1.5

Adjusted Signal

1.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

37.6K

Stars

Java

Language

1.6M

Lines of Code

10.7K

Files

659

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 381 finding(s).

Hallucinated Dependency & Supply Chain Risk 5.4/100 · LOW

Are imports declared and package/API names verified? 265 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 179 finding(s).

PR Review Velocity Impact 6.7/100 · LOW

Which changes need focused human review? 659 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 164HIGH 5MEDIUM 24LOW 466

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 659 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators164 hits · 1655 pts

Severity	File	Line	Snippet	Context
CRITICAL	…rg/keycloak/themeverifier/VerifyMessageProperties.java	237	sanitized = org.apache.commons.text.StringEscapeUtils.unescapeHtml4(sanitized);	CODE
CRITICAL	…rg/keycloak/themeverifier/VerifyMessageProperties.java	300	value = org.apache.commons.text.StringEscapeUtils.unescapeHtml4(value);	CODE
CRITICAL	…uarkus/runtime/cli/UpdateCompatibilityPicocliTest.java	96	assertEquals(majorMinorOf(org.infinispan.commons.util.Version.getVersion()), info.get(CacheEmbeddedConfigProvide	CODE
CRITICAL	…uarkus/runtime/cli/UpdateCompatibilityPicocliTest.java	129	String ispnVersion = majorMinorOf(org.infinispan.commons.util.Version.getVersion());	CODE
CRITICAL	…uarkus/runtime/cli/UpdateCompatibilityPicocliTest.java	338	m.put("version", majorMinorOf(org.infinispan.commons.util.Version.getVersion()));	CODE
CRITICAL⚡	…ain/java/org/keycloak/quarkus/runtime/Environment.java	99	if (org.keycloak.common.util.Environment.isDevMode()) {	CODE
CRITICAL⚡	…ain/java/org/keycloak/quarkus/runtime/Environment.java	103	return org.keycloak.common.util.Environment.DEV_PROFILE_VALUE.equals(Configuration.getNonPersistedConfigValue(or	CODE
CRITICAL⚡	…ain/java/org/keycloak/quarkus/runtime/Environment.java	107	return org.keycloak.common.util.Environment.isDevMode();	CODE
CRITICAL⚡	…in/java/org/keycloak/quarkus/runtime/KeycloakMain.java	141	String.format("Failed to start server in (%s) mode", getKeycloakModeFromProfile(org.keycloak.common.util	CODE
CRITICAL⚡	…in/java/org/keycloak/quarkus/runtime/KeycloakMain.java	147	String.format("Failed to start server in (%s) mode", getKeycloakModeFromProfile(org.keycloak	CODE
CRITICAL⚡	…in/java/org/keycloak/quarkus/runtime/KeycloakMain.java	154	String.format("Unexpected error when starting the server in (%s) mode", getKeycloakModeFromProfile(o	CODE
CRITICAL	…c/main/java/org/keycloak/quarkus/runtime/Messages.java	38	if (!org.keycloak.common.util.Environment.DEV_PROFILE_VALUE.equals(org.keycloak.common.util.Environment.getProfi	CODE
CRITICAL	…untime/configuration/KeycloakConfigSourceProvider.java	44	String profile = org.keycloak.common.util.Environment.getProfile();	CODE
CRITICAL	…runtime/configuration/mappers/HttpPropertyMappers.java	577	if (Environment.isDevMode() \|\| org.keycloak.common.util.Environment.isNonServerMode()) {	CODE
CRITICAL	…time/configuration/mappers/CachingPropertyMappers.java	42	(value, context) -> org.keycloak.common.util.Environment.isNonServerMode()	CODE
CRITICAL	…e/configuration/mappers/HostnameV2PropertyMappers.java	59	boolean isProd = Environment.PROD_PROFILE_VALUE.equals(org.keycloak.common.util.Environment.getProfile());	CODE
CRITICAL	…ain/java/org/keycloak/quarkus/runtime/cli/Picocli.java	585	String profile = org.keycloak.common.util.Environment.getProfile();	CODE
CRITICAL	…ain/java/org/keycloak/quarkus/runtime/cli/Picocli.java	934	String profile = Optional.ofNullable(org.keycloak.common.util.Environment.getProfile())	CODE
CRITICAL	…g/keycloak/quarkus/runtime/cli/command/ShowConfig.java	63	String profile = org.keycloak.common.util.Environment.getProfile();	CODE
CRITICAL	…rkus/runtime/cli/command/AbstractAutoBuildCommand.java	56	String profile = org.keycloak.common.util.Environment.getProfile();	CODE
CRITICAL	…ders/java/org/keycloak/it/jaxrs/filter/TestFilter.java	65	// should say something like Normal scoped producer method may not return null: org.keycloak.quarkus.runtime	COMMENT
CRITICAL	…rg/keycloak/quarkus/deployment/LiquibaseProcessor.java	87	classes.removeIf(classInfo -> !org.keycloak.config.database.Database.isLiquibaseDatabaseSupported(classInfo.	CODE
CRITICAL	…g/keycloak/crypto/hash/Argon2PasswordHashProvider.java	119	org.bouncycastle.crypto.params.Argon2Parameters.Builder builder = new org.bouncycastle.crypto.params	CODE
CRITICAL	…/keycloak/crypto/elytron/test/ElytronPemUtilsTest.java	40	String encoded = org.keycloak.common.util.PemUtils.generateThumbprint(test, "SHA-1");	CODE
CRITICAL	…/keycloak/crypto/elytron/test/ElytronPemUtilsTest.java	47	String encoded = org.keycloak.common.util.PemUtils.generateThumbprint(test, "SHA-256");	CODE
CRITICAL	core/src/test/java/org/keycloak/util/PemUtilsTest.java	30	String encoded = org.keycloak.common.util.PemUtils.generateThumbprint(test, "SHA-1");	CODE
CRITICAL	core/src/test/java/org/keycloak/util/PemUtilsTest.java	37	String encoded = org.keycloak.common.util.PemUtils.generateThumbprint(test, "SHA-256");	CODE
CRITICAL	…re/src/main/java/org/keycloak/jose/jws/JWSBuilder.java	116	if (org.keycloak.crypto.Algorithm.Ed25519.equals(sigAlgName) \|\| org.keycloak.crypto.Algorithm.Ed448.equals(sigAl	CODE
CRITICAL	testsuite/integration-arquillian/HOW-TO-RUN.md	511	or not known at org.keycloak.testsuite.util.OAuthClient.doWellKnownRequest(OAuthClient.java:1032)	CODE
CRITICAL	testsuite/integration-arquillian/HOW-TO-RUN.md	512	at org.keycloak.testsuite.url.DefaultHostnameTest.assertBackendForcedToFrontendWithMatchingHostname(	CODE
CRITICAL	…va/org/keycloak/testsuite/broker/KcSamlBrokerTest.java	336	assertThat(ob, org.keycloak.testsuite.util.Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	171	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	206	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	234	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	285	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	314	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…ak/testsuite/broker/KcOIDCBrokerWithSignatureTest.java	372	KeysMetadataRepresentation.KeyMetadataRepresentation key = org.keycloak.testsuite.util.KeyUtils.findActiveSignin	CODE
CRITICAL	…/keycloak/testsuite/broker/KcSamlSignedBrokerTest.java	134	.assertResponse(org.keycloak.testsuite.util.Matchers.statusCodeIsHC(Status.BAD_REQUEST));	CODE
CRITICAL	…/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java	378	KeyPair keyPair = org.keycloak.common.util.KeyUtils.generateRsaKeyPair(2048);	CODE
CRITICAL	…/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java	391	KeyPair keyPair = org.keycloak.common.util.KeyUtils.generateRsaKeyPair(2048);	CODE
CRITICAL	…/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java	403	testUploadCertificatePEM(org.keycloak.common.util.KeyUtils.generateRsaKeyPair(2048), Algorithm.RS256, null);	CODE
CRITICAL	…/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java	413	testUploadPublicKeyPem(org.keycloak.common.util.KeyUtils.generateRsaKeyPair(2048), Algorithm.RS256, null);	CODE
CRITICAL	…/oauth/tokenexchange/ClientTokenExchangeSAML2Test.java	692	return org.keycloak.testsuite.util.KeyUtils.publicKeyFromString(keyRep.getPublicKey());	CODE
CRITICAL	…/oauth/tokenexchange/ClientTokenExchangeSAML2Test.java	696	return org.keycloak.testsuite.util.KeyUtils.privateKeyFromString(privateKey);	CODE
CRITICAL	…/org/keycloak/testsuite/forms/PasswordHashingTest.java	421	org.bouncycastle.crypto.params.Argon2Parameters parameters = new org.bouncycastle.crypto.params.Argon2Parame	CODE
CRITICAL	…/java/org/keycloak/testsuite/forms/BruteForceTest.java	582	long T1 = org.keycloak.common.util.Time.currentTimeMillis();	CODE
CRITICAL	…ava/org/keycloak/testsuite/util/AssertAdminEvents.java	300	int expectedLength = prefix.length() + 1 + org.keycloak.models.utils.KeycloakModelUtils.generateId().len	CODE
CRITICAL	…va/org/keycloak/testsuite/util/ClientPoliciesUtil.java	512	return org.keycloak.common.util.KeyUtils.generateEcKeyPair(ecDomainParamName);	CODE
CRITICAL	…est/java/org/keycloak/testsuite/util/RealmManager.java	98	rep.setCodeSecret(org.keycloak.models.utils.KeycloakModelUtils.generateCodeSecret());	CODE
CRITICAL	…eycloak/testsuite/oidc/LightWeightAccessTokenTest.java	998	runOnServerMaster.run(RunHelpers.reinitializeProviderFactoryWithSystemPropertiesScope(org.keycloak.protocol.Logi	CODE
CRITICAL	…/testsuite/adapter/servlet/SAMLServletAdapterTest.java	726	NEW_KEY_PAIR = KeyUtils.generateRsaKeyPair(org.keycloak.testsuite.util.KeyUtils.getLowestSupportedRsaKeySize	CODE
CRITICAL	…t/java/org/keycloak/testsuite/client/FAPICIBATest.java	441	requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());	CODE
CRITICAL	…t/java/org/keycloak/testsuite/client/FAPICIBATest.java	457	requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());	CODE
CRITICAL	…/test/java/org/keycloak/testsuite/client/CIBATest.java	1864	requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());	CODE
CRITICAL	…/test/java/org/keycloak/testsuite/client/CIBATest.java	1890	requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());	CODE
CRITICAL	…/test/java/org/keycloak/testsuite/client/CIBATest.java	2980	requestObject.id(org.keycloak.models.utils.KeycloakModelUtils.generateId());	CODE
CRITICAL	…te/client/policies/SamlClientPoliciesExecutorTest.java	267	org.keycloak.testsuite.util.Matchers.isSamlStatusResponse(JBossSAMLURIConstants.STATUS_S	CODE
CRITICAL	…te/client/policies/SamlClientPoliciesExecutorTest.java	291	org.keycloak.testsuite.util.Matchers.isSamlStatusResponse(JBossSAMLURIConstants.STATUS_S	CODE
CRITICAL	…te/client/policies/SamlClientPoliciesExecutorTest.java	321	org.keycloak.testsuite.util.Matchers.isSamlStatusResponse(JBossSAMLURIConstants.STATUS_S	CODE
CRITICAL	…/test/java/org/keycloak/testsuite/saml/BrokerTest.java	289	.assertResponse(org.keycloak.testsuite.util.Matchers.statusCodeIsHC(200))	CODE
104 more matches not shown…

Hyper-Verbose Identifiers166 hits · 199 pts

Severity	File	Line	Snippet	Context
LOW	js/libs/ui-shared/src/utils/errors.ts	32	export function getNetworkErrorDescription(data: unknown) {	CODE
LOW	js/apps/account-ui/test/verifiable-credentials.spec.ts	30	async function openVerifiableCredentials(page: Page, realmName: string) {	CODE
LOW	…count-ui/test/account-security/linked-accounts.spec.ts	102	async function loginWithUsernamePassword(	CODE
LOW	js/apps/account-ui/src/api/methods.ts	118	export async function deleteApplicationSessions(	CODE
LOW	js/apps/account-ui/src/api/methods.ts	196	export async function deleteVerifiableCredential(	CODE
LOW	js/apps/account-ui/src/api/methods.ts	211	export async function getIssuedVerifiableCredentials({	CODE
LOW	js/apps/account-ui/src/api/methods.ts	223	export async function revokeIssuedVerifiableCredential(	CODE
LOW	js/apps/admin-ui/test/organization/groups.ts	6	export async function selectOrgGroupActionToggleItem(page: Page, item: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	9	export async function goToClientScopeEvaluateTab(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	13	export async function goToEffectiveRoleScopeMappingsTab(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	17	export async function assertEffectiveRoleScopeMapping(	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	59	export async function assertTableCellDropdownValue(page: Page, value: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	63	export async function goToGenerateAccessTokenTab(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/scope.ts	67	export async function assertHasAccessTokenGenerated(	CODE
LOW	js/apps/admin-ui/test/clients/scope.ts	81	export async function assertNoAccessTokenGenerated(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/scope.ts	88	export async function assertHasUserInfoGenerated(page: Page, username: string) {	CODE
LOW	js/apps/admin-ui/test/clients/scope.ts	103	export async function assertHasIdTokenGenerated(page: Page, username: string) {	CODE
LOW	js/apps/admin-ui/test/clients/scope.ts	121	export async function assertNoUserInfoGenerated(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/initial-access.ts	4	export async function goToInitialAccessTokenTab(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/initial-access.ts	8	export async function assertInitialAccessTokensIsEmpty(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/initial-access.ts	14	export async function assertInitialAccessTokensIsNotEmpty(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/initial-access.ts	36	export async function assertExpirationGreaterThanZeroError(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/initial-access.ts	50	export async function checkSaveButtonIsDisabled(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/details.ts	10	function getKeyForCodeExchangeInput(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/details.ts	14	export async function selectKeyForCodeExchangeInput(page: Page, value: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/details.ts	19	export async function assertKeyForCodeExchangeInput(page: Page, value: string) {	CODE
LOW	js/apps/admin-ui/test/clients/details.ts	32	export async function enableJwtAuthorizationGrant(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/details.ts	36	export async function getJwtAuthorizationGrantIdpOptions(	CODE
LOW	js/apps/admin-ui/test/clients/authorization.ts	21	export async function clickAuthenticationSaveButton(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/authorization.ts	41	export async function assertEmptyStateNotVisible(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/authorization.ts	146	export function getEvaluateResourceKeyInput(page: Page, rowIndex = 0) {	CODE
LOW	js/apps/admin-ui/test/clients/authorization.ts	154	export function getEvaluateResourceKeyOptions(page: Page, rowIndex = 0) {	CODE
LOW	js/apps/admin-ui/test/clients/authorization.ts	209	export async function assertEvaluatePermissionScopes(	CODE
LOW⚡	js/apps/admin-ui/test/clients/registration-policies.ts	3	export async function goToClientRegistrationTab(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/registration-policies.ts	11	export async function clickCreateAnonymousPolicy(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/registration-policies.ts	15	export async function clickCreateAuthenticatedPolicy(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/role.ts	13	export async function goToCreateRoleFromEmptyState(page: Page) {	CODE
LOW	…s/admin-ui/test/clients/assign-oid4vci-client-scope.ts	51	async function clickCreateClientScopeAction(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	14	function getKeyForEncryptionAlgorithmInput(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	18	function getKeyForEncryptionKeyAlgorithmInput(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	22	function getKeyForEncryptionDigestMethodInput(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	26	function getKeyForEncryptionMaskGenerationFunctionInput(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/saml.ts	87	export async function clickEncryptionAssertions(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/saml.ts	91	export async function clickOffEncryptionAssertions(page: Page) {	CODE
LOW	js/apps/admin-ui/test/clients/saml.ts	107	export async function assertNameIdFormatDropdown(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	121	export async function selectEncryptionAlgorithmInput(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	128	export async function selectEncryptionKeyAlgorithmInput(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	135	export async function selectEncryptionDigestMethodInput(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	142	export async function selectEncryptionMaskGenerationFunctionInput(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	153	export async function assertEncryptionAlgorithm(page: Page, value: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	157	export async function assertEncryptionKeyAlgorithm(page: Page, value: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	161	export async function assertEncryptionDigestMethod(page: Page, value: string) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	165	export async function assertEncryptionMaskGenerationFunction(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	183	export async function assertEncryptionAlgorithmInputVisible(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	190	export async function assertEncryptionKeyAlgorithmInputVisible(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	197	export async function assertEncryptionDigestMethodInputVisible(	CODE
LOW⚡	js/apps/admin-ui/test/clients/saml.ts	204	export async function assertEncryptionMaskGenerationFunctionInputVisible(	CODE
LOW	js/apps/admin-ui/test/clients/advanced.ts	25	export async function assertTestClusterAvailability(	CODE
LOW⚡	js/apps/admin-ui/test/clients/advanced.ts	42	function getAccessTokenSignatureAlgorithm(page: Page) {	CODE
LOW⚡	js/apps/admin-ui/test/clients/advanced.ts	46	export async function selectAccessTokenSignatureAlgorithm(	CODE
106 more matches not shown…

Structural Annotation Overuse68 hits · 126 pts

Severity	File	Line	Snippet	Context
LOW⚡	…est/java/org/keycloak/testsuite/oauth/par/ParTest.java	316	// Step 1 - Login as regular user and obtain sessionId	COMMENT
LOW⚡	…est/java/org/keycloak/testsuite/oauth/par/ParTest.java	324	// Step 2: PAR request with some custom injected parameters	COMMENT
LOW	…est/java/org/keycloak/testsuite/oauth/par/ParTest.java	339	// Step 3: Attempt to exchange code for token with the "fake code" from PAR	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	571	// Step 1: Login and change email (triggers verification due to realm verification setting)	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	587	// Step 2: Logout and login again (should show pending verification message)	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	599	// Step 3: Complete verification to ensure cache is cleared	COMMENT
LOW⚡	…keycloak/tests/oid4vc/OID4VCRefreshCredentialTest.java	910	// Step 2: Exchange Token-A → Token-B (first refresh — should succeed)	COMMENT
LOW⚡	…keycloak/tests/oid4vc/OID4VCRefreshCredentialTest.java	918	// Step 3: Replay Token-A — should be REJECTED because it was already consumed	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	472	// Step 1: Request token without authorization_details parameter (no scope needed)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	501	// Step 2: Request the actual credential using ONLY the identifier (no credential_configuration_id)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	537	// Step 3: Verify that the issued credential structure is valid	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	555	// Step 1: Get pre-authorized code token	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	572	// Step 2: Verify token works at credential endpoint (should succeed)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	585	// Step 3: Verify token is rejected at Account REST API endpoint (uses BearerTokenAuthenticator)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	599	// Step 4: Verify token is rejected at Admin REST API endpoint (uses BearerTokenAuthenticator)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	637	// Step 1: Request token without authorization_details parameter	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	710	// Step 1: Request token with authorization details containing specific claims	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	750	// Step 2: Request the actual credential using the identifier and config id	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	787	// Step 3: Verify that the issued credential contains the requested claims AND may contain additional claims	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	166	// Step 1: First login with OID4VCI (should return authorization_details)	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	171	// Step 2: Logout and clear cookies to isolate sessions strictly	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	178	// Step 3: Second login - Regular SSO (should NOT return authorization_details)	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	190	// Step 4: Second token must NOT have authorization_details	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	194	// Step 5: Credential request with second token must fail	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	114	// Step 2: Perform authorization with PAR	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	122	// Step 3: Exchange authorization code for tokens (WITHOUT authorization_details in token request)	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	130	// Step 4: Verify authorization_details is present in token response	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	269	// Step 2: Perform authorization with PAR	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	277	// Step 3: Exchange authorization code for tokens	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	284	// Step 4: Verify authorization_details are derived from requested OID4VC scope	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	84	// Step 1: Create PAR request with authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	154	// Step 5: Request the actual credential using the identifier	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	170	// Step 1: Create PAR request with INVALID authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	192	// Step 2: Perform authorization with PAR	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	209	// Step 1: Create PAR request with authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	240	// Step 2: Perform authorization with PAR	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	257	// Step 1: Create PAR request WITHOUT authorization_details	COMMENT
LOW	…oak/tests/oauth/OfflineTokenSessionManagementTest.java	312	// Step 1 - online login with "tets-app"	COMMENT
LOW⚡	…oak/tests/oauth/OfflineTokenSessionManagementTest.java	324	// Step 2 - offline login with "offline-client"	COMMENT
LOW⚡	…oak/tests/oauth/OfflineTokenSessionManagementTest.java	334	// Step 3 - set some offset to refresh SSO session and offline user session. But use different client, so th	COMMENT
LOW⚡	…oak/tests/oauth/OfflineTokenSessionManagementTest.java	344	// Step 4 - set bigger time offset and login with the original client "offline-token". Login should be succe	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	214	// Step 1: Interactive login to establish an SSO session	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	218	// Step 2: Push a new PAR request	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	223	// Step 3: First use of request_uri with prompt=none — must succeed via silent auth	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	232	// Step 4: Replay the same request_uri — must be rejected (PAR already consumed)	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	236	// Step 5: Verify the code from the first (legitimate) use is still valid	COMMENT
LOW⚡	…oak/tests/model/AuthenticationSessionProviderTest.java	357	// Step 1: Create session at base time	COMMENT
LOW⚡	…oak/tests/model/AuthenticationSessionProviderTest.java	364	// Step 2: Refresh timestamp at +25 (middle of first 50-second coarse bucket).	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	383	// Step 3: At +112, threshold = T0+12. coarse = T0 < T0+12 (candidate), but	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	400	// Step 4: Run expiration again at the same time. Coarse is now corrected to the	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	413	// Step 5: At +135, threshold = T0+35 > timestamp T0+25. Truly expired. Deleted.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1051	// Step 1: Create a session at the current time	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1060	// Step 2: Advance time to just before the next coarse boundary and refresh.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1080	// Step 3: Advance time so threshold falls between coarse and exact.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1090	// Step 4: Verify the session survived and its coarse value was advanced	COMMENT
LOW	…/org/keycloak/tests/model/UserSessionProviderTest.java	1101	// Step 5: Run expiration again at the same time — coarse is now above threshold	COMMENT
LOW	…/org/keycloak/tests/model/UserSessionProviderTest.java	1116	// Step 6: Advance time far enough that lastSessionRefresh is truly expired	COMMENT
LOW⚡	…eycloak/tests/account/AccountRestServiceRolesTest.java	223	// Step 1: GET login page, capture cookies from response	COMMENT
LOW⚡	…eycloak/tests/account/AccountRestServiceRolesTest.java	228	// Step 2: Extract action URL and POST credentials with cookies	COMMENT
LOW	…eycloak/tests/account/AccountRestServiceRolesTest.java	248	// Step 3: Fetch account console HTML with session cookies	COMMENT
8 more matches not shown…

Fake / Example Data101 hits · 114 pts

Severity	File	Line	Snippet	Context
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	199	rep.getSmtpServer().put("from", "keycloak@example.org");	CODE
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	200	rep.getSmtpServer().put("replyTo", "noreply@example.org");	CODE
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	201	rep.getSmtpServer().put("envelopeFrom", "bounce@example.org");	CODE
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	266	assertEquals("keycloak@example.org", rep.getSmtpServer().get("from"));	CODE
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	267	assertEquals("noreply@example.org", rep.getSmtpServer().get("replyTo"));	CODE
LOW⚡	…a/org/keycloak/models/utils/StripSecretsUtilsTest.java	268	assertEquals("bounce@example.org", rep.getSmtpServer().get("envelopeFrom"));	CODE
LOW	…rc/test/java/org/keycloak/tests/scim/tck/UserTest.java	328	assertEquals("John Doe", actual.getName().getFormatted());	CODE
LOW	core/src/test/resources/sdjwt/s3.3-holder-claims.json	8	"street_address": "123 Main St",	CODE
LOW	core/src/test/resources/sdjwt/s6.1-holder-claims.json	9	"street_address": "123 Main St",	CODE
LOW	…src/test/java/org/keycloak/sdjwt/JsonClaimsetTest.java	55	String expected_street_address_claim = "123 Main St";	CODE
LOW	js/libs/keycloak-admin-client/README.md	59	email: 'user@example.com',	CODE
LOW	js/libs/keycloak-admin-client/test/realms.spec.ts	430	user.email = "test@test.com";	CODE
LOW	js/apps/admin-ui/test/clients/initial-access.spec.ts	77	await searchItem(page, placeHolder, "John Doe");	CODE
LOW	js/apps/admin-ui/test/clients/main.spec.ts	115	await searchItem(page, placeHolder, "John Doe");	CODE
LOW	…pps/admin-ui/test/client-scope/oid4vci-mappers.spec.ts	150	"user@example.com",	CODE
LOW	js/apps/admin-ui/src/clients/ssf/tabs/SubjectsTab.tsx	257	? "user@example.com"	CODE
LOW	js/apps/admin-ui/src/clients/ssf/tabs/EmitEventsTab.tsx	135	// from "user@example.com" to "user-uuid" / "username" / "org-alias"	COMMENT
LOW	js/apps/admin-ui/src/clients/ssf/tabs/EmitEventsTab.tsx	414	? "user@example.com"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	5	"description": "Lorem ipsum dolor sit amet",	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	5	"description": "Lorem ipsum dolor sit amet",	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	14	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	14	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	19	"description": "Lorem ipsum dolor sit"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	24	"description": "Lorem ipsum dolor sit, consecte"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	29	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	29	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	34	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	34	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	39	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	39	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	44	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	44	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	49	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	49	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	54	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	54	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	59	"description": "Lorem ipsum dolor sit "	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	64	"description": "Lorem ipsum dolor sit amet, consecte occaecat"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	64	"description": "Lorem ipsum dolor sit amet, consecte occaecat"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	69	"description": "Lorem ipsum dolor sit amet, consecte"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	69	"description": "Lorem ipsum dolor sit amet, consecte"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	74	"description": "Lorem ipsum dolor"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	79	"description": "Lorem ipsum dolor sit amet"	CODE
LOW⚡	…pps/admin-ui/src/realm-roles/__tests__/mock-roles.json	79	"description": "Lorem ipsum dolor sit amet"	CODE
LOW	…s/admin-ui/src/realm-settings/themes/PreviewWindow.tsx	41	Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	…s/admin-ui/src/realm-settings/themes/PreviewWindow.tsx	41	Lorem ipsum dolor sit amet, consectetur adipiscing elit.	CODE
LOW	…cloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java	161	createUser(bc.providerRealmName(), username, BrokerTestConstants.USER_PASSWORD, firstname, lastname, "firstnamel	CODE
LOW	…cloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java	806	createUser(bc.providerRealmName(), expectedBrokeredUserName, BrokerTestConstants.USER_PASSWORD, "f", "l", "fl@ex	CODE
LOW	…cloak/testsuite/broker/KcOidcFirstBrokerLoginTest.java	833	createUser(bc.providerRealmName(), expectedBrokeredUserName, BrokerTestConstants.USER_PASSWORD, "f", "l", "fl@ex	CODE
LOW	…testsuite/broker/KcSamlUsernameTemplateMapperTest.java	124	updateAccountInformationPage.updateAccountInformation("valid-username", "user@example.com", "John", "Doe");	CODE
LOW	…k/testsuite/broker/KcSamlXPathAttributeMapperTest.java	124	assertThat(user.getEmail(), equalTo("test@example.org"));	CODE
LOW	…st/java/org/keycloak/testsuite/forms/RegisterTest.java	685	registerPage.openWithLoginHint("test@test.com");	CODE
LOW	…st/java/org/keycloak/testsuite/forms/RegisterTest.java	687	assertEquals("test@test.com", registerPage.getEmail());	CODE
LOW	…cloak/testsuite/forms/RegisterWithUserProfileTest.java	334	Assertions.assertEquals("Example.", driver.findElement(By.cssSelector("input#placeholderAttribute")).getAttribut	CODE
LOW	…st/java/org/keycloak/testsuite/oidc/OIDCScopeTest.java	232	Assertions.assertEquals("John Doe", idToken.getName());	CODE
LOW	…ite/federation/UserStorageGracefulDegradationTest.java	89	localUser3.setEmail("admin@example.com");	CODE
LOW	…/federation/ldap/LDAPSearchForUsersPaginationTest.java	220	ldapObject.setSingleAttribute("mail", "outsideuser@example.org");	CODE
LOW	…/test/java/org/keycloak/testsuite/client/CIBATest.java	430	bindingMessage = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt	CODE
LOW	…/test/java/org/keycloak/testsuite/client/CIBATest.java	430	bindingMessage = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt	CODE
LOW	…ycloak/testsuite/validation/BuiltinValidatorsTest.java	174	Assertions.assertTrue(validator.validate("admin@example.org", "email").isValid());	CODE
41 more matches not shown…

Verbosity Indicators58 hits · 106 pts

Severity	File	Line	Snippet	Context
LOW	…/resource/schema/attribute/ComplexAttributeSetter.java	48	// for now lists can only be of complex types, so we need to check if the return type is assignable	COMMENT
LOW⚡	…est/java/org/keycloak/testsuite/oauth/par/ParTest.java	324	// Step 2: PAR request with some custom injected parameters	COMMENT
LOW	…est/java/org/keycloak/testsuite/oauth/par/ParTest.java	339	// Step 3: Attempt to exchange code for token with the "fake code" from PAR	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	571	// Step 1: Login and change email (triggers verification due to realm verification setting)	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	587	// Step 2: Logout and login again (should show pending verification message)	COMMENT
LOW	…RequiredActionUpdateEmailTestWithVerificationTest.java	599	// Step 3: Complete verification to ensure cache is cleared	COMMENT
LOW⚡	…keycloak/tests/oid4vc/OID4VCRefreshCredentialTest.java	910	// Step 2: Exchange Token-A → Token-B (first refresh — should succeed)	COMMENT
LOW⚡	…keycloak/tests/oid4vc/OID4VCRefreshCredentialTest.java	918	// Step 3: Replay Token-A — should be REJECTED because it was already consumed	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	472	// Step 1: Request token without authorization_details parameter (no scope needed)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	501	// Step 2: Request the actual credential using ONLY the identifier (no credential_configuration_id)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	537	// Step 3: Verify that the issued credential structure is valid	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	555	// Step 1: Get pre-authorized code token	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	572	// Step 2: Verify token works at credential endpoint (should succeed)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	585	// Step 3: Verify token is rejected at Account REST API endpoint (uses BearerTokenAuthenticator)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	599	// Step 4: Verify token is rejected at Admin REST API endpoint (uses BearerTokenAuthenticator)	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	637	// Step 1: Request token without authorization_details parameter	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	710	// Step 1: Request token with authorization details containing specific claims	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	750	// Step 2: Request the actual credential using the identifier and config id	COMMENT
LOW	…uth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java	787	// Step 3: Verify that the issued credential contains the requested claims AND may contain additional claims	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	166	// Step 1: First login with OID4VCI (should return authorization_details)	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	171	// Step 2: Logout and clear cookies to isolate sessions strictly	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	178	// Step 3: Second login - Regular SSO (should NOT return authorization_details)	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	190	// Step 4: Second token must NOT have authorization_details	COMMENT
LOW⚡	…d4vc/issuance/OID4VCAuthorizationCodeFlowTestBase.java	194	// Step 5: Credential request with second token must fail	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	114	// Step 2: Perform authorization with PAR	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	122	// Step 3: Exchange authorization code for tokens (WITHOUT authorization_details in token request)	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	130	// Step 4: Verify authorization_details is present in token response	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	269	// Step 2: Perform authorization with PAR	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	277	// Step 3: Exchange authorization code for tokens	COMMENT
LOW⚡	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	284	// Step 4: Verify authorization_details are derived from requested OID4VC scope	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	84	// Step 1: Create PAR request with authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	154	// Step 5: Request the actual credential using the identifier	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	170	// Step 1: Create PAR request with INVALID authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	192	// Step 2: Perform authorization with PAR	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	209	// Step 1: Create PAR request with authorization_details	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	240	// Step 2: Perform authorization with PAR	COMMENT
LOW	…ce/signing/OID4VCAuthorizationCodeFlowWithPARTest.java	257	// Step 1: Create PAR request WITHOUT authorization_details	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	214	// Step 1: Interactive login to establish an SSO session	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	218	// Step 2: Push a new PAR request	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	223	// Step 3: First use of request_uri with prompt=none — must succeed via silent auth	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	232	// Step 4: Replay the same request_uri — must be rejected (PAR already consumed)	COMMENT
LOW⚡	…rc/test/java/org/keycloak/tests/oauth/par/ParTest.java	236	// Step 5: Verify the code from the first (legitimate) use is still valid	COMMENT
LOW⚡	…oak/tests/model/AuthenticationSessionProviderTest.java	357	// Step 1: Create session at base time	COMMENT
LOW⚡	…oak/tests/model/AuthenticationSessionProviderTest.java	364	// Step 2: Refresh timestamp at +25 (middle of first 50-second coarse bucket).	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	383	// Step 3: At +112, threshold = T0+12. coarse = T0 < T0+12 (candidate), but	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	400	// Step 4: Run expiration again at the same time. Coarse is now corrected to the	COMMENT
LOW	…oak/tests/model/AuthenticationSessionProviderTest.java	413	// Step 5: At +135, threshold = T0+35 > timestamp T0+25. Truly expired. Deleted.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1051	// Step 1: Create a session at the current time	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1060	// Step 2: Advance time to just before the next coarse boundary and refresh.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1080	// Step 3: Advance time so threshold falls between coarse and exact.	COMMENT
LOW⚡	…/org/keycloak/tests/model/UserSessionProviderTest.java	1090	// Step 4: Verify the session survived and its coarse value was advanced	COMMENT
LOW	…/org/keycloak/tests/model/UserSessionProviderTest.java	1101	// Step 5: Run expiration again at the same time — coarse is now above threshold	COMMENT
LOW	…/org/keycloak/tests/model/UserSessionProviderTest.java	1116	// Step 6: Advance time far enough that lastSessionRefresh is truly expired	COMMENT
LOW⚡	…eycloak/tests/account/AccountRestServiceRolesTest.java	223	// Step 1: GET login page, capture cookies from response	COMMENT
LOW⚡	…eycloak/tests/account/AccountRestServiceRolesTest.java	228	// Step 2: Extract action URL and POST credentials with cookies	COMMENT
LOW	…eycloak/tests/account/AccountRestServiceRolesTest.java	248	// Step 3: Fetch account console HTML with session cookies	COMMENT
LOW⚡	…va/org/keycloak/tests/login/LoginErrorMessageTest.java	77	// Step 1: enter valid username on the username-only page	COMMENT
LOW⚡	…va/org/keycloak/tests/login/LoginErrorMessageTest.java	83	// Step 2: UsernamePasswordForm renders with username hidden (user was pre-set).	COMMENT

Over-Commented Block68 hits · 68 pts

Severity	File	Line	Snippet	Context
LOW	quarkus/set-quarkus-version.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…rage/database/liquibase/QuarkusJpaUpdaterProvider.java	241	// target database already has the table and the DDL would fail the script with "already exists".	COMMENT
LOW	…eycloak/quarkus/runtime/logging/KeycloakLogFilter.java	161	// departure always leaves at least one live owner, so this is expected during rolling restarts.	COMMENT
LOW	js/util/gh-dependabot-failure-stats.sh	1	#!/usr/bin/env bash	COMMENT
LOW	js/apps/account-ui/src/i18n-type.ts	1	// This type is aliased to any, so that we can find all the places where we use it.	COMMENT
LOW	…ycloak/client/registration/cli/commands/UpdateCmd.java	121	}	COMMENT
LOW	…ycloak/client/registration/cli/commands/UpdateCmd.java	141	//	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	141	*	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	181	// ----- Token Request -----	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	241	// - [2] attach dpop_jkt to Req Obj: YES (RSA)	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	261	// ----- PAR -----	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	321	// - [3] attach dpop_jkt to Form Param: YES (RSA)	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	361	public void testSuccess_Proof_ReqObj_QueryParam() throws Exception {	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	401	assertEquals(200, res.getStatusCode());	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	521	assertEquals("DPoP Proof public key thumbprint does not match dpop_jkt.", pResp.getErrorDescription());	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	561	assertEquals(200, res.getStatusCode());	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	601	dpopProofEncoded = generateSignedDPoPProof(UUID.randomUUID().toString(), HttpMethod.POST, oauth.getEndpoints().g	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	641		COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	701	// Authz Endpoint:	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	741	// - [2] attach dpop_jkt to Req Obj: YES (RSA)	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	781	// PAR Endpoint:	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	821	// - [1] attach DPoP Proof: NO	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	861	// - [2] attach dpop_jkt to Req Obj: No	COMMENT
LOW	…/org/keycloak/testsuite/oauth/par/ParWithDPoPTest.java	901	// Authz Endpoint:	COMMENT
LOW	…eycloak/testsuite/forms/AuthenticatorSubflowsTest.java	301	//	COMMENT
LOW	…oak/testsuite/federation/ldap/LDAPGroupMapperTest.java	1341	GroupModel defaultGroup11 = KeycloakModelUtils.findGroupByPath(session, appRealm, "/defaultGroup1/defaultGro	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	141	// public void testDailyEviction() {	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	161	//	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	181	// testIsCached();	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	201	// });	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	221	// RoleModel hardcoded = realm.getRole("hardcoded-role");	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	241	// RealmModel realm = session.realms().getRealmByName("test");	COMMENT
LOW	…loak/testsuite/federation/storage/RoleStorageTest.java	261	// model.setCachePolicy(CacheableStorageProviderModel.CachePolicy.DEFAULT);	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	141	// model.setEvictionHour(eviction.get(HOUR_OF_DAY));	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	161	// RoleStorageProviderModel model = realm.getRoleStorageProviders().get(0);	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	181	//	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	201	// testNotCached();	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	221	// testingClient.server().run(session -> {	COMMENT
LOW	…oak/testsuite/federation/storage/GroupStorageTest.java	241	//	COMMENT
LOW	…/java/org/keycloak/testsuite/auth/page/AuthServer.java	41	}	COMMENT
LOW	…/test/java/org/keycloak/tests/cli/admin/KcAdmTest.java	101	Assertions.assertTrue(exe.stdoutLines().size() > 10, "help message returned");	COMMENT
LOW	…/transmitter/DefaultSsfTransmitterProviderFactory.java	281	if (deliveredRetentionStr != null) {	COMMENT
LOW	…ransmitter/stream/StreamConfigInputRepresentation.java	41	// Per SSF §8.1.1.1 these are transmitter-supplied — a spec-compliant	COMMENT
LOW	…org/keycloak/ssf/transmitter/stream/StreamService.java	161	// configuration the receiver actually supplied.	COMMENT
LOW	…org/keycloak/ssf/transmitter/stream/StreamService.java	901	// If the merge flipped the delivery channel (e.g. PUSH → POLL),	COMMENT
LOW	…org/keycloak/ssf/transmitter/stream/StreamService.java	1421	// transmit AND "will not hold any events	COMMENT
LOW	…keycloak/ssf/transmitter/emit/EventEmitterService.java	101	}	COMMENT
LOW	…keycloak/ssf/transmitter/emit/EventEmitterService.java	161	"Stream has no delivery method configured — configure push or poll delivery for the stream first");	COMMENT
LOW	…keycloak/ssf/transmitter/emit/EventEmitterService.java	201	if (complex.getTenant() != null && resolved.organization() == null) {	COMMENT
LOW	…keycloak/ssf/transmitter/emit/EventEmitterService.java	221	// callers and the admin UI to render a translated	COMMENT
LOW	…ak/ssf/transmitter/event/SecurityEventTokenMapper.java	461	// Resolved the way SsfTransmitterEventListener resolves it, from the admin	COMMENT
LOW	…ak/ssf/transmitter/event/SecurityEventTokenMapper.java	1061	// for the cases that must NOT map: access-token revocation	COMMENT
LOW	…ssf/transmitter/event/SsfTransmitterEventListener.java	101	// userId or an unresolvable user bypasses the pre-check and	COMMENT
LOW	…ssf/transmitter/event/SsfTransmitterEventListener.java	261	// attribute or an external policy) doesn't get redundant	COMMENT
LOW	…f/transmitter/SsfTransmitterStreamManagementTests.java	141	@InjectRunOnServer	COMMENT
LOW	…f/transmitter/SsfTransmitterStreamManagementTests.java	1441	// client (authResult.client()) and resource owner	COMMENT
LOW	…s/ssf/transmitter/SsfTransmitterEventEmitterTests.java	161	// pipeline reads. Tests that exercise the 403 branches override	COMMENT
LOW	…s/ssf/transmitter/SsfTransmitterEventEmitterTests.java	1121	@Test	COMMENT
LOW	…/org/keycloak/ssf/services/admin/SsfAdminResource.java	1041	// same format the admin UI role picker produces: plain	COMMENT
LOW	…/org/keycloak/ssf/services/admin/SsfAdminResource.java	1081	// routes user subjects through the mapper (honoring the	COMMENT
8 more matches not shown…

Decorative Section Separators9 hits · 38 pts

Severity	File	Line	Snippet	Context
MEDIUM	…va/org/keycloak/services/client/SimpleClientModel.java	18	// ── Identity ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…va/org/keycloak/services/client/SimpleClientModel.java	25	// ── Flags ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	39	// ── URLs ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	46	// ── Auth ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	54	// ── Attributes & flow overrides ───────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	58	// ── Scopes ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	63	// ── Protocol mappers ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	66	// ── Registered nodes ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…va/org/keycloak/services/client/SimpleClientModel.java	69	// ── Timestamps ────────────────────────────────────────────────────────────	COMMENT

AI Slop Vocabulary8 hits · 24 pts

Severity	File	Line	Snippet	Context
MEDIUM	…rg/keycloak/quarkus/runtime/cli/NonRunningPicocli.java	15	// TODO: could utilize CLIResult	COMMENT
MEDIUM	…in/java/org/keycloak/testsuite/utils/tls/TLSUtils.java	51	// Essentially, this is REQUEST CLIENT AUTH behavior. It doesn't fail if the client doesn't have a cert.	COMMENT
MEDIUM	…rg/keycloak/testsuite/forms/MultipleTabsLoginTest.java	448	// seamless login in the second tab, user already authenticated	COMMENT
MEDIUM	…rg/keycloak/testsuite/forms/MultipleTabsLoginTest.java	461	// seamless authentication in the first tab	COMMENT
MEDIUM	…/test/java/org/keycloak/tests/admin/AdminRootTest.java	48	// This might not be robust enough. If something made KC on a different port, this would fail.	COMMENT
MEDIUM	…c/main/java/org/keycloak/common/util/NetworkUtils.java	52	// Definitely not an IPv6, return untouched input.	COMMENT
MEDIUM	…c/main/java/org/keycloak/common/util/NetworkUtils.java	80	// Definitely not an IPv6, return untouched input.	COMMENT
MEDIUM	…cators/client/AttestationBasedClientAuthenticator.java	500	// [TODO] The authorization server can utilize the jti value for replay attack detection	COMMENT

Self-Referential Comments7 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/codeql/codeql-config-javascript.yml	2	# This file is invalid on purpose for testing. Exclude it to prevent an "Unexpected token" error in CodeQL being repor	COMMENT
MEDIUM	.github/codeql/codeql-config-typescript.yml	2	# This file is invalid on purpose for testing. Exclude it to prevent an "Unexpected token" error in CodeQL being repor	COMMENT
MEDIUM	.github/scripts/aws/rds/aurora_create.sh	20	# Create the Aurora VPC	COMMENT
MEDIUM	.github/scripts/aws/rds/aurora_create.sh	31	# Create the Aurora Subnets	COMMENT
MEDIUM	.github/scripts/aws/rds/aurora_create.sh	68	# Create an Aurora VPC Security Group	COMMENT
MEDIUM	.github/scripts/aws/rds/aurora_create.sh	104	# Create the Aurora DB cluster and instance	COMMENT
MEDIUM	operator/scripts/prepare-olm-test.sh	28	# Create the test-catalog	COMMENT

Cross-File Repetition4 hits · 20 pts

Severity	File	Snippet	Context
HIGH	…/keycloak/tests/admin/cli/v2/KcAdmV2ClientCLITest.java	{ "protocol": "%s", "clientid": "different-client-id", "enabled": true }	STRING
HIGH	…dmin/client/v2/validation/PutClientValidationTest.java	{ "protocol": "%s", "clientid": "different-client-id", "enabled": true }	STRING
HIGH	…min/client/v2/validation/PostClientValidationTest.java	{ "protocol": "%s", "clientid": "different-client-id", "enabled": true }	STRING
HIGH	…client/v2/validation/AbstractClientValidationTest.java	{ "protocol": "%s", "clientid": "different-client-id", "enabled": true }	STRING

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…s/clientpolicy/executor/RejectMayActClaimExecutor.java	171	// the consent note keeps the parameter exactly as requested, so find the granted scope instead of rebuilding it	COMMENT

Slop Phrases3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	…xecutor/SecureRedirectUrisEnforcerExecutorFactory.java	140	"Don't forget to use escaping of special characters like dots as otherwise dot is interpreted as any cha	CODE
LOW	…ervices/resources/admin/RealmLocalizationResource.java	203	// this fallback is no longer needed since the fix for #15845, don't forget to remove it from the API	COMMENT
LOW	…ervices/resources/admin/RealmLocalizationResource.java	203	// this fallback is no longer needed since the fix for #15845, don't forget to remove it from the API	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	.github/actions/conditional/conditional.sh	59	# Check if changed files matches regex	COMMENT
LOW	…tions/testsuite-deprecation-check/deprecation-check.sh	16	# Check if changed files matches regex	COMMENT

keycloak/keycloak

Open-Source Code Quality, Security and Technical Debt Review