1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

14.3K

Stars

TypeScript

Language

196.4K

Lines of Code

1.1K

Files

206

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 61 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.5/100 · LOW

Are imports declared and package/API names verified? 145 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 44 finding(s).

PR Review Velocity Impact 6.1/100 · LOW

Which changes need focused human review? 206 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 6MEDIUM 2LOW 197

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 206 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data144 hits · 172 pts

Severity	File	Line	Snippet	Context
LOW⚡	ftp/acquisitions.md	9	Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy	CODE
LOW⚡	ftp/acquisitions.md	9	Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy	CODE
LOW⚡	ftp/acquisitions.md	12	clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit	CODE
LOW⚡	ftp/acquisitions.md	13	amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam	CODE
LOW⚡	ftp/acquisitions.md	13	amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam	CODE
LOW⚡	ftp/acquisitions.md	17	ipsum dolor sit amet.	CODE
LOW	frontend/src/app/app.guard.spec.ts	49	name: 'John Doe',	CODE
LOW	frontend/src/app/navbar/navbar.component.ts	107	public selectedLanguage = 'placeholder'	CODE
LOW	frontend/src/app/navbar/navbar.component.ts	113	public shortKeyLang = 'placeholder'	CODE
LOW	frontend/src/app/navbar/navbar.component.spec.ts	588	component.userEmail = 'foo@bar.com'	CODE
LOW⚡	frontend/src/app/oauth/oauth.component.spec.ts	89	userService.oauthLogin.mockReturnValue(of({ email: 'test@test.com' }))	CODE
LOW⚡	frontend/src/app/oauth/oauth.component.spec.ts	91	expect(userService.save).toHaveBeenCalledWith({ email: 'test@test.com', password: 'bW9jLnRzZXRAdHNldA==', passwo	CODE
LOW⚡	frontend/src/app/oauth/oauth.component.spec.ts	95	userService.oauthLogin.mockReturnValue(of({ email: 'test@test.com' }))	CODE
LOW⚡	frontend/src/app/oauth/oauth.component.spec.ts	98	expect(userService.login).toHaveBeenCalledWith({ email: 'test@test.com', password: 'bW9jLnRzZXRAdHNldA==', oauth	CODE
LOW	…onents/challenge-card/challenge-card.component.spec.ts	20	description: 'lorem ipsum',	CODE
LOW	…l-mode-warning/tutorial-mode-warning.component.spec.ts	20	description: 'lorem ipsum',	CODE
LOW	…l-mode-warning/tutorial-mode-warning.component.spec.ts	64	description: 'lorem ipsum',	CODE
LOW	…rning/challenges-unavailable-warning.component.spec.ts	17	description: 'lorem ipsum',	CODE
LOW	…rning/challenges-unavailable-warning.component.spec.ts	26	description: 'lorem ipsum',	CODE
LOW	…rning/challenges-unavailable-warning.component.spec.ts	59	description: 'lorem ipsum',	CODE
LOW	…rning/challenges-unavailable-warning.component.spec.ts	76	description: 'lorem ipsum',	CODE
LOW	…rning/challenges-unavailable-warning.component.spec.ts	85	description: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	7	description: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	8	originalDescription: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	24	description: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	25	originalDescription: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	41	description: 'lorem ipsum',	CODE
LOW	…rc/app/score-board/helpers/challenge-filtering.spec.ts	42	originalDescription: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	6	description: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	7	originalDescription: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	23	description: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	24	originalDescription: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	40	description: 'lorem ipsum',	CODE
LOW	…/src/app/score-board/helpers/challenge-sorting.spec.ts	41	originalDescription: 'lorem ipsum',	CODE
LOW	frontend/src/app/recycle/recycle.component.html	67	<small>Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut	CODE
LOW	frontend/src/app/recycle/recycle.component.html	67	<small>Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut	CODE
LOW	frontend/src/app/recycle/recycle.component.html	79	<small>Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor	CODE
LOW	frontend/src/app/recycle/recycle.component.html	79	<small>Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor	CODE
LOW⚡	frontend/src/app/about/about.component.html	16	Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et	CODE
LOW⚡	frontend/src/app/about/about.component.html	16	Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et	CODE
LOW⚡	frontend/src/app/about/about.component.html	18	clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet,	CODE
LOW⚡	frontend/src/app/about/about.component.html	18	clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet,	CODE
LOW⚡	frontend/src/app/about/about.component.html	21	takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed	CODE
LOW⚡	frontend/src/app/about/about.component.html	21	takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed	CODE
LOW⚡	frontend/src/app/about/about.component.html	26	delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit,	CODE
LOW⚡	frontend/src/app/about/about.component.html	26	delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit,	CODE
LOW⚡	frontend/src/app/about/about.component.html	32	Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod	CODE
LOW⚡	frontend/src/app/about/about.component.html	32	Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod	CODE
LOW⚡	frontend/src/app/about/about.component.html	34	dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem	CODE
LOW⚡	frontend/src/app/about/about.component.html	34	dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem	CODE
LOW⚡	frontend/src/app/about/about.component.html	35	ipsum dolor sit amet, consetetur sadipscing elitr, At accusam aliquyam diam diam dolore dolores duo eirmod eos	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	28	Lorem ipsum dolor sit amet <strong><i class='fab fa-bitcoin'></i> {{altcoinName}}</strong>, consetetur sadipsc	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	28	Lorem ipsum dolor sit amet <strong><i class='fab fa-bitcoin'></i> {{altcoinName}}</strong>, consetetur sadipsc	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	32	Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu f	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	32	Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu f	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	40	Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer p	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	40	Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer p	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	48	At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus es	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	48	At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus es	CODE
LOW⚡	frontend/src/app/token-sale/token-sale.component.html	62	Stet clita kasd gubergren, no <strong><i class='fab fa-bitcoin'></i> {{altcoinName}}</strong> sea takimata s	CODE
84 more matches not shown…

Hyper-Verbose Identifiers44 hits · 44 pts

Severity	File	Line	Snippet	Context
LOW	frontend/src/hacking-instructor/index.ts	190	export async function startHackingInstructorFor (challengeName: string): Promise<void> {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	65	export function waitForInputToNotHaveValue (inputSelector: string, value: string, options = { ignoreCase: true }) {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	82	export function waitForInputToNotHaveValueAndNotBeEmpty (inputSelector: string, value: string, options = { ignoreCase: t	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	116	export function waitForElementToGetClicked (elementSelector: string) {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	131	export function waitForElementsInnerHtmlToBe (elementSelector: string, value: string) {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	159	export function waitForAngularRouteToBeVisited (route: string) {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	244	export function waitForSelectToNotHaveValue (selectSelector: string, value: string) {	CODE
LOW	frontend/src/hacking-instructor/helpers/helpers.ts	259	export function waitForRightUriQueryParamPair (key: string, value: string) {	CODE
LOW	…strength-info/password-strength-info.component.spec.ts	5	function createPasswordComponentStub (overrides: Partial<any> = {}): any {	CODE
LOW	…er-settings/pipes/difficulty-selection-summary.pipe.ts	27	function breakDifficultiesIntoNeighboringGroups (difficulties: (1 \| 2 \| 3 \| 4 \| 5 \| 6)[]): DifficultyGroup[] {	CODE
LOW	…er-settings/pipes/difficulty-selection-summary.pipe.ts	46	function convertDifficultyGroupsToString (difficultyGroups: DifficultyGroup[]): string {	CODE
LOW	…end/src/app/score-board/helpers/challenge-filtering.ts	100	function getCompleteChallengeStatus (	CODE
LOW	frontend/src/assets/private/three.js	21805	function materialNeedsSmoothNormals ( material ) {	CODE
LOW	frontend/src/assets/private/three.js	21833	function bufferGuessVertexColorType( material ) {	CODE
LOW	frontend/src/assets/private/three.js	24365	function unrollImmediateBufferMaterial ( globject ) {	CODE
LOW	lib/antiCheat.ts	162	function isLooselyCoupledToPreviouslySolved (challenge: Challenge) {	CODE
LOW	lib/antiCheat.ts	206	export function checkForSourceFileOverlap (challengeKey: string, submission: string): boolean {	CODE
LOW	lib/utils.ts	153	export function getChallengeEnablementStatus (challenge: Challenge,	CODE
LOW	lib/codingChallenges.ts	47	function getCodeChallengesFromFile (file: FileMatch) {	CODE
LOW	lib/codingChallenges.ts	59	export function getCodingChallengeFromFileContent (source: string, challengeKey: string) {	CODE
LOW	data/staticData.ts	93	export async function loadStaticSecurityQuestionsData (): Promise<StaticSecurityQuestions[]> {	CODE
LOW	data/datacreator.ts	296	function getGeneratedRandomFakeUserEmail () {	CODE
LOW	data/datacreator.ts	473	function customizeChangeProductChallenge (description: string, customUrl: string, customProduct: Product) {	CODE
LOW	data/datacache.ts	34	export function setRetrieveBlueprintChallengeFile (retrieveBlueprintChallengeFileArg: string) {	CODE
LOW	data/static/codefixes/xssBonusChallenge.info.yml	7	explanation: 'Using bypassSecurityTrustSoundCloud() instead of bypassSecurityTrustHtml() supposedly bypasses sanitiz	CODE
LOW	routes/login.ts	68	function verifyPostLoginChallenges (user: User) {	CODE
LOW	routes/verify.ts	144	async function checkPatternInFeedbackAndComplaints (	CODE
LOW	routes/verify.ts	245	function knownVulnerableComponentChallenge () {	CODE
LOW	routes/verify.ts	252	function knownVulnerableComponents () {	CODE
LOW	routes/verify.ts	286	function typosquattingNpmChallenge () {	CODE
LOW	routes/verify.ts	293	function typosquattingAngularChallenge () {	CODE
LOW	routes/verify.ts	307	function supplyChainAttackChallenge () {	CODE
LOW	routes/verify.ts	321	function dlpPastebinDataLeakChallenge () {	CODE
LOW	routes/verify.ts	342	function vulnerableDockerImageChallenge () {	CODE
LOW	routes/verify.ts	363	export function checkSystemPromptSimilarity (submission: string, reference: string, threshold = 0.25): boolean {	CODE
LOW	routes/verify.ts	368	async function systemPromptExtractionChallenge (): Promise<void> {	CODE
LOW	routes/resetPassword.ts	57	function verifySecurityAnswerChallenges (user: UserModel, answer: string) {	CODE
LOW	routes/basketItems.ts	58	export function quantityCheckBeforeBasketItemAddition () {	CODE
LOW	routes/basketItems.ts	65	export function quantityCheckBeforeBasketItemUpdate () {	CODE
LOW	routes/order.ts	190	function calculateApplicableDiscount (basket: BasketModel, req: Request) {	CODE
LOW	routes/fileServer.ts	39	function verifySuccessfulPoisonNullByteExploit (file: string) {	CODE
LOW	routes/fileServer.ts	56	function endsWithAllowlistedFileType (param: string) {	CODE
LOW	routes/metrics.ts	63	export function observeRequestMetricsMiddleware () {	CODE
LOW	routes/metrics.ts	73	export function observeFileUploadMetricsMiddleware () {	CODE

Synthetic Comment Markers6 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH	CONTRIBUTING.md	19	6. Noise (e.g. unnecessary comments) generated by AI tools _must_ be removed before opening a PR.	CODE
HIGH	AGENTS.md	101	Required per CONTRIBUTING.md rule #6: Remove unnecessary AI-generated content before submitting PRs.	CODE
HIGH	.github/workflows/issue-compliance.yml	162	// A generic automated/AI-generated vulnerability report tends to (a) use several "field: value"	COMMENT
HIGH	.github/workflows/issue-compliance.yml	226	// 12. Generic AI-generated maintenance/bug report smell: formal audit-style structure and vague	COMMENT
HIGH	.github/workflows/issue-compliance.yml	241	// 13. Formulaic / bulk AI-generated challenge idea: lists several generic vulnerability buzzwords	COMMENT
HIGH	.github/workflows/issue-compliance.yml	254	// 14. Formulaic AI-generated vulnerability narrative: boilerplate framing ("introduce a ...	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	frontend/src/app/oauth/oauth.component.ts	72	const hash = this.route.snapshot.data.params.substr(1)	CODE

Over-Commented Block9 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	frontend/src/assets/private/three.js	30161	points.push( points[ 0 ] );	COMMENT
LOW	frontend/src/assets/private/three.js	30501	//	COMMENT
LOW	frontend/src/assets/private/three.js	31321	// var c = [];	COMMENT
LOW	frontend/src/assets/private/OrbitControls.js	1	/**	COMMENT
LOW	…efixes/resetPasswordBjoernOwaspChallenge_2_correct.yml	1	# Provide password reset option via a one-time link with	COMMENT
LOW	…c/codefixes/resetPasswordBjoernChallenge_1_correct.yml	1	# Provide password reset option via a one-time link with	COMMENT
LOW	…c/codefixes/resetPasswordBenderChallenge_2_correct.yml	1	# Provide password reset option via a one-time link with	COMMENT
LOW	…c/codefixes/resetPasswordUvoginChallenge_3_correct.yml	1	# Provide password reset option via a one-time link with	COMMENT
LOW	…atic/codefixes/resetPasswordJimChallenge_3_correct.yml	1	# Provide password reset option via a one-time link with	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	frontend/src/assets/private/three.js	3514	// this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes	COMMENT
MEDIUM	frontend/src/assets/private/three.js	3838	// this is a more robust check for empty than ( volume <= 0 ) because volume can get positive with two negative axes	COMMENT

juice-shop/juice-shop

Open-Source Code Quality, Security and Technical Debt Review