Repository Analysis

hoppscotch/hoppscotch

Open-Source API Development Ecosystem • https://hoppscotch.io • Offline, On-Prem & Cloud • Web, Desktop & CLI • Open-Source Alternative to Postman, Insomnia

1.2 Likely human-written View on GitHub
1.2
Adjusted Score
1.2
Raw Score
100%
Time Factor
2026-05-28
Last Push
79,353
Stars
TypeScript
Language
391,080
Lines of Code
1771
Files
277
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 14HIGH 1MEDIUM 8LOW 254

Pattern Findings

277 matches across 9 categories. Click a row to expand file-level details.

Hyper-Verbose Identifiers153 hits · 156 pts
SeverityFileLineSnippet
LOWpackages/hoppscotch-common/src/newstore/history.ts62export function translateToNewRESTHistory(x: any): RESTHistoryEntry {
LOWpackages/hoppscotch-common/src/newstore/history.ts298export function toggleRESTHistoryEntryStar(entry: RESTHistoryEntry) {
LOWpackages/hoppscotch-common/src/newstore/history.ts319export function deleteGraphqlHistoryEntry(entry: GQLHistoryEntry) {
LOWpackages/hoppscotch-common/src/newstore/history.ts333export function toggleGraphqlHistoryEntryStar(entry: GQLHistoryEntry) {
LOWpackages/hoppscotch-common/src/newstore/history.ts340export function removeDuplicateRestHistoryEntry(id: string) {
LOWpackages/hoppscotch-common/src/newstore/history.ts347export function removeDuplicateGraphqlHistoryEntry(id: string) {
LOWpackages/hoppscotch-common/src/newstore/mockServers.ts208export function loadMockServersForWorkspace(
LOWpackages/hoppscotch-common/src/newstore/settings.ts310export function performSettingsDataMigrations(data: any): SettingsDef {
LOWpackages/hoppscotch-common/src/newstore/environments.ts542export function getAggregateEnvsWithCurrentValue() {
LOWpackages/hoppscotch-common/src/newstore/environments.ts726export function getSelectedEnvironmentIndex() {
LOWpackages/hoppscotch-common/src/newstore/environments.ts730export function getSelectedEnvironmentType() {
LOWpackages/hoppscotch-common/src/newstore/environments.ts734export function setSelectedEnvironmentIndex(
LOWpackages/hoppscotch-common/src/newstore/environments.ts745export function getLegacyGlobalEnvironment(): Environment | null {
LOWpackages/hoppscotch-common/src/newstore/environments.ts778export function getLocalIndexByEnvironmentID(id: string) {
LOWpackages/hoppscotch-common/src/newstore/environments.ts949export function removeEnvironmentVariable(
LOWpackages/hoppscotch-common/src/newstore/environments.ts962export function updateEnvironmentVariable(
LOWpackages/hoppscotch-common/src/newstore/collections.ts74export function navigateToFolderWithIndexPath(
LOWpackages/hoppscotch-common/src/newstore/collections.ts130export function cascadeParentCollectionForProperties(
LOWpackages/hoppscotch-common/src/newstore/collections.ts690 function recursiveChangeRefIdToAvoidConflicts(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1162 function recursiveChangeRefIdToAvoidConflicts(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1426function computeCollectionInheritedProps(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1494export function getRESTCollectionInheritedProps(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1635export function removeDuplicateRESTCollectionOrFolder(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1743export function updateRESTCollectionOrder(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1852export function duplicateGraphQLCollection(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1865export function removeDuplicateGraphqlCollectionOrFolder(
LOWpackages/hoppscotch-common/src/newstore/collections.ts1952function removeDuplicateCollectionsFromPath(
LOWpackages/hoppscotch-common/src/newstore/reordering.ts41export function changeCurrentReorderStatus(reorderItem: ReorderingItem) {
LOW…ppscotch-common/src/composables/mockServerWorkspace.ts14export function useMockServerWorkspaceSync() {
LOW…otch-common/src/composables/documentationVisibility.ts8export function useDocumentationVisibility() {
LOW…/hoppscotch-common/src/components/settings/Desktop.vue339async function toggleDisableUpdateChecks(): Promise<void> {
LOW…ppscotch-common/src/components/app/spotlight/index.vue209function newUseArrowKeysForNavigation() {
LOW…s/hoppscotch-common/src/modules/kernel-interceptors.ts16function initKernelInterceptorService(): KernelInterceptorService {
LOW…s/hoppscotch-common/src/modules/kernel-interceptors.ts36function initializeDefaultInterceptor(service: KernelInterceptorService): void {
LOWpackages/hoppscotch-common/src/pages/oauth.vue34function translateOAuthRedirectError(error: string) {
LOWpackages/hoppscotch-common/src/helpers/RequestRunner.ts708function updateEnvsAfterTestScript(
LOWpackages/hoppscotch-common/src/helpers/RequestRunner.ts1061function translateToSandboxTestResults(
LOWpackages/hoppscotch-common/src/helpers/network.ts15export function createRESTNetworkRequestStream(
LOW…ges/hoppscotch-common/src/helpers/keyboard-strategy.ts27export function getKeyboardLayoutStrategy(): KeyboardLayoutStrategy {
LOW…ges/hoppscotch-common/src/helpers/keyboard-strategy.ts31export function setKeyboardLayoutStrategy(
LOWpackages/hoppscotch-common/src/helpers/hopp-fetch.ts67async function convertFetchToRelayRequest(
LOWpackages/hoppscotch-common/src/helpers/hopp-fetch.ts214function convertRelayResponseToSerializableResponse(
LOWpackages/hoppscotch-common/src/helpers/tern.js58function postProcessCompletionResult(res) {
LOWpackages/hoppscotch-common/src/helpers/tern.js105export function getPreRequestScriptCompletions(code, row, col) {
LOW…hoppscotch-common/src/helpers/collection/collection.ts18export function resolveSaveContextOnCollectionReorder(
LOW…hoppscotch-common/src/helpers/collection/collection.ts115export function updateSaveContextForAffectedRequests(
LOW…hoppscotch-common/src/helpers/collection/collection.ts160export function updateInheritedPropertiesForAffectedRequests(
LOW…hoppscotch-common/src/helpers/collection/collection.ts217function resetSaveContextForAffectedRequests(folderPath: string) {
LOW…hoppscotch-common/src/helpers/collection/collection.ts306export function transformCollectionForImport(
LOW…es/hoppscotch-common/src/helpers/collection/request.ts21export function resolveSaveContextOnRequestReorder(payload: {
LOWpackages/hoppscotch-common/src/helpers/auth/digest.ts81export async function fetchInitialDigestAuthInfo(
LOW…pscotch-common/src/helpers/auth/types/aws-signature.ts90export async function generateAwsSignatureAuthHeaders(
LOW…pscotch-common/src/helpers/auth/types/aws-signature.ts117export async function generateAwsSignatureAuthParams(
LOW…ges/hoppscotch-common/src/helpers/auth/types/bearer.ts8export async function generateBearerAuthHeaders(
LOW…es/hoppscotch-common/src/helpers/auth/types/api-key.ts9export async function generateApiKeyAuthHeaders(
LOW…ges/hoppscotch-common/src/helpers/auth/types/digest.ts15export async function generateDigestAuthHeaders(
LOW…common/src/helpers/mockServer/exampleMockCollection.ts201export async function createMockCollectionForTeam(
LOW…common/src/helpers/mockServer/exampleMockCollection.ts256export async function createMockCollectionForPersonal(
LOW…tch-common/src/helpers/mockServer/exampleCollection.ts25export function createExamplePetStoreCollection(
LOW…ges/hoppscotch-common/src/helpers/utils/statusCodes.ts88export function getStatusCodeReasonPhrase(
93 more matches not shown…
Hallucination Indicators14 hits · 140 pts
SeverityFileLineSnippet
CRITICAL…/hoppscotch-common/src/components/environments/Add.vue242 tabs.currentActiveTab.value.document.request.endpoint.replace(
CRITICAL…s/hoppscotch-common/src/components/http/TestResult.vue329 testResults.value.envDiff.selected.additions.every(
CRITICAL…pscotch-common/src/components/http/test/TestResult.vue291 testResults.value.envDiff.selected.additions.every(
CRITICAL…ages/hoppscotch-common/src/components/embeds/index.vue59 return tab.value.document.request.requestVariables.map(({ key, value }) => ({
CRITICAL…es/hoppscotch-common/src/components/embeds/Request.vue84 return tab.value.document.request.requestVariables.map(({ key, value }) => ({
CRITICALpackages/hoppscotch-common/src/helpers/RequestRunner.ts543 tab.value.document.request.requestVariables.map(
CRITICAL…hoppscotch-common/src/helpers/collection/collection.ts140 folderPath: tab.value.document.saveContext.folderPath.replace(
CRITICALpackages/hoppscotch-common/src/helpers/auth/index.ts19 ? restTabsService.currentActiveTab.value.document.request.requestVariables.map(
CRITICAL…__tests__/pm-namespace/response/bdd-assertions.spec.ts785 pm.response.to.have.responseTime.below(500)
CRITICAL…__tests__/pm-namespace/response/bdd-assertions.spec.ts816 pm.response.to.have.responseTime.above(100)
CRITICAL…__tests__/pm-namespace/response/bdd-assertions.spec.ts872 pm.response.to.have.responseTime.below(500)
CRITICAL…chai-powered-assertions/properties-collections.spec.ts536 hopp.expect([{a: 1}, {b: 2}]).to.not.have.deep.ordered.members([{b: 2}, {a: 1}])
CRITICAL…chai-powered-assertions/properties-collections.spec.ts568 hopp.expect([{a: 1}, {b: 2}, {c: 3}]).to.not.include.deep.ordered.members([{b: 2}, {a: 1}])
CRITICAL…ugin-workspace/tauri-plugin-appload/src/uri/handler.rs80 let csp = match self.config.app.security.csp.as_ref() {
Verbosity Indicators29 hits · 50 pts
SeverityFileLineSnippet
LOW…es/hoppscotch-common/src/components/smart/EnvInput.vue597 // since the readonly prop is reactive, we need to check if it has changed
LOWpackages/hoppscotch-common/src/helpers/auth/digest.ts46 // Step 1: Hash the username, realm, password and any additional fields based on the algorithm
LOWpackages/hoppscotch-common/src/helpers/auth/digest.ts54 // Step 2: Hash the method and URI
LOWpackages/hoppscotch-common/src/helpers/auth/digest.ts60 // Step 3: Compute the response hash
LOW…ges/hoppscotch-common/src/helpers/auth/types/digest.ts25 // Step 1: Fetch the initial auth info (nonce, realm, etc.)
LOW…ges/hoppscotch-common/src/helpers/auth/types/digest.ts34 // Step 2: Set up the parameters for the digest authentication header
LOW…ges/hoppscotch-common/src/helpers/auth/types/digest.ts54 // Step 3: Generate the Authorization header
LOW…ppscotch-js-sandbox/src/bootstrap-code/post-request.js1840 // For the Chai extension, we need to check if cookies exist
LOW…backend/src/user-collection/user-collection.service.ts757 // Step 0: lock the rows
LOW…backend/src/user-collection/user-collection.service.ts772 // Step 1: Decrement orderIndex of all items that come after collection.orderIndex till end of list of ite
LOW…backend/src/user-collection/user-collection.service.ts782 // Step 2: Update orderIndex of collection to length of list
LOW…backend/src/user-collection/user-collection.service.ts832 // Step 0: lock the rows
LOW…backend/src/user-collection/user-collection.service.ts852 // Step 1: Determine if we are moving collection up or down the list
LOW…backend/src/user-collection/user-collection.service.ts856 // Step 2: Update OrderIndex of items in list depending on moving up or down
LOW…backend/src/user-collection/user-collection.service.ts876 // Step 3: Update OrderIndex of collection
LOW…backend/src/team-collection/team-collection.service.ts910 // Step 0: lock the rows
LOW…backend/src/team-collection/team-collection.service.ts925 // Step 1: Decrement orderIndex of all items that come after collection.orderIndex till end of list of ite
LOW…backend/src/team-collection/team-collection.service.ts939 // Step 2: Update orderIndex of collection to length of list
LOW…backend/src/team-collection/team-collection.service.ts982 // Step 0: lock the rows
LOW…backend/src/team-collection/team-collection.service.ts1001 // Step 1: Determine if we are moving collection up or down the list
LOW…backend/src/team-collection/team-collection.service.ts1005 // Step 2: Update OrderIndex of items in list depending on moving up or down
LOW…backend/src/team-collection/team-collection.service.ts1025 // Step 3: Update OrderIndex of collection
LOW…pscotch-backend/src/mock-server/mock-server.service.ts781 // Step 6: Return highest scoring example
LOWpackages/hoppscotch-cli/src/utils/pre-request.ts314 // Step 1: Fetch the initial auth info (nonce, realm, etc.)
LOWpackages/hoppscotch-cli/src/utils/pre-request.ts321 // Step 2: Set up the parameters for the digest authentication header
LOWpackages/hoppscotch-cli/src/utils/pre-request.ts343 // Step 3: Generate the Authorization header
LOWpackages/hoppscotch-cli/src/utils/auth/digest.ts68 // Step 1: Hash the username, realm, password and any additional fields based on the algorithm
LOWpackages/hoppscotch-cli/src/utils/auth/digest.ts76 // Step 2: Hash the method and URI
LOWpackages/hoppscotch-cli/src/utils/auth/digest.ts82 // Step 3: Compute the response hash
Over-Commented Block49 hits · 49 pts
SeverityFileLineSnippet
LOWdocker-compose.yml1# To make it easier to self-host, we have a preset docker compose config that also
LOWdocker-compose.yml241# This will start: AIO only (use when you have an external database)
LOW…/hoppscotch-common/src/composables/desktop-settings.ts1import { reactive, ref, readonly } from "vue"
LOW…ges/hoppscotch-common/src/platform/desktop-settings.ts41 // Connection and startup behavior. The `connectionTimeoutMs` default
LOW…ch-common/src/components/environments/ImportExport.vue401 }
LOW…otch-common/src/components/graphql/ExplorerSection.vue41
LOWpackages/hoppscotch-common/src/helpers/ternlint.js461 if (!parentType.isEmpty() && type.isEmpty()) {
LOW…n/src/helpers/curl/__tests__/detectContentType.spec.js41 // </book>
LOW…n/src/helpers/curl/__tests__/detectContentType.spec.js61 // TODO: Figure this test situation
LOW…n/src/helpers/curl/__tests__/detectContentType.spec.js81 // <head>
LOW…c/helpers/editor/extensions/HoppPredefinedVariables.ts41 // Don't show tooltip if the cursor is inside a comment
LOWpackages/hoppscotch-common/src/kernel/log.ts1// kernel log wrapper. same setup as store.ts: delegates to the kernel
LOWpackages/hoppscotch-common/src/kernel/log.ts21// in-memory buffer that works even before the kernel is initialized.
LOWpackages/hoppscotch-common/src/kernel/store.ts21// sanitize it the same way Tauri sanitizes window labels: replace all
LOWpackages/hoppscotch-common/src/kernel/store.ts281// Use this for anything that should persist regardless of which org
LOWpackages/hoppscotch-agent/src-tauri/.cargo/config.toml1# Enable static linking for C runtime library on Windows.
LOWpackages/hoppscotch-agent/src-tauri/src/webview/mod.rs1/// The WebView2 Runtime is a critical dependency for Tauri applications on Windows.
LOWpackages/hoppscotch-agent/src-tauri/src/webview/mod.rs21/// > HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
LOW…sandbox/src/__tests__/pm-namespace/sendRequest.spec.ts661 ])
LOWpackages/hoppscotch-kernel/src/relay/impl/web/v/1.ts141
LOWpackages/hoppscotch-kernel/src/relay/impl/web/v/1.ts161 // }
LOWpackages/hoppscotch-kernel/src/relay/impl/web/v/1.ts181 // accessKeyId: accessKey,
LOWpackages/hoppscotch-desktop/src-tauri/src/config.rs81// couple this code to the plugin's on-disk format, the webview pushes the
LOWpackages/hoppscotch-desktop/src-tauri/src/config.rs101 /// related connection paths. Mirrors `API_TIMEOUT_SECS` when the value
LOW…ckages/hoppscotch-desktop/src-tauri/src/webview/mod.rs1/// The WebView2 Runtime is a critical dependency for Tauri applications on Windows.
LOW…ckages/hoppscotch-desktop/src-tauri/src/webview/mod.rs21/// > HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
LOW…ktop/plugin-workspace/tauri-plugin-appload/devenv.yaml21# If you have more than one devenv you can merge them
LOW…ri-plugin-appload/examples/tauri-app/src/vite-env.d.ts1/// <reference types="svelte" />
LOW…op/plugin-workspace/tauri-plugin-appload/src/models.rs141 pub bundle_name: String,
LOW…op/plugin-workspace/tauri-plugin-appload/src/models.rs201#[derive(Debug, Clone, Deserialize)]
LOW…/plugin-workspace/tauri-plugin-appload/src/commands.rs121
LOW…p/plugin-workspace/tauri-plugin-appload/src/mapping.rs1use dashmap::DashMap;
LOW…p/plugin-workspace/tauri-plugin-appload/src/mapping.rs41 /// * `host` - The virtual host (e.g., "acme_hoppscotch_io")
LOW…/hoppscotch-desktop/plugin-workspace/relay/devenv.yaml21# If you have more than one devenv you can merge them
LOW…ppscotch-desktop/plugin-workspace/relay/src/interop.rs21 #[serde(rename = "text/csv")]
LOW…ppscotch-desktop/plugin-workspace/relay/src/interop.rs41 #[serde(rename = "multipart/form-data")]
LOW…ppscotch-desktop/plugin-workspace/relay/src/interop.rs61 #[serde(rename = "audio/mp4")]
LOW…ppscotch-desktop/plugin-workspace/relay/src/interop.rs81 #[serde(rename = "video/mp4")]
LOW…ppscotch-desktop/plugin-workspace/relay/src/interop.rs101 #[serde(rename = "image/png")]
LOWpackages/hoppscotch-desktop/src/main.ts21// Sync the launcher window's zoom with the user's persisted preference.
LOW…hoppscotch-desktop/src/services/persistence.service.ts101 migrate: async () => E.right(undefined),
LOW…hoppscotch-desktop/src/services/persistence.service.ts121 // coerces to "1" so every migration reruns from scratch. In both
LOW…nd/src/team-collection/team-collection.service.spec.ts2101 });
LOW…nd/src/team-collection/team-collection.service.spec.ts2121 // parentID: rootTeamCollection.parentID,
LOW…backend/src/team-collection/team-collection.service.ts701 ): Promise<O.Option<boolean>> {
LOWpackages/hoppscotch-sh-admin/src/vite-env.d.ts1/// <reference types="vite/client" />
LOW…tch-selfhost-web/webapp-server/internal/crypto/keys.go1// Package crypto handles ed25519 key generation and persistence.
LOWpackages/hoppscotch-selfhost-web/src/main.ts301 }
LOW…ch-selfhost-web/src/platform/collections/web/import.ts101 // Flush orphans left under originals' refIds when the backend dropped
Decorative Section Separators8 hits · 24 pts
SeverityFileLineSnippet
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts17// ─── truncateText ────────────────────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts81// ─── formatTooltipValue ──────────────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts118// ─── calculateTooltipDimensions ──────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts164// ─── applyTooltipOverflowStyles ──────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts209// ─── createTooltipValueRow ───────────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts300// ─── constrainTooltipToViewport ──────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts378// ─── stabilizeTooltipHover ───────────────────────────────────────
MEDIUM…tch-common/src/helpers/utils/__tests__/tooltip.spec.ts396// ─── Constants ───────────────────────────────────────────────────
Fake / Example Data20 hits · 22 pts
SeverityFileLineSnippet
LOW…-common/src/helpers/auth/types/__tests__/test-utils.ts76 initialValue: '{"sub": "1234567890", "name": "John Doe"}',
LOW…-common/src/helpers/auth/types/__tests__/test-utils.ts77 currentValue: '{"sub": "1234567890", "name": "John Doe"}',
LOW…ch-common/src/helpers/auth/types/__tests__/jwt.spec.ts35 payload: '{"sub": "1234567890", "name": "John Doe"}',
LOW…ch-common/src/helpers/auth/types/__tests__/jwt.spec.ts48 payload: '{"sub": "1234567890", "name": "John Doe"}',
LOW…ch-common/src/helpers/auth/types/__tests__/jwt.spec.ts111 payload: '{"sub": "1234567890", "name": "John Doe"}',
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts21 expect(getOrgInitials("Acme Corp")).toBe("AC")
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts41 expect(getOrgInitials("Acme Corp")).toBe("AC")
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts54 const a = getOrgColorIndex("Acme Corp")
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts55 const b = getOrgColorIndex("Acme Corp")
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts60 const a = getOrgColorIndex("Acme Corp")
LOW…ommon/src/helpers/utils/__tests__/organization.spec.ts79 const color = getOrgColor("Acme Corp")
LOW…h-common/src/helpers/curl/__tests__/curlparser.spec.js459 value: "test@test.com",
LOW…src/__tests__/pm-namespace/advanced-assertions.spec.ts637 name: "John Doe",
LOW…src/__tests__/pm-namespace/advanced-assertions.spec.ts649 pm.response.to.have.jsonPath("$.user.profile.name", "John Doe")
LOW…src/__tests__/pm-namespace/advanced-assertions.spec.ts665 "Expected 'John Doe' to deep equal 'John Doe'"
LOW…sandbox/src/__tests__/pm-namespace/sendRequest.spec.ts203 raw: JSON.stringify({ name: 'John Doe' })
LOW…space/chai-powered-assertions/functions-errors.spec.ts726 hopp.expect('user@example.com').to.satisfy(function(email) {
LOW…amespace/chai-powered-assertions/strings-regex.spec.ts257 hopp.expect('user@example.com').to.match(/^[a-z0-9._%+-]+@[a-z0-9.-]+\\.[a-z]{2,}$/i)
LOWpackages/hoppscotch-relay/README.md88 Some(BodyDef::Text(r#"{"name": "John Doe"}"#.to_string())),
LOW…tch-backend/src/published-docs/published-docs.model.ts162 example: '{"author": "John Doe", "tags": ["api", "rest"]}',
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippet
HIGH…hoppscotch-common/src/services/oauth/flows/authCode.ts96 // missing, default to 'plain' as requested by the user.
Slop Phrases2 hits · 3 pts
SeverityFileLineSnippet
LOWdocker-compose.yml43 # Edit the below line to match your PostgresDB URL if you have an outside DB (make sure to update the .env file as
LOWdocker-compose.yml195 # Edit the below line to match your PostgresDB URL if you have an outside DB (make sure to update the .env file as
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippet
LOWhealthcheck.sh12# Check if the container has been running for at least 15 seconds