AI Slop Code Risk Monitor

jackc/pgx

SlopCodeMonitor badge for jackc/pgx Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

PostgreSQL driver and toolkit for Go

1.0 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for jackc/pgx, a Go project with 14,369 GitHub stars. SynthScan examined 92,911 lines of code across 373 source files, recording 85 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 1.0 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.0
Adjusted Signal
1.0
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
14.4K
Stars
Go
Language
92.9K
Lines of Code
373
Files
85
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 83 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 4.7/100 · LOW

Which changes need focused human review? 85 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 83

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 85 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block80 hits · 80 pts
SeverityFileLineSnippetContext
LOWport-tamer.toml1# port-tamer — this project's TCP port allocation (https://github.com/jackc/port-tamer).COMMENT
LOWport-tamer.toml21#COMMENT
LOWbatch.go121 //COMMENT
LOWvalues_test.go1021// expected []anyCOMMENT
LOWvalues_test.go1041// var actual []anyCOMMENT
LOWmise.toml21# by the devcontainer, so `golangci-lint run ./...` only worked if you had installed it yourself.COMMENT
LOWmise.toml41#COMMENT
LOWtest.sh1#!/usr/bin/env bashCOMMENT
LOWrows.go21// and [Rows.CommandTag].COMMENT
LOWrows.go41 // when there was an error executing the query.COMMENT
LOWrows.go81// Row is a convenience wrapper over [Rows] that is returned by [Conn.QueryRow].COMMENT
LOWprocess-compose.yaml1# process-compose — the long-running half of this checkout's development environment.COMMENT
LOWprocess-compose.yaml21# PGX_LOGS_DIR DevPaths::LOGS_DIR — the layout belongs to that module, not to ten literalsCOMMENT
LOWprocess-compose.yaml61 # SIGINT is PostgreSQL's fast shutdown: roll back open transactions and exit, rather thanCOMMENT
LOWconn.go221COMMENT
LOWconn.go661 QueryExecModeCacheStatementCOMMENT
LOWconn.go681 //COMMENT
LOWconn.go741// determine if the query executed successfully.COMMENT
LOWpgproto3/frontend.go61 authType uint32COMMENT
LOWpgproto3/doc.go1// Package pgproto3 is an encoder and decoder of the PostgreSQL wire protocol version 3.COMMENT
LOWpgconn/config.go61COMMENT
LOWpgconn/config.go101 // MinProtocolVersion is the minimum acceptable PostgreSQL protocol version.COMMENT
LOWpgconn/config.go141 return kCOMMENT
LOWpgconn/config.go161 // repeated parameter.COMMENT
LOWpgconn/config.go241 address = filepath.Join(host, ".s.PGSQL.") + strconv.FormatInt(int64(port), 10)COMMENT
LOWpgconn/config.go261// The returned *Config may be modified. However, it is strongly recommended that any configuration that can be doneCOMMENT
LOWpgconn/config.go281// PGPASSFILECOMMENT
LOWpgconn/config.go301//COMMENT
LOWpgconn/config.go321// sslmode, so an attacker who controls servicefile and service can redirect the connection. If any portion of theCOMMENT
LOWpgconn/config.go341// password fields, while libpq quotes the failing input verbatim. This redaction is best effort. An invalid connectionCOMMENT
LOWpgconn/auth_scram.go1// SCRAM-SHA-256 and SCRAM-SHA-256-PLUS authenticationCOMMENT
LOWpgconn/defaults_windows.go21// %HOMEDRIVE%+%HOMEPATH%) on this platform; it never calls into the WindowsCOMMENT
LOWpgconn/defaults_windows.go81}COMMENT
LOWpgconn/pgconn.go61// false on any FATAL-severity errors. This will not receive network errors. The *PgConn is provided so the handler isCOMMENT
LOWpgconn/pgconn.go861 }()COMMENT
LOWpgconn/pgconn.go1301 }COMMENT
LOWpgconn/pgconn.go1361 return resultCOMMENT
LOWpgconn/pgconn.go2221// Ping pings the server. This can be useful because a TCP connection can be broken such that a write will appear toCOMMENT
LOWpgconn/pgconn.go2381//COMMENT
LOWpgconn/config_security_home_dir_test.go21// defaults lookup (default user, passfile, servicefile, sslcert, sslkey,COMMENT
LOWpgconn/config_security_home_dir_test.go81COMMENT
LOWpgconn/defaults.go21// os.UserHomeDir only reads the $HOME environment variable on this platform;COMMENT
LOWpgconn/defaults.go61 }COMMENT
LOWpgconn/parse_keyword_value_test.go61// FuzzParseKeywordValueSettings checks that parseKeywordValueSettings neverCOMMENT
LOWpgconn/parse_url.go1package pgconnCOMMENT
LOWpgconn/parse_url.go21// of failing the parse.COMMENT
LOWpgconn/parse_url.go41 // sawRawSSLKey / sawSSLTrueAlias / sawExplicitSSLModeKey record whichCOMMENT
LOWpgconn/benchmark_test.go221 if rowCount != 1 {COMMENT
LOWpgconn/pgconn_test.go5741COMMENT
LOWpgconn/errors.go261// every password position -- the userinfo password and password/sslpasswordCOMMENT
LOWpgconn/errors.go301 // land there in malformed URIs: an unencoded '/' or '?' in a userinfoCOMMENT
LOWpgxpool/pool.go121type Config struct {COMMENT
LOWpgxpool/pool.go141 // query will fail with the returned error.COMMENT
LOWpgxpool/pool.go181COMMENT
LOWpgxpool/pool.go361// - pool_health_check_period: duration string (default 1 minute)COMMENT
LOWpgtype/datetime_text.go1package pgtypeCOMMENT
LOWpgtype/datetime_text.go21// zero and never carry trailing zeros. This is only the shape the server emits under theCOMMENT
LOWpgtype/text_test.go81}COMMENT
LOWpgtype/tid.go21//COMMENT
LOWinternal/pgdatetime/pgdatetime.go1// Package pgdatetime writes PostgreSQL's ISO date/time text format.COMMENT
20 more matches not shown…
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUM.devcontainer/post-create.bash10# Create a symlink to the shared .scratch directory for temporary files if it exists.COMMENT
MEDIUMscripts/lib/dev_paths.rb94 # Create the socket directory, private to this user, and refuse to use one that is not.COMMENT
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippetContext
LOWrows_test.go1031 SELECT 1 AS user_id, 'John Doe' AS nameCODE
LOWrows_test.go1041 assert.ElementsMatch(t, slice, []UserAPIKey{{UserAPIKeyID: 101, UserID: 1, User: &User{UserID: 1, Name: "John Doe"}, ACODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWinternal/sanitize/benchmark.sh14# Check if there are uncommitted changesCOMMENT