3.5

Adjusted Signal

3.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

38.5K

Stars

Language

839.2K

Lines of Code

5.6K

Files

2.7K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 15.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 2680 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 17 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 6 finding(s).

PR Review Velocity Impact 15.8/100 · LOW

Which changes need focused human review? 2697 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 5HIGH 1MEDIUM 75LOW 2616

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 2697 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block2562 hits · 2552 pts

Severity	File	Line	Snippet	Context
LOW	prow/integ-suite-kind.sh	1	#!/bin/bash	COMMENT
LOW	prow/release-commit.sh	1	#!/bin/bash	COMMENT
LOW	prow/lib.sh	1	#!/bin/bash	COMMENT
LOW	prow/release-test.sh	1	#!/bin/bash	COMMENT
LOW	prow/benchtest.sh	1	#!/bin/bash	COMMENT
LOW	prow/coverage.sh	1	#!/bin/bash	COMMENT
LOW	tools/build-base-images.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tools/build-kind-image.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tools/dump-docker-logs.sh	1	#!/bin/bash	COMMENT
LOW	tools/skip-image.sh	1	#!/bin/bash	COMMENT
LOW	tools/convert_RbacConfig_to_ClusterRbacConfig.sh	1	#!/bin/bash	COMMENT
LOW	tools/docker-copy.sh	1	#!/bin/bash	COMMENT
LOW	tools/gen_istio_image_list.sh	1	#!/bin/bash	COMMENT
LOW	tools/dump_kubernetes.sh	1	#!/bin/bash	COMMENT
LOW	tools/commonfiles-postprocess.sh	1	#!/bin/bash	COMMENT
LOW	tools/packaging/postinst.sh	1	#!/bin/bash	COMMENT
LOW	tools/packaging/common/istio-start.sh	1	#!/bin/bash	COMMENT
LOW	tools/istio-nftables/pkg/capture/run.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-nftables/pkg/capture/run_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-nftables/pkg/capture/run_linux_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-nftables/pkg/nft/program.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-nftables/pkg/constants/constants.go	1	// Copyright Istio Authors	COMMENT
LOW	…ls/istio-nftables/pkg/builder/nftables_builder_impl.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-nftables/pkg/builder/nftables_api.go	1	// Copyright Istio Authors	COMMENT
LOW	…ls/istio-nftables/pkg/builder/nftables_builder_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/lint/helm-values-proto/lint.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/docker.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/docker.go	41	// construct a big build plan which docker can execute in parallel. This provides order of magnitude	COMMENT
LOW	tools/docker-builder/types.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/crane.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/crane.go	41	// the configured base image, and add a new layer for all the copies. This layer is constructed in a	COMMENT
LOW	tools/docker-builder/common.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/main.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/dockerfile/parse.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/builder/tar.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/docker-builder/builder/crane.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/cmd/root.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/capture/run.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/capture/run_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/capture/helper.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/capture/run_linux_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/constants/constants.go	1	// Copyright Istio Authors	COMMENT
LOW	…istio-iptables/pkg/dependencies/implementation_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/dependencies/interface.go	1	// Copyright Istio Authors	COMMENT
LOW	…ptables/pkg/dependencies/implementation_unspecified.go	1	//go:build !linux	COMMENT
LOW	tools/istio-iptables/pkg/dependencies/implementation.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/dependencies/implementation.go	121	// It is not sufficient to check for the presence of one binary or the other in $PATH -	COMMENT
LOW	…iptables/pkg/dependencies/implementation_linux_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/dependencies/stub.go	1	// Copyright Istio Authors	COMMENT
LOW	…stio-iptables/pkg/dependencies/implementation_linux.go	1	// Copyright Istio Authors	COMMENT
LOW	…stio-iptables/pkg/dependencies/implementation_linux.go	201	// In CNI, we are running the pod network namespace, but the host filesystem. Locking the host is both useless and har	COMMENT
LOW	…ls/istio-iptables/pkg/builder/iptables_builder_test.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/builder/helper.go	1	// Copyright Istio Authors	COMMENT
LOW	…ls/istio-iptables/pkg/builder/iptables_builder_impl.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/validation/vld.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/validation/validator.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/validation/vld_unix.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/istio-iptables/pkg/validation/vld_unspecified.go	1	//go:build !unix	COMMENT
LOW	tools/common/config/config.go	1	// Copyright Istio Authors	COMMENT
LOW	tools/common/config/config_other.go	1	//go:build !linux	COMMENT
2502 more matches not shown…

Self-Referential Comments40 hits · 126 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	tests/testdata/certs/generate.sh	137	# Create a certificate authority	COMMENT
MEDIUM⚡	tests/testdata/certs/generate.sh	146	# Create a server certificate	COMMENT
MEDIUM⚡	tests/testdata/certs/generate.sh	151	# Create a client certificate	COMMENT
MEDIUM⚡	tests/testdata/certs/generate.sh	156	# Create a DNS client certificate	COMMENT
MEDIUM⚡	tests/testdata/certs/generate.sh	161	# Create a server certificate for MountedCerts test	COMMENT
MEDIUM⚡	tests/testdata/certs/generate.sh	166	# Create a client certificate for MountedCerts test	COMMENT
MEDIUM	…p-externalistiod-config-integration-test-defaults.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/iop-integration-test-defaults.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/create_cluster_gke.sh	107	# Create the cluster	COMMENT
MEDIUM	…tegration/iop-integration-test-defaults-with-quic.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/iop-wds.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	…-externalistiod-primary-integration-test-defaults.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/iop-ambient-test-defaults.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	…/integration/iop-remote-integration-test-defaults.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	…/integration/iop-remote-integration-test-gateways.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/base-clustertrustbundle.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	tests/integration/base.yaml	1	# This file provides some defaults for integration testing.	COMMENT
MEDIUM	samples/extauthz/local-ext-authz.yaml	17	# Define the service entry for the local ext-authz service on port 8000.	COMMENT
MEDIUM	samples/extauthz/local-ext-authz.yaml	33	# Define the service entry for the local ext-authz service on port 9000.	COMMENT
MEDIUM	samples/bookinfo/platform/kube/bookinfo-dualstack.yaml	16	# This file defines the services, service accounts, and deployments for the Bookinfo sample.	COMMENT
MEDIUM	samples/bookinfo/platform/kube/bookinfo.yaml	16	# This file defines the services, service accounts, and deployments for the Bookinfo sample.	COMMENT
MEDIUM	samples/bookinfo/platform/kube/bookinfo-psa.yaml	16	# This file defines the same services, service accounts, and deployments as bookinfo.yaml with	COMMENT
MEDIUM	common/scripts/kind_provisioner.sh	310	# Create the clusters. Retry to handle port-allocation races when creating clusters in parallel.	COMMENT
MEDIUM	common/scripts/setup_env.sh	165	# This function is designed for maximum compatibility with various platforms. This runs on	COMMENT
MEDIUM	istioctl/pkg/kubeinject/kubeinject.go	496	# Create a persistent version of the deployment with Istio sidecar injected.	COMMENT
MEDIUM	istioctl/pkg/multicluster/remote_secret.go	97	Example: ` # Create a secret to access cluster c0's apiserver and install it in cluster c1.	CODE
MEDIUM	istioctl/pkg/multicluster/remote_secret.go	105	# Create a secret access a remote cluster with an auth plugin	COMMENT
MEDIUM	istioctl/pkg/multicluster/remote_secret.go	484	outputHeader = "# This file is autogenerated, do not edit.\n"	CODE
MEDIUM	istioctl/pkg/multicluster/remote_secret_test.go	115	return fmt.Sprintf(`# This file is autogenerated, do not edit.	CODE
MEDIUM	istioctl/pkg/multicluster/remote_secret_test.go	148	return fmt.Sprintf(`# This file is autogenerated, do not edit.	CODE
MEDIUM	istioctl/pkg/multicluster/remote_secret_test.go	644	want := `# This file is autogenerated, do not edit.	CODE
MEDIUM	istioctl/pkg/tag/tag.go	118	Example: ` # Create a revision tag from the "1-8-0" revision	CODE
MEDIUM	istioctl/pkg/tag/tag.go	171	Example: ` # Create a revision tag from the "1-8-0" revision	CODE
MEDIUM	…fests/charts/istio-control/istio-discovery/values.yaml	574	# Define the security context for the pod.	COMMENT
MEDIUM	…-discovery/templates/remote-istiod-endpointslices.yaml	9	# This file is only used for remote `istiod` installs.	COMMENT
MEDIUM	…l/istio-discovery/templates/remote-istiod-service.yaml	2	# This file is only used for remote	COMMENT
MEDIUM	manifests/charts/gateway/values.yaml	36	# Define the security context for the pod.	COMMENT
MEDIUM⚡	pkg/testcerts/generate-certs.sh	56	# Create a certificate authority	COMMENT
MEDIUM⚡	pkg/testcerts/generate-certs.sh	60	# Create a server certificate	COMMENT
MEDIUM⚡	pkg/testcerts/generate-certs.sh	65	# Create a client certificate	COMMENT

AI Slop Vocabulary41 hits · 106 pts

Severity	File	Line	Snippet	Context
LOW	prow/release-commit.sh	51	# If not specified, we can just create a temporary directory	COMMENT
MEDIUM	tools/bug-report/pkg/bugreport/bugreport.go	427	// TODO(stewartbutler): output the logs to a more robust/complete structure.	COMMENT
LOW	tests/integration/security/fuzz/fuzzers/jwt_tool/run.sh	18	# The jwt_tool.py always return non-zero exit code, overwrite to just return zero as the test code will check the report	COMMENT
LOW	…sts/integration/security/fuzz/fuzzers/dotdotpwn/run.sh	18	# The dotdotpwn.pl always return non-zero exit code, overwrite to just return zero as the test code will check the repor	COMMENT
MEDIUM	tests/integration/ambient/main_test.go	48	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	tests/integration/ambient/cnirepair/main_test.go	43	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	tests/integration/ambient/cni/main_test.go	52	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	tests/integration/ambient/cniupgrade/main_test.go	46	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	tests/integration/pilot/main_test.go	31	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	tests/integration/pilot/agentgateway/main_test.go	32	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	…egration/pilot/localwatcher/localsecretwatcher_test.go	33	// Below are various preconfigured echo deployments. Whenever possible, tests should utilize these	COMMENT
MEDIUM	pilot/pkg/security/authz/builder/builder.go	462	// can utilize these metadata to trigger the enforcement conditionally.	COMMENT
MEDIUM	…/pkg/networking/core/loadbalancer/loadbalancer_test.go	856	// TODO Below assertions are not robust to ordering changes in cluster.LoadAssignment.Endpoints[i]	COMMENT
MEDIUM	…/pkg/networking/core/loadbalancer/loadbalancer_test.go	1009	// TODO Below assertions are not robust to ordering changes in cluster.LoadAssignment.Endpoints[i]	COMMENT
MEDIUM	…/pkg/networking/core/loadbalancer/loadbalancer_test.go	1167	// TODO Below assertions are not robust to ordering changes in cluster.LoadAssignment.Endpoints[i]	COMMENT
MEDIUM	pilot/pkg/model/endpointshards.go	354	// completed until after a response after the update. Essentially, we transition from v0 -> v1 ->	COMMENT
LOW	manifests/charts/ztunnel/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	manifests/charts/istio-cni/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	manifests/charts/default/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	manifests/charts/gateways/istio-egress/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	manifests/charts/gateways/istio-ingress/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	…fests/charts/istio-control/istio-discovery/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
MEDIUM	…fests/charts/istio-control/istio-discovery/values.yaml	190	# to utilize a remote instance.	COMMENT
LOW	manifests/charts/base/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
LOW	manifests/charts/gateway/values.yaml	2	# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.	COMMENT
MEDIUM	pkg/test/framework/components/echo/config.go	376	// TODO this can be more robust to not require labeling initial echo config (check namespace + isWaypoint + not sidecar	COMMENT
MEDIUM	pkg/security/security.go	76	// SDSExternalCredentialPrefix is the prefix for the credentialName which will utilize external SDS connections defined	COMMENT
MEDIUM	pkg/istio-agent/xds_proxy_test.go	346	// this ensures we are robust against cases where envoy rapidly disconnects and reconnects	COMMENT
MEDIUM	pkg/kube/krt/collection.go	151	// Where possible, we utilize the reverse-indexing to get the precise list of potentially changed objects.	COMMENT
MEDIUM	pkg/kube/multicluster/secretcontroller_test.go	546	// Test our (lack of) ability to do seamless updates of a cluster.	COMMENT
MEDIUM	pkg/kube/multicluster/secretcontroller_test.go	578	// If this is an update and we have a previous component, use seamless migration	COMMENT
MEDIUM	pkg/kube/multicluster/secretcontroller_test.go	621	// With seamless migration implemented, we should get 'delete/initial, add/later, update/common'.	COMMENT
MEDIUM	pkg/kube/multicluster/secretcontroller_test.go	622	// The test should fail until seamless migration properly implements UPDATE events for objects that exist in both old a	COMMENT
MEDIUM	pkg/kube/multicluster/secretcontroller.go	253	// During a cluster update, a new component is constructed before the old one is removed for seamless migration.	COMMENT
MEDIUM	pkg/kube/multicluster/cluster.go	164	// for seamless migration (comparing old vs new state).	COMMENT
MEDIUM	pkg/kube/multicluster/component.go	80	// until the new one has synced, ensuring seamless access without gaps.	COMMENT
MEDIUM	pkg/kube/multicluster/component.go	85	// New component hasn't synced yet, return old component for seamless access	COMMENT
MEDIUM	pkg/kube/multicluster/component.go	136	// Store old component temporarily so constructor can access it for seamless migration	COMMENT
MEDIUM	pkg/kube/multicluster/component.go	225	// wrappedEventHandler wraps an event handler to provide seamless migration during cluster updates.	COMMENT
MEDIUM	pkg/kube/multicluster/component.go	238	// This ensures that components consuming these events see a seamless transition without unnecessary	COMMENT
MEDIUM	pkg/kube/controllers/common.go	38	// Object is a union of runtime + meta objects. Essentially every k8s object meets this interface.	COMMENT

Hallucination Indicators5 hits · 50 pts

Severity	File	Line	Snippet	Context
CRITICAL	istioctl/pkg/describe/describe.go	306	printSpaces(initPrintNum+printLevel1), dr.Spec.TrafficPolicy.Tls.Mode.String())	CODE
CRITICAL	operator/pkg/webhook/webhook.go	167	if names.Contains(m.Resource.Metadata.FullName.Name.String()) {	CODE
CRITICAL	operator/pkg/apis/validation/validation.go	87	cniEnabled := iop.Spec.Components != nil && iop.Spec.Components.Cni != nil && iop.Spec.Components.Cni.Enabled.GetValueO	CODE
CRITICAL	operator/pkg/apis/validation/validation.go	88	ztunnelEnabled := iop.Spec.Components != nil && iop.Spec.Components.Ztunnel != nil && iop.Spec.Components.Ztunnel.Enabl	CODE
CRITICAL	pkg/ctrlz/assets/static/js/jquery-3.2.1.slim.min.js	3	}),this},r.extend({isReady:!1,readyWait:1,ready:function(a){(a===!0?--r.readyWait:r.isReady)\|\|(r.isReady=!0,a!==!0&&--r.	CODE

Redundant / Tautological Comments7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	prow/integ-suite-kind.sh	261	# Check if the user is running the clusters in manual mode.	COMMENT
LOW	…integration/security/fuzz/fuzzers/jwt_tool/jwtconf.ini	12	# Set this to the URL you are hosting your custom JWKS file - your own server, or maybe use this cheeky reflective URL (	COMMENT
LOW	…integration/security/fuzz/fuzzers/jwt_tool/jwtconf.ini	14	# Set this to the base URL of a Collaborator server, somewhere you can read live logs, a Request Bin etc.	COMMENT
LOW	release/downloadIstioCtl.sh	136	# Print message	COMMENT
LOW	istioctl/pkg/kubeinject/testdata/mesh-config.yaml	1	# Set enableTracing to false to disable request tracing.	COMMENT
LOW	istioctl/pkg/kubeinject/testdata/istio-operator.yaml	8	# Set enableTracing to false to disable request tracing.	COMMENT
LOW	manifests/charts/gateways/istio-egress/values.yaml	70	# Set this to "external" if and only if you want the egress gateway to	COMMENT

TODO Padding7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	cni/cmd/istio-cni/main.go	51	// TODO: implement plugin version	COMMENT
LOW	pilot/pkg/model/push_context.go	957	"sds", // TODO: implement this	CODE
LOW	pilot/pkg/model/push_context.go	1015	// TODO: implement SDS provider	COMMENT
LOW	pilot/pkg/xds/workload_test.go	362	// TODO: implement pod update; this actually cannot really be done without waypoints or VIPs	COMMENT
LOW	pilot/pkg/xds/workload_test.go	427	// TODO: implement pod update; this actually cannot really be done without waypoints or VIPs	COMMENT
LOW	pilot/pkg/xds/proxy_dependencies.go	129	// TODO: implement ambient aware scoping	COMMENT
LOW	pkg/adsc/adsc.go	103	// TODO: implement SecretManager for cert dir	COMMENT

Modern AI Meta-Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/istio-iptables/pkg/capture/run.go	664	// Apply safety guardrails	COMMENT
MEDIUM	cni/pkg/iptables/iptables.go	484	// Apply safety guardrails	COMMENT
MEDIUM	pkg/test/csrctrl/controllers/start_csrctrl.go	24	// +kubebuilder:scaffold:imports	COMMENT

Structural Annotation Overuse6 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	tests/integration/GKE.md	7	## Step 1: Set up GCP	COMMENT
LOW	tests/integration/GKE.md	38	## Step 2: Set up a cluster	COMMENT
LOW	tests/integration/GKE.md	91	## Step 3: Set up Istio environment variables	COMMENT
LOW	pilot/pkg/config/kube/crd/conversion.go	205	// NOTE: This function only decodes a subset of the complete k8s	COMMENT
LOW	pkg/config/validation/validation.go	2234	// NOTE: This method identical to analyzeUnreachableHTTPRules.	COMMENT
LOW	pkg/config/validation/validation.go	2272	// NOTE: This method identical to analyzeUnreachableHTTPRules.	COMMENT

Slop Phrases3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/testdata/config/none.yaml	9	# This is the first test using the new isolated model, you can use it as a template to create more	COMMENT
MEDIUM	…/bookinfo/platform/kube/bookinfo-ratings-v2-mysql.yaml	40	# if you would like to use mysqldb then you can use this file	COMMENT
LOW	istioctl/pkg/kubeinject/testdata/mesh-config.yaml	7	# NOTE: If you change any values in this section, make sure to make	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	cni/pkg/nodeagent/server_linux.go	67	// Error while detecting the artifacts. Default to nftables (as requested) for a fail-safe behavior.	COMMENT

Unused Imports6 hits · 6 pts

Severity	File	Line	Context
LOW	bin/diff_yaml.py	20	CODE
LOW	security/tools/jwt/sa-jwt.py	22	CODE
LOW	security/tools/jwt/samples/gen-jwt.py	22	CODE
LOW	samples/helloworld/src/app.py	19	CODE
LOW	samples/bookinfo/src/productpage/productpage.py	17	CODE
LOW	samples/bookinfo/src/productpage/productpage.py	18	CODE

Fake / Example Data6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	security/pkg/credentialfetcher/plugin/mock_test.go	26	const fakeTokenPrefix = "fake-token-"	CODE
LOW	…/bookinfo/src/productpage/static/tailwind/tailwind.css	25	`),x=y.length-1,x>0?(k=s+x,S=w-y[x].length):(k=s,S=a),E=O.comment,s=k,p=k,d=w-S):c===O.slash?(w=o,E=c,p=s,d=o-a,u=w+1):(	CODE
LOW	pilot/pkg/networking/core/cluster_tls_test.go	1073	PrivateKey: "some-fake-key",	CODE
LOW	…stdata/manifest-generate/input/pilot_env_var_from.yaml	15	key: fake-key	CODE
LOW	…anifest-generate/output/pilot_env_var_from.golden.yaml	84	key: fake-key	CODE
LOW	…analyzers/testdata/telemetry-lightstep-meshconfig.yaml	6	accessToken: "fake-token"	CODE

Hyper-Verbose Identifiers5 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	samples/bookinfo/src/ratings/ratings.js	229	function getLocalReviewsSuccessful(res, productId) {	CODE
LOW	samples/bookinfo/src/ratings/ratings.js	234	function getLocalReviewsServiceUnavailable(res) {	CODE
LOW	samples/bookinfo/src/details/details.rb	84	def fetch_details_from_external_service(isbn, id, headers)	CODE
LOW	…ookinfo/src/productpage/tests/unit/test_productpage.py	34	def test_header_propagation_reviews(self, m):	CODE
LOW	…ookinfo/src/productpage/tests/unit/test_productpage.py	62	def test_header_propagation_ratings(self, m):	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	samples/addons/extras/prometheus-secure-metrics.yaml	6	# Usage:	COMMENT
LOW	pkg/kube/krt/krttest/helpers.go	35	// Example usage:	COMMENT

AI Structural Patterns1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	bin/diff_yaml.py	107		CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	security/tools/jwt/samples/gen-jwt.py	30		CODE

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	samples/bookinfo/src/ratings/ratings.js	252	function handleRequest (request, response) {	CODE

istio/istio

Open-Source Code Quality, Security and Technical Debt Review