PostgreSQL driver and toolkit for Go
This report summarizes scanner evidence for jackc/pgx, a Go project with 14,369 GitHub stars. SynthScan examined 92,911 lines of code across 373 source files, recording 85 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 1.0 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 83 finding(s).
Are imports declared and package/API names verified? 2 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 85 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 85 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | port-tamer.toml | 1 | # port-tamer — this project's TCP port allocation (https://github.com/jackc/port-tamer). | COMMENT |
| LOW | port-tamer.toml | 21 | # | COMMENT |
| LOW | batch.go | 121 | // | COMMENT |
| LOW | values_test.go | 1021 | // expected []any | COMMENT |
| LOW | values_test.go | 1041 | // var actual []any | COMMENT |
| LOW | mise.toml | 21 | # by the devcontainer, so `golangci-lint run ./...` only worked if you had installed it yourself. | COMMENT |
| LOW | mise.toml | 41 | # | COMMENT |
| LOW | test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | rows.go | 21 | // and [Rows.CommandTag]. | COMMENT |
| LOW | rows.go | 41 | // when there was an error executing the query. | COMMENT |
| LOW | rows.go | 81 | // Row is a convenience wrapper over [Rows] that is returned by [Conn.QueryRow]. | COMMENT |
| LOW | process-compose.yaml | 1 | # process-compose — the long-running half of this checkout's development environment. | COMMENT |
| LOW | process-compose.yaml | 21 | # PGX_LOGS_DIR DevPaths::LOGS_DIR — the layout belongs to that module, not to ten literals | COMMENT |
| LOW | process-compose.yaml | 61 | # SIGINT is PostgreSQL's fast shutdown: roll back open transactions and exit, rather than | COMMENT |
| LOW | conn.go | 221 | COMMENT | |
| LOW | conn.go | 661 | QueryExecModeCacheStatement | COMMENT |
| LOW | conn.go | 681 | // | COMMENT |
| LOW | conn.go | 741 | // determine if the query executed successfully. | COMMENT |
| LOW | pgproto3/frontend.go | 61 | authType uint32 | COMMENT |
| LOW | pgproto3/doc.go | 1 | // Package pgproto3 is an encoder and decoder of the PostgreSQL wire protocol version 3. | COMMENT |
| LOW | pgconn/config.go | 61 | COMMENT | |
| LOW | pgconn/config.go | 101 | // MinProtocolVersion is the minimum acceptable PostgreSQL protocol version. | COMMENT |
| LOW | pgconn/config.go | 141 | return k | COMMENT |
| LOW | pgconn/config.go | 161 | // repeated parameter. | COMMENT |
| LOW | pgconn/config.go | 241 | address = filepath.Join(host, ".s.PGSQL.") + strconv.FormatInt(int64(port), 10) | COMMENT |
| LOW | pgconn/config.go | 261 | // The returned *Config may be modified. However, it is strongly recommended that any configuration that can be done | COMMENT |
| LOW | pgconn/config.go | 281 | // PGPASSFILE | COMMENT |
| LOW | pgconn/config.go | 301 | // | COMMENT |
| LOW | pgconn/config.go | 321 | // sslmode, so an attacker who controls servicefile and service can redirect the connection. If any portion of the | COMMENT |
| LOW | pgconn/config.go | 341 | // password fields, while libpq quotes the failing input verbatim. This redaction is best effort. An invalid connection | COMMENT |
| LOW | pgconn/auth_scram.go | 1 | // SCRAM-SHA-256 and SCRAM-SHA-256-PLUS authentication | COMMENT |
| LOW | pgconn/defaults_windows.go | 21 | // %HOMEDRIVE%+%HOMEPATH%) on this platform; it never calls into the Windows | COMMENT |
| LOW | pgconn/defaults_windows.go | 81 | } | COMMENT |
| LOW | pgconn/pgconn.go | 61 | // false on any FATAL-severity errors. This will not receive network errors. The *PgConn is provided so the handler is | COMMENT |
| LOW | pgconn/pgconn.go | 861 | }() | COMMENT |
| LOW | pgconn/pgconn.go | 1301 | } | COMMENT |
| LOW | pgconn/pgconn.go | 1361 | return result | COMMENT |
| LOW | pgconn/pgconn.go | 2221 | // Ping pings the server. This can be useful because a TCP connection can be broken such that a write will appear to | COMMENT |
| LOW | pgconn/pgconn.go | 2381 | // | COMMENT |
| LOW | pgconn/config_security_home_dir_test.go | 21 | // defaults lookup (default user, passfile, servicefile, sslcert, sslkey, | COMMENT |
| LOW | pgconn/config_security_home_dir_test.go | 81 | COMMENT | |
| LOW | pgconn/defaults.go | 21 | // os.UserHomeDir only reads the $HOME environment variable on this platform; | COMMENT |
| LOW | pgconn/defaults.go | 61 | } | COMMENT |
| LOW | pgconn/parse_keyword_value_test.go | 61 | // FuzzParseKeywordValueSettings checks that parseKeywordValueSettings never | COMMENT |
| LOW | pgconn/parse_url.go | 1 | package pgconn | COMMENT |
| LOW | pgconn/parse_url.go | 21 | // of failing the parse. | COMMENT |
| LOW | pgconn/parse_url.go | 41 | // sawRawSSLKey / sawSSLTrueAlias / sawExplicitSSLModeKey record which | COMMENT |
| LOW | pgconn/benchmark_test.go | 221 | if rowCount != 1 { | COMMENT |
| LOW | pgconn/pgconn_test.go | 5741 | COMMENT | |
| LOW | pgconn/errors.go | 261 | // every password position -- the userinfo password and password/sslpassword | COMMENT |
| LOW | pgconn/errors.go | 301 | // land there in malformed URIs: an unencoded '/' or '?' in a userinfo | COMMENT |
| LOW | pgxpool/pool.go | 121 | type Config struct { | COMMENT |
| LOW | pgxpool/pool.go | 141 | // query will fail with the returned error. | COMMENT |
| LOW | pgxpool/pool.go | 181 | COMMENT | |
| LOW | pgxpool/pool.go | 361 | // - pool_health_check_period: duration string (default 1 minute) | COMMENT |
| LOW | pgtype/datetime_text.go | 1 | package pgtype | COMMENT |
| LOW | pgtype/datetime_text.go | 21 | // zero and never carry trailing zeros. This is only the shape the server emits under the | COMMENT |
| LOW | pgtype/text_test.go | 81 | } | COMMENT |
| LOW | pgtype/tid.go | 21 | // | COMMENT |
| LOW | internal/pgdatetime/pgdatetime.go | 1 | // Package pgdatetime writes PostgreSQL's ISO date/time text format. | COMMENT |
| 20 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .devcontainer/post-create.bash | 10 | # Create a symlink to the shared .scratch directory for temporary files if it exists. | COMMENT |
| MEDIUM | scripts/lib/dev_paths.rb | 94 | # Create the socket directory, private to this user, and refuse to use one that is not. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | rows_test.go | 1031 | SELECT 1 AS user_id, 'John Doe' AS name | CODE |
| LOW | rows_test.go | 1041 | assert.ElementsMatch(t, slice, []UserAPIKey{{UserAPIKeyID: 101, UserID: 1, User: &User{UserID: 1, Name: "John Doe"}, A | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/sanitize/benchmark.sh | 14 | # Check if there are uncommitted changes | COMMENT |