An open source, self-hosted implementation of the Tailscale control server
This report presents the forensic synthetic code analysis of juanfont/headscale, a Go project with 41,660 GitHub stars. SynthScan v2.0 examined 174,747 lines of code across 562 source files, recording 481 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 3.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 481 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config-example.yaml | 1 | --- | COMMENT |
| LOW | config-example.yaml | 21 | # Address to listen to /metrics and /debug, you may want | COMMENT |
| LOW | config-example.yaml | 41 | # List of IP prefixes to allocate tailaddresses from. | COMMENT |
| LOW | config-example.yaml | 61 | v6: fd7a:115c:a1e0::/48 | COMMENT |
| LOW | config-example.yaml | 81 | # Region ID to use for the embedded DERP server. | COMMENT |
| LOW | config-example.yaml | 121 | # https://headscale.net/stable/ref/derp/ | COMMENT |
| LOW | config-example.yaml | 141 | # (auth key, CLI, web auth). Tagged nodes are exempt and never expire. | COMMENT |
| LOW | config-example.yaml | 161 | # pings each HA node every probe_interval via the Noise channel. If a node | COMMENT |
| LOW | config-example.yaml | 201 | # SQLite config | COMMENT |
| LOW | config-example.yaml | 221 | # name: headscale | COMMENT |
| LOW | config-example.yaml | 281 | # If the mode is set to "file", the path to a HuJSON file containing policies. | COMMENT |
| LOW | config-example.yaml | 301 | # | COMMENT |
| LOW | config-example.yaml | 321 | global: | COMMENT |
| LOW | config-example.yaml | 341 | # your tailnet base_domain is always the first search domain. | COMMENT |
| LOW | config-example.yaml | 361 | unix_socket: /var/run/headscale/headscale.sock | COMMENT |
| LOW | config-example.yaml | 381 | # # `LoadCredential` straightforward: | COMMENT |
| LOW | config-example.yaml | 401 | # | COMMENT |
| LOW | config-example.yaml | 421 | # # PKCE adds an additional layer of security to the OAuth 2.0 authorization code flow | COMMENT |
| LOW | config-example.yaml | 441 | # disabled by default. Enabling this will make your clients send logs to Tailscale Inc. | COMMENT |
| LOW | config-example.yaml | 461 | enabled: false | COMMENT |
| LOW | cmd/vendorhash/main.go | 1 | // vendorhash maintains the Nix SRI hash for the Go module vendor tree | COMMENT |
| LOW | cmd/gen-openapi/main.go | 1 | // Command gen-openapi emits a Headscale OpenAPI document from the authoritative | COMMENT |
| LOW | integration/auth_oidc_test.go | 121 | t.Fatalf("unexpected users: %s", diff) | COMMENT |
| LOW | integration/auth_oidc_test.go | 1081 | listNodes, err := headscale.ListNodes() | COMMENT |
| LOW | integration/auth_oidc_test.go | 1101 | // - The test verifies that the node ID is preserved (since it's the same user on the same device) | COMMENT |
| LOW | integration/auth_oidc_test.go | 1321 | } | COMMENT |
| LOW | integration/auth_oidc_test.go | 1461 | // policy applied until they restarted their client. This was a regression | COMMENT |
| LOW | integration/auth_oidc_test.go | 1741 | }, integrationutil.ScaledTimeout(10*time.Second), integrationutil.SlowPoll, "headscale should have correct users and no | COMMENT |
| LOW | integration/ts2021_websocket_test.go | 41 | // client uses. It is fast and always on. | COMMENT |
| LOW | integration/auth_key_test.go | 561 | // Verify node comes back online | COMMENT |
| LOW | integration/acl_test.go | 621 | assert.EventuallyWithT(t, func(c *assert.CollectT) { | COMMENT |
| LOW | integration/acl_test.go | 641 | // "SrcIPs": ["*"] | COMMENT |
| LOW | integration/acl_test.go | 3141 | // | COMMENT |
| LOW | integration/acl_test.go | 3301 | // Additional verification: check filter rules are not empty | COMMENT |
| LOW | integration/acl_test.go | 3461 | // This test verifies that: | COMMENT |
| LOW | integration/auth_web_flow_test.go | 201 | // initially authenticate using the web-based authentication flow (where users visit a URL | COMMENT |
| LOW | integration/tags_test.go | 2781 | assertNodeHasTagsWithCollect(c, nodes[0], []string{"tag:valid-owned"}) | COMMENT |
| LOW | integration/tags_test.go | 3081 | t.Logf("Test 5.2 PASS: Registration correctly rejected with error: %v", err) | COMMENT |
| LOW | integration/route_test.go | 2161 | panic("node not found") | COMMENT |
| LOW | integration/route_test.go | 3841 | ip, err := subRouter2.IPv4() | COMMENT |
| LOW | integration/route_test.go | 4061 | // than a graceful tailscale down. The two differ in what the server sees: | COMMENT |
| LOW | integration/route_test.go | 4261 | assert.Contains(c, peer.PrimaryRoutes.AsSlice(), pref) | COMMENT |
| LOW | integration/route_test.go | 4281 | // resumes when r1 returns. | COMMENT |
| LOW | integration/scenario.go | 61 | // The list contains two special cases, "head" and "unstable" which | COMMENT |
| LOW | integration/scenario.go | 141 | // Networks, if set, is the separate Docker networks that should be | COMMENT |
| LOW | integration/scenario.go | 1741 | // endpoint. | COMMENT |
| LOW | integration/scenario.go | 1761 | // return errStatusCodeNotOK | COMMENT |
| LOW | integration/k8s_operator_test.go | 41 | Sources: []policyv2.Alias{policyv2.Wildcard}, | COMMENT |
| LOW | integration/tsic/tsic.go | 1061 | // Netmap returns the current Netmap ([netmap.NetworkMap]) of the Tailscale instance. | COMMENT |
| LOW | integration/tsic/tsic.go | 1301 | // Before that, we can check the BackendState to see if the | COMMENT |
| LOW | integration/wasmic/wasmclient/main.go | 1 | //go:build js | COMMENT |
| LOW | integration/k3sic/k3sic.go | 1 | // Package k3sic wraps a single-container k3s cluster (server + agent) as a | COMMENT |
| LOW | integration/k3sic/k3sic.go | 221 | COMMENT | |
| LOW | integration/k3sic/k3sic.go | 241 | COMMENT | |
| LOW | integration/k3sic/k3sic.go | 461 | // Proxy pods' tailscaled logs: DERP-connection and registration failures | COMMENT |
| LOW | gen/client/v1/client.gen.go | 401 | // | COMMENT |
| LOW | hscontrol/auth_test.go | 2301 | "error-test-method", | COMMENT |
| LOW | hscontrol/auth_test.go | 2941 | t.Logf("✓ New node created for user1 with machine key from %s (ID=%d)", node.hostname, newNode.ID().Uint64()) | COMMENT |
| LOW | hscontrol/auth_test.go | 3161 | COMMENT | |
| LOW | hscontrol/auth_test.go | 3441 | assert.Equal(t, initialNodeID, allNodes.At(0).ID(), "node ID should not change on re-registration") | COMMENT |
| 155 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config-example.yaml | 45 | # WARNING: These prefixes MUST be subsets of the standard Tailscale ranges: | COMMENT |
| LOW | integration/auth_oidc_test.go | 1834 | // Step 1: Verify initial route is advertised, approved, and SERVING | COMMENT |
| LOW | integration/auth_oidc_test.go | 1863 | // Step 2: Logout | COMMENT |
| LOW | integration/auth_oidc_test.go | 1885 | // Step 3: Re-authenticate via OIDC as the same user | COMMENT |
| LOW | integration/auth_oidc_test.go | 1903 | // Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication | COMMENT |
| LOW | integration/auth_key_test.go | 639 | // Step 1: Verify initial route is advertised, approved, and SERVING | COMMENT |
| LOW | integration/auth_key_test.go | 668 | // Step 2: Logout | COMMENT |
| LOW | integration/auth_key_test.go | 690 | // Step 3: Re-authenticate with the SAME user (using auth key) | COMMENT |
| LOW | integration/auth_key_test.go | 713 | // Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication | COMMENT |
| LOW⚡ | integration/acl_test.go | 2812 | // Step 1: Verify initial state - HTTP on port 80 should work with tag:webserver | COMMENT |
| LOW⚡ | integration/acl_test.go | 2818 | // Step 2: Change tag from webserver to sshonly | COMMENT |
| LOW⚡ | integration/acl_test.go | 3278 | // Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] | COMMENT |
| LOW⚡ | integration/acl_test.go | 3285 | // Step 5: THE CRITICAL TEST - verify connectivity STILL works | COMMENT |
| LOW | integration/acl_test.go | 2576 | // Step 1: Verify initial access state | COMMENT |
| LOW | integration/acl_test.go | 2609 | // Step 2: Apply tag change | COMMENT |
| LOW | integration/acl_test.go | 2627 | // Step 3: Verify final NetMap visibility first (fast signal that | COMMENT |
| LOW | integration/acl_test.go | 2655 | // Step 4: Verify final access state (this is the key test for #2389). | COMMENT |
| LOW | integration/acl_test.go | 2839 | // Step 3: Verify peer is still visible in NetMap (partial access, not full removal) | COMMENT |
| LOW | integration/acl_test.go | 2858 | // Step 4: Verify HTTP on port 80 now fails (tag:sshonly only allows port 22). | COMMENT |
| LOW | integration/acl_test.go | 3054 | // Step 1: Verify initial connectivity - all users can reach each other | COMMENT |
| LOW | integration/acl_test.go | 3066 | // Step 2: Get user3's node and user, then delete them | COMMENT |
| LOW | integration/acl_test.go | 3091 | // Step 3: Verify that user1 and user2 can still communicate (before triggering policy refresh) | COMMENT |
| LOW | integration/acl_test.go | 3102 | // Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] which | COMMENT |
| LOW | integration/acl_test.go | 3114 | // Step 5: THIS IS THE CRITICAL TEST - verify connectivity STILL works after | COMMENT |
| LOW | integration/acl_test.go | 3231 | // Step 1: Verify initial connectivity - user1 and user3 can ping each other | COMMENT |
| LOW | integration/acl_test.go | 3245 | // Step 2: Delete user2's node and user (like reporter deleting "deleteable") | COMMENT |
| LOW | integration/acl_test.go | 3263 | // Step 3: Verify connectivity still works after user2 deletion | COMMENT |
| LOW | integration/acl_test.go | 3395 | // Step 1: Verify initial connectivity with VALID policy | COMMENT |
| LOW | integration/acl_test.go | 3409 | // Step 2: DYNAMICALLY update policy to add unknown user | COMMENT |
| LOW | integration/acl_test.go | 3439 | // Step 3: THE CRITICAL TEST - verify connectivity STILL works | COMMENT |
| LOW | integration/acl_test.go | 3543 | // Step 1: Verify initial connectivity WITH unknown user in policy | COMMENT |
| LOW | integration/acl_test.go | 3558 | // Step 2: Update policy to REMOVE the unknown user | COMMENT |
| LOW | integration/acl_test.go | 3587 | // Step 3: Verify connectivity after removing unknown user | COMMENT |
| LOW⚡ | integration/tags_test.go | 3181 | // Step 3: Register via CLI with user (this is the exact step that triggers the panic) | COMMENT |
| LOW⚡ | integration/tags_test.go | 3188 | // Step 4: Verify node is now user-owned and the mapper didn't panic. | COMMENT |
| LOW | integration/tags_test.go | 526 | // Step 2: Admin assigns different tags via headscale CLI | COMMENT |
| LOW | integration/tags_test.go | 548 | // Step 3: Force reauthentication | COMMENT |
| LOW | integration/tags_test.go | 650 | // Step 2: Admin assigns multiple tags via headscale CLI | COMMENT |
| LOW | integration/tags_test.go | 671 | // Step 3: Attempt to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1012 | // Step 2: Admin assigns tags | COMMENT |
| LOW | integration/tags_test.go | 1033 | // Step 3: Run tailscale up with --reset | COMMENT |
| LOW | integration/tags_test.go | 1131 | // Step 2: Admin assigns tags | COMMENT |
| LOW | integration/tags_test.go | 1152 | // Step 3: Run tailscale up with empty --advertise-tags | COMMENT |
| LOW | integration/tags_test.go | 1250 | // Step 2: Admin assigns multiple tags | COMMENT |
| LOW | integration/tags_test.go | 1271 | // Step 3: Attempt to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1549 | // Step 1: Create and register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1579 | // Step 2: Try to add second tag via CLI | COMMENT |
| LOW | integration/tags_test.go | 1640 | // Step 1: Create and register with two tags | COMMENT |
| LOW | integration/tags_test.go | 1670 | // Step 2: Try to remove second tag via CLI | COMMENT |
| LOW | integration/tags_test.go | 1731 | // Step 1: Register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1765 | // Step 2: Admin assigns different tag | COMMENT |
| LOW | integration/tags_test.go | 1785 | // Step 3: Try to change tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1848 | // Step 1: Register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1881 | // Step 2: Admin assigns both tags | COMMENT |
| LOW | integration/tags_test.go | 1901 | // Step 3: Try to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 2575 | // Step 2: Admin changes tag to tag:second (FIRST CALL - this is "tag:bar" in issue terms) | COMMENT |
| LOW | integration/tags_test.go | 2630 | // Step 3: Call SetNodeTags AGAIN with the SAME tag (SECOND CALL) | COMMENT |
| LOW | integration/tags_test.go | 2649 | // Step 4: Do another tag change to verify the pattern repeats | COMMENT |
| LOW | integration/tags_test.go | 2685 | // Step 5: Call SetNodeTags AGAIN with the SAME tag | COMMENT |
| LOW | integration/tags_test.go | 2835 | // Step 1: Create and register a node with tags | COMMENT |
| 35 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | integration/auth_oidc_test.go | 1834 | // Step 1: Verify initial route is advertised, approved, and SERVING | COMMENT |
| LOW | integration/auth_oidc_test.go | 1863 | // Step 2: Logout | COMMENT |
| LOW | integration/auth_oidc_test.go | 1885 | // Step 3: Re-authenticate via OIDC as the same user | COMMENT |
| LOW | integration/auth_oidc_test.go | 1903 | // Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication | COMMENT |
| LOW | integration/auth_key_test.go | 639 | // Step 1: Verify initial route is advertised, approved, and SERVING | COMMENT |
| LOW | integration/auth_key_test.go | 668 | // Step 2: Logout | COMMENT |
| LOW | integration/auth_key_test.go | 690 | // Step 3: Re-authenticate with the SAME user (using auth key) | COMMENT |
| LOW | integration/auth_key_test.go | 713 | // Step 4: THE CRITICAL TEST - Verify routes are STILL SERVING after re-authentication | COMMENT |
| LOW⚡ | integration/acl_test.go | 2812 | // Step 1: Verify initial state - HTTP on port 80 should work with tag:webserver | COMMENT |
| LOW⚡ | integration/acl_test.go | 2818 | // Step 2: Change tag from webserver to sshonly | COMMENT |
| LOW⚡ | integration/acl_test.go | 3278 | // Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] | COMMENT |
| LOW⚡ | integration/acl_test.go | 3285 | // Step 5: THE CRITICAL TEST - verify connectivity STILL works | COMMENT |
| LOW | integration/acl_test.go | 2576 | // Step 1: Verify initial access state | COMMENT |
| LOW | integration/acl_test.go | 2609 | // Step 2: Apply tag change | COMMENT |
| LOW | integration/acl_test.go | 2627 | // Step 3: Verify final NetMap visibility first (fast signal that | COMMENT |
| LOW | integration/acl_test.go | 2655 | // Step 4: Verify final access state (this is the key test for #2389). | COMMENT |
| LOW | integration/acl_test.go | 2839 | // Step 3: Verify peer is still visible in NetMap (partial access, not full removal) | COMMENT |
| LOW | integration/acl_test.go | 2858 | // Step 4: Verify HTTP on port 80 now fails (tag:sshonly only allows port 22). | COMMENT |
| LOW | integration/acl_test.go | 3054 | // Step 1: Verify initial connectivity - all users can reach each other | COMMENT |
| LOW | integration/acl_test.go | 3066 | // Step 2: Get user3's node and user, then delete them | COMMENT |
| LOW | integration/acl_test.go | 3091 | // Step 3: Verify that user1 and user2 can still communicate (before triggering policy refresh) | COMMENT |
| LOW | integration/acl_test.go | 3102 | // Step 4: Create a NEW user - this triggers [State.updatePolicyManagerUsers] which | COMMENT |
| LOW | integration/acl_test.go | 3114 | // Step 5: THIS IS THE CRITICAL TEST - verify connectivity STILL works after | COMMENT |
| LOW | integration/acl_test.go | 3231 | // Step 1: Verify initial connectivity - user1 and user3 can ping each other | COMMENT |
| LOW | integration/acl_test.go | 3245 | // Step 2: Delete user2's node and user (like reporter deleting "deleteable") | COMMENT |
| LOW | integration/acl_test.go | 3263 | // Step 3: Verify connectivity still works after user2 deletion | COMMENT |
| LOW | integration/acl_test.go | 3395 | // Step 1: Verify initial connectivity with VALID policy | COMMENT |
| LOW | integration/acl_test.go | 3409 | // Step 2: DYNAMICALLY update policy to add unknown user | COMMENT |
| LOW | integration/acl_test.go | 3439 | // Step 3: THE CRITICAL TEST - verify connectivity STILL works | COMMENT |
| LOW | integration/acl_test.go | 3543 | // Step 1: Verify initial connectivity WITH unknown user in policy | COMMENT |
| LOW | integration/acl_test.go | 3558 | // Step 2: Update policy to REMOVE the unknown user | COMMENT |
| LOW | integration/acl_test.go | 3587 | // Step 3: Verify connectivity after removing unknown user | COMMENT |
| LOW⚡ | integration/tags_test.go | 3181 | // Step 3: Register via CLI with user (this is the exact step that triggers the panic) | COMMENT |
| LOW⚡ | integration/tags_test.go | 3188 | // Step 4: Verify node is now user-owned and the mapper didn't panic. | COMMENT |
| LOW | integration/tags_test.go | 526 | // Step 2: Admin assigns different tags via headscale CLI | COMMENT |
| LOW | integration/tags_test.go | 548 | // Step 3: Force reauthentication | COMMENT |
| LOW | integration/tags_test.go | 650 | // Step 2: Admin assigns multiple tags via headscale CLI | COMMENT |
| LOW | integration/tags_test.go | 671 | // Step 3: Attempt to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1012 | // Step 2: Admin assigns tags | COMMENT |
| LOW | integration/tags_test.go | 1033 | // Step 3: Run tailscale up with --reset | COMMENT |
| LOW | integration/tags_test.go | 1131 | // Step 2: Admin assigns tags | COMMENT |
| LOW | integration/tags_test.go | 1152 | // Step 3: Run tailscale up with empty --advertise-tags | COMMENT |
| LOW | integration/tags_test.go | 1250 | // Step 2: Admin assigns multiple tags | COMMENT |
| LOW | integration/tags_test.go | 1271 | // Step 3: Attempt to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1549 | // Step 1: Create and register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1579 | // Step 2: Try to add second tag via CLI | COMMENT |
| LOW | integration/tags_test.go | 1640 | // Step 1: Create and register with two tags | COMMENT |
| LOW | integration/tags_test.go | 1670 | // Step 2: Try to remove second tag via CLI | COMMENT |
| LOW | integration/tags_test.go | 1731 | // Step 1: Register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1765 | // Step 2: Admin assigns different tag | COMMENT |
| LOW | integration/tags_test.go | 1785 | // Step 3: Try to change tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 1848 | // Step 1: Register with one tag | COMMENT |
| LOW | integration/tags_test.go | 1881 | // Step 2: Admin assigns both tags | COMMENT |
| LOW | integration/tags_test.go | 1901 | // Step 3: Try to reduce tags via CLI | COMMENT |
| LOW | integration/tags_test.go | 2575 | // Step 2: Admin changes tag to tag:second (FIRST CALL - this is "tag:bar" in issue terms) | COMMENT |
| LOW | integration/tags_test.go | 2630 | // Step 3: Call SetNodeTags AGAIN with the SAME tag (SECOND CALL) | COMMENT |
| LOW | integration/tags_test.go | 2649 | // Step 4: Do another tag change to verify the pattern repeats | COMMENT |
| LOW | integration/tags_test.go | 2685 | // Step 5: Call SetNodeTags AGAIN with the SAME tag | COMMENT |
| LOW | integration/tags_test.go | 2835 | // Step 1: Create and register a node with tags | COMMENT |
| LOW | integration/tags_test.go | 2876 | // Step 2: Reauth with empty tags to remove all tags | COMMENT |
| 34 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hscontrol/types/testcapture/testcapture_test.go | 424 | "full_policy": {"tagOwners": {"tag:ops": ["user@example.com"]}}, | CODE |
| LOW | hscontrol/types/testcapture/testcapture_test.go | 442 | want := `{"tagOwners":{"tag:ops":["user@example.com"]}}` | CODE |
| LOW | hscontrol/servertest/via_ha_compat_test.go | 394 | "thor@example.org", | CODE |
| LOW | hscontrol/templates/auth_success.go | 25 | // e.g. "user@example.com". | COMMENT |
| LOW | hscontrol/policy/v2/policy_test.go | 896 | {Model: gorm.Model{ID: 1}, Name: "admin", Email: "admin@example.com"}, | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 935 | "group:admin": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1063 | {Model: gorm.Model{ID: 2}, Name: "admin", Email: "admin@example.com"}, | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1145 | "group:admin": ["admin@example.com"], | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1232 | {Model: gorm.Model{ID: 1}, Name: "admin", Email: "admin@example.com"}, | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1262 | "group:admin": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1300 | {Model: gorm.Model{ID: 1}, Name: "admin", Email: "admin@example.com"}, | CODE |
| LOW | hscontrol/policy/v2/policy_test.go | 1339 | "group:admin": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/policytester_compat_test.go | 48 | {Model: gorm.Model{ID: 2}, Name: "thor", Email: "thor@example.org"}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 42 | Group("group:example"): []Username{Username("user@example.com")}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 48 | Tag("tag:test"): Owners{up("user@example.com")}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 55 | new(Username("user@example.com")), | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 5996 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 5998 | {"src": "thor@example.org", "dst": ["tag:server"], "accept": ["root"]} | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6007 | require.Equal(t, "thor@example.org", got.Src.String()) | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6072 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6074 | {"src": "thor@example.org", "dst": ["tag:server:22"], "accept": ["root"]} | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6084 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6086 | {"src": "thor@example.org", "dst": ["10.0.0.0/8"], "accept": ["root"]} | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6142 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6144 | {"src": "thor@example.org", "dst": ["autogroup:internet"], "accept": ["root"]} | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6154 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6156 | {"src": "thor@example.org", "dst": ["tag:not-in-tagOwners"], "accept": ["root"]} | CODE |
| LOW⚡ | hscontrol/policy/v2/types_test.go | 6166 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 74 | assert.Contains(t, jsonString, "user@example.com") | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 422 | "group:c": ["thor@example.org"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 661 | "group:admins": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 682 | Group("group:admins"): []Username{Username("admin@example.com")}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 709 | "tag:web": ["admin@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 710 | "tag:server": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 733 | "group:admins": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 752 | Group("group:admins"): []Username{Username("admin@example.com")}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1031 | "group:test": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1032 | "INVALID_GROUP_FIELD": ["user@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1043 | "group:test": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1055 | "group:test": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1079 | "tag:test": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1110 | "src": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1111 | "dst": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1143 | "10.0.0.0/8": ["user@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1145 | "exitNode": ["user@example.com"], | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1198 | "user@example.com" | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 1201 | "user@example.com" | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 2175 | "tag:client": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 2197 | "tag:client": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 2217 | "tag:client": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 2237 | "tag:client": ["admin@example.com"] | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6020 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6023 | "src": "thor@example.org", | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6049 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6051 | {"src": "thor@example.org", "dst": ["tag:server"]} | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6100 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6102 | {"src": "thor@example.org", "dst": ["100.64.0.16"], "accept": ["root"]} | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6122 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6124 | {"src": "thor@example.org", "dst": ["fd7a:115c:a1e0::10"], "accept": ["root"]} | CODE |
| LOW | hscontrol/policy/v2/types_test.go | 6178 | "tagOwners": {"tag:server": ["admin@example.org"]}, | CODE |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | integration/route_test.go | 683 | // Get the expected router IP - use a more robust approach to handle temporary disconnections | COMMENT |
| MEDIUM | integration/dockertestutil/config.go | 70 | // This could be improved with more robust detection if needed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | integration/run.sh | 59 | # Check if both arguments are provided | COMMENT |
| LOW | .github/workflows/needs-more-info-timer.yml | 81 | # Check if 3 days have passed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | integration/README.md | 52 | ## Required scaffolding | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hscontrol/mapper/tail_test.go | 199 | // TODO: Add tests to check other aspects of the node conversion: | COMMENT |