Flexible authentication solution for Rails with Warden.
This report summarizes scanner evidence for heartcombo/devise, a Ruby project with 24,355 GitHub stars. SynthScan examined 19,090 lines of code across 215 source files, recording 189 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 11.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 171 finding(s).
Are imports declared and package/API names verified? 18 finding(s).
Are wrappers, guards, and repeated structures necessary? 44 finding(s).
Which changes need focused human review? 189 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 189 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/controllers/devise_controller.rb | 21 | # Override prefixes to consider the scoped view. | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 41 | # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 61 | COMMENT | |
| LOW | test/rails_app/config/environments/test.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 21 | config.mailer_sender = "please-change-me@config-initializers-devise.com" | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 41 | # should be aborted or not if the value is not present. By default is empty. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 61 | # Tell if authentication through request.params is enabled. True by default. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 81 | # When allow_unconfirmed_access_for is zero, the user won't be able to sign in without confirming. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 101 | # Regex to use to validate the email address | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 121 | # :both = Enables both strategies | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 141 | COMMENT | |
| LOW | test/rails_app/config/initializers/devise.rb | 161 | # The default is true, which means any logout action will sign out all active scopes. | COMMENT |
| LOW | test/rails_app/config/initializers/devise.rb | 181 | # If you want to use other strategies, that are not supported by Devise, or | COMMENT |
| LOW | test/rails_app/db/schema.rb | 1 | # encoding: UTF-8 | COMMENT |
| LOW | lib/devise.rb | 381 | # +model+ - String representing the load path to a custom *model* for this module (to autoload.) | COMMENT |
| LOW | lib/devise.rb | 441 | COMMENT | |
| LOW | lib/devise/mapping.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 21 | # def configure_permitted_parameters | COMMENT |
| LOW | lib/devise/parameter_sanitizer.rb | 81 | COMMENT | |
| LOW | lib/devise/test/controller_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/test/controller_helpers.rb | 61 | # * +scope+ - An optional +Symbol+ with the scope where the resource | COMMENT |
| LOW | lib/devise/test/integration_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/mailers/helpers.rb | 61 | template_path | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 61 | # | COMMENT |
| LOW | lib/devise/models/omniauthable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 101 | false | COMMENT |
| LOW | lib/devise/models/database_authenticatable.rb | 141 | result | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 21 | # passed to find_for_authentication method and considered in your model lookup. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 41 | # | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 141 | # | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 161 | # end | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 181 | # message = devise_mailer.send(notification, self, *args) | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 241 | http_authenticatable.include?(strategy) : http_authenticatable | COMMENT |
| LOW | lib/devise/models/recoverable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/recoverable.rb | 61 | # reset_password_within is a model configuration, must always be an integer value. | COMMENT |
| LOW | lib/devise/models/timeoutable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 21 | # | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 181 | # in models to map to a nice sign up e-mail. | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 201 | # # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 221 | # Examples: | COMMENT |
| LOW | lib/devise/models/confirmable.rb | 301 | # used to insert your own logic that is only run after the user successfully | COMMENT |
| LOW | lib/devise/models/lockable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/rememberable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/models/rememberable.rb | 21 | # asking for credentials. After this time the user will be blocked and | COMMENT |
| LOW | lib/devise/models/validatable.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 21 | # defined for normal mappings. | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 81 | end | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 101 | # authenticate_admin! # Signs admin in or redirect | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 181 | elsif context.respond_to?(:root_path) | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 201 | # namespace :user do | COMMENT |
| LOW | lib/devise/controllers/sign_in_out.rb | 21 | # to the set_user method in warden. | COMMENT |
| LOW | lib/devise/controllers/store_location.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/controllers/url_helpers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/devise/rails/routes.rb | 41 | # | COMMENT |
| LOW | lib/devise/rails/routes.rb | 61 | # # Confirmation routes for Confirmable, if User model has :confirmable configured | COMMENT |
| 41 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/mailers/devise/mailer.rb | 7 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | app/mailers/devise/mailer.rb | 12 | def reset_password_instructions(record, token, opts = {}) | CODE |
| LOW | app/controllers/devise_controller.rb | 216 | def respond_with_navigational(*args, &block) | CODE |
| LOW | app/controllers/devise/omniauth_callbacks_controller.rb | 29 | def after_omniauth_failure_path_for(scope) | CODE |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 55 | def after_resetting_password_path_for(resource) | CODE |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 60 | def after_sending_reset_password_instructions_path_for(resource_name) | CODE |
| LOW | app/controllers/devise/unlocks_controller.rb | 40 | def after_sending_unlock_instructions_path_for(resource) | CODE |
| LOW | app/controllers/devise/confirmations_controller.rb | 38 | def after_resending_confirmation_instructions_path_for(resource_name) | CODE |
| LOW | app/controllers/devise/confirmations_controller.rb | 43 | def after_confirmation_path_for(resource_name, resource) | CODE |
| LOW | app/controllers/devise/registrations_controller.rb | 111 | def after_inactive_sign_up_path_for(resource) | CODE |
| LOW | app/controllers/devise/registrations_controller.rb | 151 | def set_flash_message_for_update(resource, prev_unconfirmed_email) | CODE |
| LOW | test/mailers/mailer_test.rb | 8 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | test/mailers/mailer_test.rb | 26 | def confirmation_instructions(record, token, opts = {}) | CODE |
| LOW | test/integration/http_authenticatable_test.rb | 102 | def sign_in_as_new_user_with_http(username = "user@test.com", password = "12345678") | CODE |
| LOW | test/integration/lockable_test.rb | 7 | def visit_user_unlock_with_token(unlock_token) | CODE |
| LOW | test/integration/confirmable_test.rb | 7 | def visit_user_confirmation_with_token(confirmation_token) | CODE |
| LOW | test/integration/confirmable_test.rb | 291 | def visit_admin_confirmation_with_token(confirmation_token) | CODE |
| LOW | test/models/confirmable_test.rb | 321 | def confirm_user_by_token_with_confirmation_sent_at(confirmation_sent_at) | CODE |
| LOW | test/support/helpers.rb | 49 | def create_user_without_email(attributes = {}) | CODE |
| LOW | test/support/helpers.rb | 53 | def create_user_with_validations(attributes = {}) | CODE |
| LOW | test/support/assertions.rb | 25 | def assert_raise_with_message(exception_klass, message, &block) | CODE |
| LOW | lib/devise/parameter_filter.rb | 19 | def filtered_hash_by_method_for_given_keys(conditions, method, condition_keys) | CODE |
| LOW | lib/devise/strategies/authenticatable.rb | 157 | def parse_authentication_key_values(hash, keys) | CODE |
| LOW | lib/devise/models/database_authenticatable.rb | 198 | def find_for_database_authentication(conditions) | CODE |
| LOW | lib/devise/models/authenticatable.rb | 180 | # def render_and_send_devise_message(notification, *args) | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 206 | def apply_to_attribute_or_variable(attr, method) | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 267 | def find_first_by_auth_conditions(tainted_conditions, opts = {}) | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 272 | def find_or_initialize_with_error_by(attribute, value, error = :invalid) #:nodoc: | CODE |
| LOW⚡ | lib/devise/models/authenticatable.rb | 277 | def find_or_initialize_with_errors(required_attributes, attributes, error = :invalid) #:nodoc: | CODE |
| LOW | lib/devise/models/recoverable.rb | 98 | def send_reset_password_instructions_notification(token) | CODE |
| LOW | lib/devise/models/recoverable.rb | 114 | def with_reset_password_token(token) | CODE |
| LOW | lib/devise/models/recoverable.rb | 123 | def send_reset_password_instructions(attributes = {}) | CODE |
| LOW | lib/devise/models/confirmable.rb | 318 | def send_confirmation_instructions(attributes = {}) | CODE |
| LOW | lib/devise/models/confirmable.rb | 359 | def find_by_unconfirmed_email_with_errors(attributes = {}) | CODE |
| LOW | lib/devise/controllers/store_location.rb | 56 | def extract_path_from_location(location) | CODE |
| LOW | lib/devise/controllers/store_location.rb | 71 | def add_fragment_back_to_path(uri, path) | CODE |
| LOW | lib/devise/rails/routes.rb | 460 | def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc: | CODE |
| LOW | …templates/controllers/omniauth_callbacks_controller.rb | 27 | # def after_omniauth_failure_path_for(scope) | COMMENT |
| LOW | …nerators/templates/controllers/passwords_controller.rb | 26 | # def after_resetting_password_path_for(resource) | COMMENT |
| LOW | …nerators/templates/controllers/passwords_controller.rb | 31 | # def after_sending_reset_password_instructions_path_for(resource_name) | COMMENT |
| LOW | …generators/templates/controllers/unlocks_controller.rb | 22 | # def after_sending_unlock_instructions_path_for(resource) | COMMENT |
| LOW | …tors/templates/controllers/confirmations_controller.rb | 22 | # def after_resending_confirmation_instructions_path_for(resource_name) | COMMENT |
| LOW | …tors/templates/controllers/confirmations_controller.rb | 27 | # def after_confirmation_path_for(resource_name, resource) | COMMENT |
| LOW | …tors/templates/controllers/registrations_controller.rb | 59 | # def after_inactive_sign_up_path_for(resource) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 64 | # Check if a reset_password_token is provided in the request | COMMENT |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 72 | # Check if the user should be signed in automatically after resetting the password. | COMMENT |
| LOW⚡ | app/controllers/devise/passwords_controller.rb | 77 | # Check if proper Lockable module methods are present & unlock strategy | COMMENT |
| LOW | app/controllers/devise/sessions_controller.rb | 57 | # Check if there is no signed in user before doing the sign out. | COMMENT |
| LOW | app/controllers/devise/registrations_controller.rb | 130 | # Check if the user should be signed in automatically after updating the password. | COMMENT |
| LOW | test/rails_app/config/environments/production.rb | 67 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | lib/devise/failure_app.rb | 263 | # Check if flash messages should be emitted. Default is to do it on | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 60 | # Check if this is a valid strategy for http authentication by: | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 70 | # Check if this is a valid strategy for params authentication by: | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 82 | # Check if the model accepts this strategy as http authenticatable. | COMMENT |
| LOW | lib/devise/strategies/authenticatable.rb | 87 | # Check if the model accepts this strategy as params authenticatable. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 75 | # Check if the current object is valid for authentication. This method and | COMMENT |
| LOW | lib/devise/controllers/helpers.rb | 270 | # Check if flash messages should be emitted. Default is to do it on | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/integration/omniauthable_test.rb | 10 | "email" => 'user@example.com', | CODE |
| LOW | test/integration/recoverable_test.rb | 51 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/recoverable_test.rb | 63 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 76 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 81 | assert_have_selector "input[type=email][value='foo@bar.com']" | CODE |
| LOW⚡ | test/integration/recoverable_test.rb | 87 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/recoverable_test.rb | 99 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 10 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 21 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 32 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 40 | create_user(email: 'foo@bar.com') | CODE |
| LOW | test/integration/database_authenticatable_test.rb | 107 | fill_in 'email', with: 'foo@bar.com' | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 62 | swap Devise, strip_whitespace_keys: [:fake_key] do | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 68 | swap Devise, case_insensitive_keys: [:fake_key] do | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 74 | conditions = { "login" => "foo@bar.com", "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => | CODE |
| LOW⚡ | test/models/database_authenticatable_test.rb | 76 | assert_equal( { "login" => "foo@bar.com", "bool1" => "true", "bool2" => "false", "fixnum" => "123", "will_be_convert | CODE |
| LOW | …st/controllers/custom_registrations_controller_test.rb | 17 | post :create, params: { user: { email: "user@example.org", password: "password", password_confirmation: "password" } | CODE |
| LOW | guides/bug_report_templates/integration_test.rb | 95 | login_as User.create!(email: 'test@test.com', password: 'test123456', password_confirmation: 'test123456') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/rails_app/db/schema.rb | 4 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| MEDIUM | test/support/webrat/integrations/rails.rb | 21 | # This method is private within webrat gem and after Ruby 2.4 we get a lot of warnings because | COMMENT |
| MEDIUM | lib/devise.rb | 289 | # Define a set of modules that are called when a mapping is added. | COMMENT |
| MEDIUM | lib/devise/models/database_authenticatable.rb | 10 | # This module defines a `password=` method. This method will hash the argument | COMMENT |
| MEDIUM | lib/devise/models/authenticatable.rb | 245 | # This method is always called during an authentication process but | COMMENT |
| MEDIUM | lib/devise/models/rememberable.rb | 133 | # Create the cookie key using the record id and remember_token | COMMENT |
| MEDIUM | lib/devise/rails/routes.rb | 47 | # This method is going to look inside your User model and create the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/devise/failure_app.rb | 115 | # TODO: Remove the fallback and just use `downcase_first` once we drop support for Rails 7.0. | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 104 | # given to :except will simply add names to exempt to Devise internal list. | COMMENT |
| MEDIUM | lib/devise/models/confirmable.rb | 31 | # confirmation. Also, when used in conjunction with `send_email_changed_notification`, | COMMENT |
| MEDIUM | lib/generators/templates/devise.rb | 160 | # Also, when used in conjunction with `send_email_changed_notification`, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/devise/models/authenticatable.rb | 42 | # You can overwrite this method yourself, but if you do, don't forget to call super: | COMMENT |
| LOW | lib/devise/models/authenticatable.rb | 42 | # You can overwrite this method yourself, but if you do, don't forget to call super: | COMMENT |