2.7

Adjusted Signal

2.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

45.2K

Stars

Language

223.1K

Lines of Code

624

Files

563

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 491 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.5/100 · LOW

Are imports declared and package/API names verified? 72 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 12.0/100 · LOW

Which changes need focused human review? 563 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 3LOW 560

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 563 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block296 hits · 276 pts

Severity	File	Line	Snippet	Context
LOW	config-example.yaml	1	---	COMMENT
LOW	config-example.yaml	21	# Address to listen to /metrics and /debug, you may want	COMMENT
LOW	config-example.yaml	41	# List of IP prefixes to allocate tailaddresses from.	COMMENT
LOW	config-example.yaml	61	v6: fd7a:115c:a1e0::/48	COMMENT
LOW	config-example.yaml	81	# Region ID to use for the embedded DERP server.	COMMENT
LOW	config-example.yaml	121	# https://tailscale.com/docs/reference/derp-servers/custom-derp-servers	COMMENT
LOW	config-example.yaml	141	# Default key expiry for non-tagged nodes, regardless of registration method	COMMENT
LOW	config-example.yaml	161	# When HA routes exist (2+ nodes advertising the same prefix), headscale	COMMENT
LOW	config-example.yaml	201		COMMENT
LOW	config-example.yaml	221	# port: 5432	COMMENT
LOW	config-example.yaml	281		COMMENT
LOW	config-example.yaml	301	# https://tailscale.com/docs/reference/faq/dns-resolv-conf	COMMENT
LOW	config-example.yaml	341	# Set custom DNS search domains. With MagicDNS enabled,	COMMENT
LOW	config-example.yaml	361	# Let nodes get TLS certificates for their MagicDNS name with	COMMENT
LOW	config-example.yaml	381	# keys are settings of that provider; add _path to a key to read it from	COMMENT
LOW	config-example.yaml	401		COMMENT
LOW	config-example.yaml	421	# # Note: client_secret and client_secret_path are mutually exclusive.	COMMENT
LOW	config-example.yaml	441	# # default. Unverified emails may be allowed in case an identity provider	COMMENT
LOW	config-example.yaml	461	# allowed_groups:	COMMENT
LOW	config-example.yaml	481	# https://tailscale.com/docs/features/logging#opt-out-of-client-logging	COMMENT
LOW	config-example.yaml	501	# default. Setting it back to false flips the default for future	COMMENT
LOW	config-example.yaml	521	# # The NodeStore batches write operations before rebuilding peer relationships,	COMMENT
LOW	cmd/vendorhash/main.go	1	// vendorhash maintains the Nix SRI hash for the Go module vendor tree	COMMENT
LOW	cmd/gen-openapi/main.go	1	// Command gen-openapi emits a Headscale OpenAPI document from the authoritative	COMMENT
LOW	tools/bump/main.go	1	// Command bump keeps headscale's pinned versions current and puts the result	COMMENT
LOW	integration/auth_oidc_test.go	121	t.Fatalf("unexpected users: %s", diff)	COMMENT
LOW	integration/auth_oidc_test.go	1101	// - The same client logs back in via OIDC as the same user (user1)	COMMENT
LOW	integration/auth_oidc_test.go	1461	// https://github.com/juanfont/headscale/issues/2888	COMMENT
LOW	integration/auth_oidc_test.go	1741	assert.Equal(ct, "oidcuser", oidcUserFound.Name)	COMMENT
LOW	integration/ts2021_websocket_test.go	41	// client uses. It is fast and always on.	COMMENT
LOW	integration/auth_key_test.go	541	// after a node logs out and re-authenticates with the same user.	COMMENT
LOW	integration/acl_test.go	621	assertCurlDockerHostname(c, client, url, "Verifying user2 can reach user1")	COMMENT
LOW	integration/acl_test.go	641	// }, {	COMMENT
LOW	integration/acl_test.go	3121		COMMENT
LOW	integration/acl_test.go	3141	// 2. Create policy with group:admin = [user1@]	COMMENT
LOW	integration/acl_test.go	3301	t.Logf("Filter rules: %d", len(filter))	COMMENT
LOW	integration/auth_web_flow_test.go	381	// - Multiple clients authenticate via web flow, each to their respective users (user1, user2)	COMMENT
LOW	integration/tags_test.go	581	}	COMMENT
LOW	integration/tags_test.go	1261	}, integrationutil.ScaledTimeout(10*time.Second), integrationutil.SlowPoll, "admin tags should be preserved after --res	COMMENT
LOW	integration/tags_test.go	1381		COMMENT
LOW	integration/tags_test.go	3621	// owned tag. Because a tag-owned node has no user and its IP is in no owner	COMMENT
LOW	integration/route_test.go	2161	for _, node := range nodes {	COMMENT
LOW	integration/route_test.go	3861	// the route have been offline simultaneously and one of them returns.	COMMENT
LOW	integration/route_test.go	4061	return	COMMENT
LOW	integration/route_test.go	4281	// docker network disconnects — the same failure primitive nblock	COMMENT
LOW	integration/scenario.go	61		COMMENT
LOW	integration/scenario.go	121		COMMENT
LOW	integration/scenario.go	141		COMMENT
LOW	integration/scenario.go	161	// OIDCSkipUserCreation, if true, skips creating users via headscale CLI	COMMENT
LOW	integration/scenario.go	1801	// httpClient := &http.Client{}	COMMENT
LOW	integration/k8s_operator_test.go	41	Sources: []policyv2.Alias{policyv2.Wildcard},	COMMENT
LOW	integration/cli_policy_test.go	21	// - policyMode: server runs with policy_mode=file vs policy_mode=database.	COMMENT
LOW	integration/tsic/tsic.go	1621	// SaveLog saves the current stdout log of the container to a path	COMMENT
LOW	integration/wasmic/wasmclient/main.go	1	//go:build js	COMMENT
LOW	integration/k3sic/k3sic.go	1	// Package k3sic wraps a single-container k3s cluster (server + agent) as a	COMMENT
LOW	integration/k3sic/k3sic.go	221		COMMENT
LOW	integration/k3sic/k3sic.go	241		COMMENT
LOW	integration/k3sic/k3sic.go	461	// Proxy pods' tailscaled logs: DERP-connection and registration failures	COMMENT
LOW	gen/client/v1/client.gen.go	481	// Takes any type of body and a specified content type.	COMMENT
LOW	gen/client/v1/client.gen.go	501	//	COMMENT
236 more matches not shown…

Structural Annotation Overuse95 hits · 124 pts

Severity	File	Line	Snippet	Context
LOW	config-example.yaml	45	# WARNING: These prefixes MUST be subsets of the standard Tailscale ranges:	COMMENT
LOW	integration/auth_oidc_test.go	1837	// Step 1: Verify initial route is advertised, approved, and SERVING	COMMENT
LOW	integration/auth_oidc_test.go	1866	// Step 2: Logout	COMMENT
LOW	integration/auth_oidc_test.go	1888	// Step 3: Re-authenticate via OIDC as the same user	COMMENT
LOW	integration/auth_oidc_test.go	1906	// Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication	COMMENT
LOW	integration/auth_key_test.go	610	// Step 1: Verify initial route is advertised, approved, and SERVING	COMMENT
LOW	integration/auth_key_test.go	639	// Step 2: Logout	COMMENT
LOW	integration/auth_key_test.go	661	// Step 3: Re-authenticate with the SAME user (using auth key)	COMMENT
LOW	integration/auth_key_test.go	684	// Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication	COMMENT
LOW⚡	integration/acl_test.go	2809	// Step 1: Verify initial state - HTTP on port 80 should work with tag:webserver	COMMENT
LOW⚡	integration/acl_test.go	2815	// Step 2: Change tag from webserver to sshonly	COMMENT
LOW⚡	integration/acl_test.go	3275	// Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers]	COMMENT
LOW⚡	integration/acl_test.go	3282	// Step 5: THE CRITICAL TEST - verify connectivity STILL works	COMMENT
LOW	integration/acl_test.go	2573	// Step 1: Verify initial access state	COMMENT
LOW	integration/acl_test.go	2606	// Step 2: Apply tag change	COMMENT
LOW	integration/acl_test.go	2624	// Step 3: Verify final NetMap visibility first (fast signal that	COMMENT
LOW	integration/acl_test.go	2652	// Step 4: Verify final access state (this is the key test for #2389).	COMMENT
LOW	integration/acl_test.go	2836	// Step 3: Verify peer is still visible in NetMap (partial access, not full removal)	COMMENT
LOW	integration/acl_test.go	2855	// Step 4: Verify HTTP on port 80 now fails (tag:sshonly only allows port 22).	COMMENT
LOW	integration/acl_test.go	3051	// Step 1: Verify initial connectivity - all users can reach each other	COMMENT
LOW	integration/acl_test.go	3063	// Step 2: Get user3's node and user, then delete them	COMMENT
LOW	integration/acl_test.go	3088	// Step 3: Verify that user1 and user2 can still communicate (before triggering policy refresh)	COMMENT
LOW	integration/acl_test.go	3099	// Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] which	COMMENT
LOW	integration/acl_test.go	3111	// Step 5: THIS IS THE CRITICAL TEST - verify connectivity STILL works after	COMMENT
LOW	integration/acl_test.go	3228	// Step 1: Verify initial connectivity - user1 and user3 can ping each other	COMMENT
LOW	integration/acl_test.go	3242	// Step 2: Delete user2's node and user (like reporter deleting "deleteable")	COMMENT
LOW	integration/acl_test.go	3260	// Step 3: Verify connectivity still works after user2 deletion	COMMENT
LOW	integration/acl_test.go	3392	// Step 1: Verify initial connectivity with VALID policy	COMMENT
LOW	integration/acl_test.go	3406	// Step 2: DYNAMICALLY update policy to add unknown user	COMMENT
LOW	integration/acl_test.go	3436	// Step 3: THE CRITICAL TEST - verify connectivity STILL works	COMMENT
LOW	integration/acl_test.go	3540	// Step 1: Verify initial connectivity WITH unknown user in policy	COMMENT
LOW	integration/acl_test.go	3555	// Step 2: Update policy to REMOVE the unknown user	COMMENT
LOW	integration/acl_test.go	3584	// Step 3: Verify connectivity after removing unknown user	COMMENT
LOW⚡	integration/tags_test.go	3391	// Step 3: Register via CLI with user (the step that triggered the panic)	COMMENT
LOW⚡	integration/tags_test.go	3398	// Step 4: The tagged node stays and the user gets a device of its own. The	COMMENT
LOW	integration/tags_test.go	527	// Step 2: Admin assigns different tags via headscale CLI	COMMENT
LOW	integration/tags_test.go	549	// Step 3: Force reauthentication	COMMENT
LOW	integration/tags_test.go	858	// Step 2: Admin assigns multiple tags via headscale CLI	COMMENT
LOW	integration/tags_test.go	879	// Step 3: Attempt to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	1220	// Step 2: Admin assigns tags	COMMENT
LOW	integration/tags_test.go	1241	// Step 3: Run tailscale up with --reset	COMMENT
LOW	integration/tags_test.go	1339	// Step 2: Admin assigns tags	COMMENT
LOW	integration/tags_test.go	1360	// Step 3: Run tailscale up with empty --advertise-tags	COMMENT
LOW	integration/tags_test.go	1458	// Step 2: Admin assigns multiple tags	COMMENT
LOW	integration/tags_test.go	1479	// Step 3: Attempt to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	1757	// Step 1: Create and register with one tag	COMMENT
LOW	integration/tags_test.go	1787	// Step 2: Try to add second tag via CLI	COMMENT
LOW	integration/tags_test.go	1848	// Step 1: Create and register with two tags	COMMENT
LOW	integration/tags_test.go	1878	// Step 2: Try to remove second tag via CLI	COMMENT
LOW	integration/tags_test.go	1939	// Step 1: Register with one tag	COMMENT
LOW	integration/tags_test.go	1973	// Step 2: Admin assigns different tag	COMMENT
LOW	integration/tags_test.go	1993	// Step 3: Try to change tags via CLI	COMMENT
LOW	integration/tags_test.go	2056	// Step 1: Register with one tag	COMMENT
LOW	integration/tags_test.go	2089	// Step 2: Admin assigns both tags	COMMENT
LOW	integration/tags_test.go	2109	// Step 3: Try to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	2783	// Step 2: Admin changes tag to tag:second (FIRST CALL - this is "tag:bar" in issue terms)	COMMENT
LOW	integration/tags_test.go	2838	// Step 3: Call SetNodeTags AGAIN with the SAME tag (SECOND CALL)	COMMENT
LOW	integration/tags_test.go	2857	// Step 4: Do another tag change to verify the pattern repeats	COMMENT
LOW	integration/tags_test.go	2893	// Step 5: Call SetNodeTags AGAIN with the SAME tag	COMMENT
LOW	integration/tags_test.go	3043	// Step 1: Create and register a node with tags	COMMENT
35 more matches not shown…

Verbosity Indicators94 hits · 123 pts

Severity	File	Line	Snippet	Context
LOW	integration/auth_oidc_test.go	1837	// Step 1: Verify initial route is advertised, approved, and SERVING	COMMENT
LOW	integration/auth_oidc_test.go	1866	// Step 2: Logout	COMMENT
LOW	integration/auth_oidc_test.go	1888	// Step 3: Re-authenticate via OIDC as the same user	COMMENT
LOW	integration/auth_oidc_test.go	1906	// Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication	COMMENT
LOW	integration/auth_key_test.go	610	// Step 1: Verify initial route is advertised, approved, and SERVING	COMMENT
LOW	integration/auth_key_test.go	639	// Step 2: Logout	COMMENT
LOW	integration/auth_key_test.go	661	// Step 3: Re-authenticate with the SAME user (using auth key)	COMMENT
LOW	integration/auth_key_test.go	684	// Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication	COMMENT
LOW⚡	integration/acl_test.go	2809	// Step 1: Verify initial state - HTTP on port 80 should work with tag:webserver	COMMENT
LOW⚡	integration/acl_test.go	2815	// Step 2: Change tag from webserver to sshonly	COMMENT
LOW⚡	integration/acl_test.go	3275	// Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers]	COMMENT
LOW⚡	integration/acl_test.go	3282	// Step 5: THE CRITICAL TEST - verify connectivity STILL works	COMMENT
LOW	integration/acl_test.go	2573	// Step 1: Verify initial access state	COMMENT
LOW	integration/acl_test.go	2606	// Step 2: Apply tag change	COMMENT
LOW	integration/acl_test.go	2624	// Step 3: Verify final NetMap visibility first (fast signal that	COMMENT
LOW	integration/acl_test.go	2652	// Step 4: Verify final access state (this is the key test for #2389).	COMMENT
LOW	integration/acl_test.go	2836	// Step 3: Verify peer is still visible in NetMap (partial access, not full removal)	COMMENT
LOW	integration/acl_test.go	2855	// Step 4: Verify HTTP on port 80 now fails (tag:sshonly only allows port 22).	COMMENT
LOW	integration/acl_test.go	3051	// Step 1: Verify initial connectivity - all users can reach each other	COMMENT
LOW	integration/acl_test.go	3063	// Step 2: Get user3's node and user, then delete them	COMMENT
LOW	integration/acl_test.go	3088	// Step 3: Verify that user1 and user2 can still communicate (before triggering policy refresh)	COMMENT
LOW	integration/acl_test.go	3099	// Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] which	COMMENT
LOW	integration/acl_test.go	3111	// Step 5: THIS IS THE CRITICAL TEST - verify connectivity STILL works after	COMMENT
LOW	integration/acl_test.go	3228	// Step 1: Verify initial connectivity - user1 and user3 can ping each other	COMMENT
LOW	integration/acl_test.go	3242	// Step 2: Delete user2's node and user (like reporter deleting "deleteable")	COMMENT
LOW	integration/acl_test.go	3260	// Step 3: Verify connectivity still works after user2 deletion	COMMENT
LOW	integration/acl_test.go	3392	// Step 1: Verify initial connectivity with VALID policy	COMMENT
LOW	integration/acl_test.go	3406	// Step 2: DYNAMICALLY update policy to add unknown user	COMMENT
LOW	integration/acl_test.go	3436	// Step 3: THE CRITICAL TEST - verify connectivity STILL works	COMMENT
LOW	integration/acl_test.go	3540	// Step 1: Verify initial connectivity WITH unknown user in policy	COMMENT
LOW	integration/acl_test.go	3555	// Step 2: Update policy to REMOVE the unknown user	COMMENT
LOW	integration/acl_test.go	3584	// Step 3: Verify connectivity after removing unknown user	COMMENT
LOW⚡	integration/tags_test.go	3391	// Step 3: Register via CLI with user (the step that triggered the panic)	COMMENT
LOW⚡	integration/tags_test.go	3398	// Step 4: The tagged node stays and the user gets a device of its own. The	COMMENT
LOW	integration/tags_test.go	527	// Step 2: Admin assigns different tags via headscale CLI	COMMENT
LOW	integration/tags_test.go	549	// Step 3: Force reauthentication	COMMENT
LOW	integration/tags_test.go	858	// Step 2: Admin assigns multiple tags via headscale CLI	COMMENT
LOW	integration/tags_test.go	879	// Step 3: Attempt to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	1220	// Step 2: Admin assigns tags	COMMENT
LOW	integration/tags_test.go	1241	// Step 3: Run tailscale up with --reset	COMMENT
LOW	integration/tags_test.go	1339	// Step 2: Admin assigns tags	COMMENT
LOW	integration/tags_test.go	1360	// Step 3: Run tailscale up with empty --advertise-tags	COMMENT
LOW	integration/tags_test.go	1458	// Step 2: Admin assigns multiple tags	COMMENT
LOW	integration/tags_test.go	1479	// Step 3: Attempt to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	1757	// Step 1: Create and register with one tag	COMMENT
LOW	integration/tags_test.go	1787	// Step 2: Try to add second tag via CLI	COMMENT
LOW	integration/tags_test.go	1848	// Step 1: Create and register with two tags	COMMENT
LOW	integration/tags_test.go	1878	// Step 2: Try to remove second tag via CLI	COMMENT
LOW	integration/tags_test.go	1939	// Step 1: Register with one tag	COMMENT
LOW	integration/tags_test.go	1973	// Step 2: Admin assigns different tag	COMMENT
LOW	integration/tags_test.go	1993	// Step 3: Try to change tags via CLI	COMMENT
LOW	integration/tags_test.go	2056	// Step 1: Register with one tag	COMMENT
LOW	integration/tags_test.go	2089	// Step 2: Admin assigns both tags	COMMENT
LOW	integration/tags_test.go	2109	// Step 3: Try to reduce tags via CLI	COMMENT
LOW	integration/tags_test.go	2783	// Step 2: Admin changes tag to tag:second (FIRST CALL - this is "tag:bar" in issue terms)	COMMENT
LOW	integration/tags_test.go	2838	// Step 3: Call SetNodeTags AGAIN with the SAME tag (SECOND CALL)	COMMENT
LOW	integration/tags_test.go	2857	// Step 4: Do another tag change to verify the pattern repeats	COMMENT
LOW	integration/tags_test.go	2893	// Step 5: Call SetNodeTags AGAIN with the SAME tag	COMMENT
LOW	integration/tags_test.go	3043	// Step 1: Create and register a node with tags	COMMENT
LOW	integration/tags_test.go	3084	// Step 2: Reauth with empty tags to remove all tags	COMMENT
34 more matches not shown…

Fake / Example Data72 hits · 67 pts

Severity	File	Line	Snippet	Context
LOW	hscontrol/types/config_test.go	1408	Email: "admin@example.com",	CODE
LOW	hscontrol/types/testcapture/testcapture_test.go	425	"full_policy": {"tagOwners": {"tag:ops": ["user@example.com"]}},	CODE
LOW	hscontrol/types/testcapture/testcapture_test.go	443	want := `{"tagOwners":{"tag:ops":["user@example.com"]}}`	CODE
LOW	hscontrol/servertest/via_ha_compat_test.go	404	"thor@example.org": "thor",	CODE
LOW	hscontrol/templates/auth_success.go	25	// e.g. "user@example.com".	COMMENT
LOW	hscontrol/policy/v2/policy_test.go	1152	{ID: 1, Name: "admin", Email: "admin@example.com"},	CODE
LOW	hscontrol/policy/v2/policy_test.go	1191	"group:admin": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/policy_test.go	1315	{ID: 2, Name: "admin", Email: "admin@example.com"},	CODE
LOW	hscontrol/policy/v2/policy_test.go	1397	"group:admin": ["admin@example.com"],	CODE
LOW	hscontrol/policy/v2/policy_test.go	1480	{ID: 1, Name: "admin", Email: "admin@example.com"},	CODE
LOW	hscontrol/policy/v2/policy_test.go	1510	"group:admin": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/policy_test.go	1546	{ID: 1, Name: "admin", Email: "admin@example.com"},	CODE
LOW	hscontrol/policy/v2/policy_test.go	1585	"group:admin": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/policytester_compat_test.go	48	{ID: 2, Name: "thor", Email: "thor@example.org"},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	42	Group("group:example"): []Username{Username("user@example.com")},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	48	Tag("tag:test"): Owners{up("user@example.com")},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	55	new(Username("user@example.com")),	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6052	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6054	{"src": "thor@example.org", "dst": ["tag:server"], "accept": ["root"]}	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6063	require.Equal(t, "thor@example.org", got.Src.String())	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6128	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6130	{"src": "thor@example.org", "dst": ["tag:server:22"], "accept": ["root"]}	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6140	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6142	{"src": "thor@example.org", "dst": ["10.0.0.0/8"], "accept": ["root"]}	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6198	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6200	{"src": "thor@example.org", "dst": ["autogroup:internet"], "accept": ["root"]}	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6210	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6212	{"src": "thor@example.org", "dst": ["tag:not-in-tagOwners"], "accept": ["root"]}	CODE
LOW⚡	hscontrol/policy/v2/types_test.go	6222	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW	hscontrol/policy/v2/types_test.go	74	assert.Contains(t, jsonString, "user@example.com")	CODE
LOW	hscontrol/policy/v2/types_test.go	422	"group:c": ["thor@example.org"],	CODE
LOW	hscontrol/policy/v2/types_test.go	661	"group:admins": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	682	Group("group:admins"): []Username{Username("admin@example.com")},	CODE
LOW	hscontrol/policy/v2/types_test.go	709	"tag:web": ["admin@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	710	"tag:server": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	733	"group:admins": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	752	Group("group:admins"): []Username{Username("admin@example.com")},	CODE
LOW	hscontrol/policy/v2/types_test.go	1031	"group:test": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1032	"INVALID_GROUP_FIELD": ["user@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	1043	"group:test": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1055	"group:test": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1079	"tag:test": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1110	"src": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1111	"dst": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1143	"10.0.0.0/8": ["user@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	1145	"exitNode": ["user@example.com"],	CODE
LOW	hscontrol/policy/v2/types_test.go	1198	"user@example.com"	CODE
LOW	hscontrol/policy/v2/types_test.go	1201	"user@example.com"	CODE
LOW	hscontrol/policy/v2/types_test.go	2175	"tag:client": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	2197	"tag:client": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	2217	"tag:client": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	2237	"tag:client": ["admin@example.com"]	CODE
LOW	hscontrol/policy/v2/types_test.go	6076	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW	hscontrol/policy/v2/types_test.go	6079	"src": "thor@example.org",	CODE
LOW	hscontrol/policy/v2/types_test.go	6105	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW	hscontrol/policy/v2/types_test.go	6107	{"src": "thor@example.org", "dst": ["tag:server"]}	CODE
LOW	hscontrol/policy/v2/types_test.go	6156	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW	hscontrol/policy/v2/types_test.go	6158	{"src": "thor@example.org", "dst": ["100.64.0.16"], "accept": ["root"]}	CODE
LOW	hscontrol/policy/v2/types_test.go	6178	"tagOwners": {"tag:server": ["admin@example.org"]},	CODE
LOW	hscontrol/policy/v2/types_test.go	6180	{"src": "thor@example.org", "dst": ["fd7a:115c:a1e0::10"], "accept": ["root"]}	CODE
12 more matches not shown…

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	integration/route_test.go	684	// Get the expected router IP - use a more robust approach to handle temporary disconnections	COMMENT
MEDIUM	integration/dockertestutil/config.go	70	// This could be improved with more robust detection if needed	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	integration/run.sh	59	# Check if both arguments are provided	COMMENT
LOW	.github/workflows/needs-more-info-timer.yml	81	# Check if 3 days have passed	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	integration/README.md	52	## Required scaffolding	COMMENT

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	hscontrol/mapper/tail_test.go	203	// TODO: Add tests to check other aspects of the node conversion:	COMMENT

juanfont/headscale

Open-Source Code Quality, Security and Technical Debt Review