb | 10 | # This module defines a `password=` method. This method will hash the argument | COMMENT |
| MEDIUM | lib/devise/models/authenticatable.rb | 245 | # This method is always called during an authentication process but | COMMENT |
| MEDIUM | lib/devise/models/rememberable.rb | 133 | # Create the cookie key using the record id and remember_token | COMMENT |
| MEDIUM | lib/devise/rails/routes.rb | 47 | # This method is going to look inside your User model and create the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/devise/failure_app.rb | 115 | # TODO: Remove the fallback and just use `downcase_first` once we drop support for Rails 7.0. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 104 | # given to :except will simply add names to exempt to Devise internal list. | COMMENT |
| MEDIUM | lib/devise/models/confirmable.rb | 31 | # confirmation. Also, when used in conjunction with `send_email_changed_notification`, | COMMENT |
| MEDIUM | lib/generators/templates/devise.rb | 160 | # Also, when used in conjunction with `send_email_changed_notification`, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/devise/models/authenticatable.rb | 42 | # You can overwrite this method yourself, but if you do, don't forget to call super: | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 42 | # You can overwrite this method yourself, but if you do, don't forget to call super: | COMMENT |