Hyperlight is a lightweight Virtual Machine Manager (VMM) designed to be embedded within applications. It enables safe execution of untrusted code within micro virtual machines with very low latency and minimal overhead.
This report summarizes scanner evidence for hyperlight-dev/hyperlight, a Rust project with 4,729 GitHub stars. SynthScan examined 113,266 lines of code across 404 source files, recording 447 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 435 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 8 finding(s).
Which changes need focused human review? 447 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 447 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/RegenSnapshotGoldens.yml | 1 | # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | COMMENT |
| LOW | .github/workflows/CargoPublish.yml | 141 | # # Cargo does not want you to modify files outside of OUT_DIR | COMMENT |
| LOW | .github/workflows/ready-for-review-manage.yml | 1 | name: Ready-for-review (manage) | COMMENT |
| LOW | .github/workflows/ready-for-review-label.yml | 1 | name: Ready-for-review (collect) | COMMENT |
| LOW | .github/workflows/dep_update_guest_locks.yml | 61 | run: cargo fetch | COMMENT |
| LOW | .github/workflows/dep_miri.yml | 1 | # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | COMMENT |
| LOW | dev/sync-project-board.sh | 1 | #!/bin/bash | COMMENT |
| LOW | dev/check-release-blockers.sh | 1 | #!/bin/bash | COMMENT |
| LOW | dev/update-cargo-hyperlight-version.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | dev/notify-ci-failure.sh | 1 | #!/bin/bash | COMMENT |
| LOW | fuzz/fuzz_targets/guest_trace.rs | 41 | COMMENT | |
| LOW | fuzz/fuzz_targets/virtq_malformed.rs | 61 | ], | COMMENT |
| LOW | src/hyperlight_component_util/src/resource.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_component_util/src/etypes.rs | 81 | Borrow(Handleable), | COMMENT |
| LOW | src/hyperlight_component_util/src/etypes.rs | 101 | U(u32, u32), | COMMENT |
| LOW | src/hyperlight_component_util/src/etypes.rs | 321 | /// of the instance declaration inference judgement. | COMMENT |
| LOW | src/hyperlight_component_util/src/etypes.rs | 341 | /// element in the list, and later elements can depend on earlier | COMMENT |
| LOW | src/hyperlight_component_util/src/etypes.rs | 421 | /// resourcetype_e in the specification | COMMENT |
| LOW | src/hyperlight_component_util/src/rtypes.rs | 821 | // duplicates of everything. We still bother running it, instead | COMMENT |
| LOW | src/hyperlight_component_util/src/substitute.rs | 21 | /// | COMMENT |
| LOW | src/hyperlight_component_util/src/substitute.rs | 281 | COMMENT | |
| LOW | src/hyperlight_component_util/src/substitute.rs | 301 | /// The substitution which is being shifted | COMMENT |
| LOW | src/hyperlight_component_util/src/subtype.rs | 21 | /// A variant case that was expected was missing | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 121 | COMMENT | |
| LOW | src/hyperlight_component_util/src/emit.rs | 301 | /// The final variable offset (relative to s.var_offset) that | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 321 | pub root_mod: &'a mut Mod, | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 341 | /// currently processing | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 361 | pub vars_needs_vars: &'a mut VecDeque<BTreeSet<u32>>, | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 381 | /// can. However, it may be the case that referring to a tyvar | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 401 | pub is_impl: bool, | COMMENT |
| LOW | src/hyperlight_component_util/src/emit.rs | 681 | m = m.submod(i.clone()); | COMMENT |
| LOW | src/hyperlight_component_util/src/component.rs | 41 | } | COMMENT |
| LOW | src/hyperlight_component_util/src/hl.rs | 21 | .join("::") | COMMENT |
| LOW | src/hyperlight_component_util/src/hl.rs | 341 | quote! { | COMMENT |
| LOW | src/hyperlight_component_util/src/elaborate.rs | 81 | } | COMMENT |
| LOW | src/hyperlight_component_util/src/elaborate.rs | 101 | /// to a resource type (either a bare resource, or, more usually, | COMMENT |
| LOW | src/hyperlight_host/build.rs | 161 | // writable/un-shared snapshot memories. | COMMENT |
| LOW | src/hyperlight_host/tests/integration_test.rs | 1381 | COMMENT | |
| LOW | src/hyperlight_host/tests/integration_test.rs | 1841 | handle.join().unwrap(); | COMMENT |
| LOW | src/hyperlight_host/tests/integration_test.rs | 1921 | }; | COMMENT |
| LOW | …erlight_host/tests/snapshot_goldens/goldens_version.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_host/tests/snapshot_goldens/platform.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_host/examples/ballast/main.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_host/examples/map-file-cow-test/main.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 1 | // SPDX-License-Identifier: Apache-2.0 | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 21 | //! that bypasses the guest's exception handler (e.g., writing to a | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 41 | //! hardware faults (page faults, undefined instructions, etc.) and reports them | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 101 | // ----------------------------------------------------------------------- | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 121 | /// | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 181 | /// When the guest triggers a CPU exception that its IDT handles (e.g., an | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 261 | /// Prints information about the on-demand crash dump API. | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 281 | /// | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 301 | // output contains the expected register values and mapped memory content. | COMMENT |
| LOW | src/hyperlight_host/examples/crashdump/main.rs | 481 | /// As an independent check on the underlying mechanism, this also reads | COMMENT |
| LOW | src/hyperlight_host/src/error.rs | 81 | #[error("Guest error occurred {0:?}: {1}")] | COMMENT |
| LOW | src/hyperlight_host/src/error.rs | 141 | COMMENT | |
| LOW | src/hyperlight_host/src/error.rs | 161 | NoHypervisorFound(), | COMMENT |
| LOW | src/hyperlight_host/src/error.rs | 181 | /// | COMMENT |
| LOW | src/hyperlight_host/src/error.rs | 201 | #[error("Raw pointer ({0:?}) was less than the base address ({1})")] | COMMENT |
| LOW | src/hyperlight_host/src/error.rs | 301 | }; | COMMENT |
| 346 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 17 | //! ┌─────────┐ (AVAIL=wrap) ┌───────────┐ | COMMENT |
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 18 | //! │ Free │ ──────────────────> │ Available │ | COMMENT |
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 19 | //! └─────────┘ └───────────┘ | COMMENT |
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 25 | //! ┌─────────┐ ┌───────────┐ | COMMENT |
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 26 | //! │Reclaimed│ <────────────────── │ Used │ | COMMENT |
| MEDIUM⚡ | src/hyperlight_common/src/virtq/ring.rs | 27 | //! └─────────┘ └───────────┘ | COMMENT |
| MEDIUM | src/hyperlight_common/src/virtq/ring.rs | 46 | //! ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ | COMMENT |
| MEDIUM | src/hyperlight_common/src/virtq/ring.rs | 51 | //! └──────────────┘ └──────────────┘ └──────────────┘ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/dep_update_guest_locks.yml | 114 | # Create a new tree with the updated files | COMMENT |
| MEDIUM⚡ | dev/check-license-headers.sh | 8 | # Define the license patterns to look for | COMMENT |
| MEDIUM⚡ | dev/check-license-headers.sh | 12 | # Define the full license header for files that need it | COMMENT |
| MEDIUM⚡ | dev/check-license-headers.sh | 18 | # Initialize a variable to track missing headers | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/ReleaseBlockerLabelCleanUp.yml | 22 | # Check if the issue has the release-blocker label | COMMENT |
| LOW | .github/workflows/dep_update_guest_locks.yml | 84 | # Check if there are any changes to the guest Cargo.lock file | COMMENT |
| LOW | dev/sync-project-board.sh | 65 | # Check if repo has 'hyperlight' in the name | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 9 | # Check if repository argument is provided | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 40 | # Check if PR only modifies allowed files | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 56 | # Check if all status checks have passed (regardless of required or not) | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 105 | # Check if PR has been modified by someone other than dependabot | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 114 | # Check if PR needs approval (i.e., hasn't been approved already) | COMMENT |
| LOW | dev/auto-approve-dependabot.sh | 125 | # Check if PR is up-to-date with base branch | COMMENT |
| LOW | dev/check-release-blockers.sh | 22 | # Check if repository argument is provided | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/how-to-run-coverage.md | 16 | ### Step 1: Run tests with coverage instrumentation | COMMENT |
| LOW | docs/how-to-run-coverage.md | 32 | ### Step 2: Generate a report | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 38 | // Step 1: Send abort code (typically 1 byte, but `code` allows flexibility) | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 41 | // Step 2: Convert the C string to bytes | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 44 | // Step 3: Send the message itself in chunks | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 47 | // Step 4: Send abort terminator to signal completion (e.g., 0xFF) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/hyperlight_host/examples/guest-debugging/main.rs | 24 | // Note: the host function is unused, it's just here for demonstration purposes | COMMENT |
| MEDIUM | src/hyperlight_host/examples/hello-world/main.rs | 9 | // Note: the host function is unused, it's just here for demonstration purposes | COMMENT |
| MEDIUM | src/hyperlight_host/src/mem/shared_mem.rs | 1129 | /// racing loads in LLVM return `undef`, as discussed above, we would | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 38 | // Step 1: Send abort code (typically 1 byte, but `code` allows flexibility) | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 41 | // Step 2: Convert the C string to bytes | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 44 | // Step 3: Send the message itself in chunks | COMMENT |
| LOW⚡ | src/hyperlight_guest/src/exit.rs | 47 | // Step 4: Send abort terminator to signal completion (e.g., 0xFF) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/hyperlight_host/Cargo.toml | 156 | # Custom harness (see main.rs). | STRING |
| MEDIUM | src/hyperlight_host/build.rs | 150 | // Essentially the kvm and mshv3 features are ignored on windows as long as you use #[cfg(kvm)] and not #[cfg(featur | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/hyperlight_host/tests/integration_test.rs | 436 | let abort_message = "Lorem ipsum dolor sit amet, \ | CODE |
| LOW | src/hyperlight_host/tests/integration_test.rs | 436 | let abort_message = "Lorem ipsum dolor sit amet, \ | CODE |
| LOW | src/hyperlight_host/tests/integration_test.rs | 452 | Dolor sit amet consectetur adipiscing elit pellentesque habitant morbi. \ | CODE |
| LOW | src/hyperlight_host/tests/integration_test.rs | 464 | Proin sagittis nisl rhoncus mattis rhoncus urna. Magna eget est lorem ipsum."; | CODE |