3.5

Adjusted Signal

3.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

89.8K

Stars

TypeScript

Language

1.3M

Lines of Code

3.7K

Files

3.7K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 3175 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 124 finding(s).

Agent Over-Engineering Ratio 10.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2262 finding(s).

PR Review Velocity Impact 15.8/100 · LOW

Which changes need focused human review? 3671 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 11MEDIUM 406LOW 3250

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3671 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1890 hits · 1943 pts

Severity	File	Line	Snippet	Context
LOW	middleware.ts	121	function hasLegacyDashboardRootState(searchParams: URLSearchParams): boolean {	CODE
LOW	middleware.ts	125	function hasUnboundedDashboardRootState(searchParams: URLSearchParams): boolean {	CODE
LOW	middleware.ts	206	function uaConditionedRedirectHeaders(location: URL): Record<string, string> {	CODE
LOW	vite.config.ts	308	function dashboardHtmlOutputPlugin(): Plugin {	CODE
LOW	vite.config.ts	342	function firstPartyChunkManifestPlugin(): Plugin {	CODE
LOW	vite.config.ts	362	function chunkSizeWarningPolicyPlugin(): Plugin {	CODE
LOW	vite.config.ts	392	function variantDashboardHtmlPlugin(): Plugin {	CODE
LOW	vite.config.ts	413	function shouldDeferDashboardStylesheet(tag: string, bundle: OutputBundle): boolean {	CODE
LOW	vite.config.ts	439	function deferDashboardStylesheetLinks(html: string, bundle: OutputBundle): string {	CODE
LOW	vite.config.ts	918	function webMcpDevSecurityHeadersPlugin(): Plugin {	CODE
LOW	pro-test/vite.config.ts	21	function isWelcomeHydrationPreload(dep: string) {	CODE
LOW	pro-test/src/i18n.ts	84	export function pinnedWelcomeContentLanguage(): SupportedLanguage \| null {	CODE
LOW	pro-test/src/i18n.ts	185	export function effectiveWelcomeContentLanguage(): string {	CODE
LOW	pro-test/src/debugbear-rum.ts	95	export function resetDebugBearRumForTesting(): void {	CODE
LOW	pro-test/src/welcome-document.ts	92	function isCanonicalOrHreflangLink(tag: string): boolean {	CODE
LOW	pro-test/src/welcome-document.ts	98	function rewriteCanonicalAndHreflang(html: string, canonical: string): string {	CODE
LOW	pro-test/src/welcome-language.ts	37	export function resolveEffectiveWelcomeContentLanguage(	CODE
LOW	pro-test/src/sentry-filter-policy.ts	68	export function sanitizeMarketingRequestUrl(value: string): string \| undefined {	CODE
LOW	pro-test/src/static-i18n-guard.ts	1	export function throwOnMissingStaticTranslation(key: string): never {	CODE
LOW	pro-test/src/services/checkout-intent-url.ts	44	export function parseCheckoutIntentFromSearch(search: string): CheckoutIntentFromUrl \| null {	CODE
LOW	pro-test/src/services/checkout-intent-url.ts	70	export function stripCheckoutIntentFromSearch(search: string): string {	CODE
LOW	pro-test/src/services/checkout-transport.ts	84	export function createDefaultCheckoutTransportDeps(): CreateCheckoutTransportDeps {	CODE
LOW	pro-test/src/services/clerk-dom-safety.ts	73	export function collectRemoveChildEvidence(source: RemoveChildEvidenceSource): RemoveChildEvidence {	CODE
LOW	pro-test/src/services/clerk-dom-safety.ts	158	export function protectClerkDomFromTranslators(doc: Document = document): () => void {	CODE
LOW	pro-test/src/services/clerk-dom-safety.ts	201	export function protectReactRootFromTranslators(root: Element): void {	CODE
LOW	pro-test/src/services/clerk-dom-safety.ts	205	function isInsideClerkTranslatorProtectedRoot(node: unknown): boolean {	CODE
LOW	pro-test/src/services/clerk-dom-safety.ts	223	export function installDetachedNodeGuards(	CODE
LOW	pro-test/src/services/checkout.ts	85	function persistFunnelEventForReplay(event: string, data?: Record<string, unknown>): void {	CODE
LOW	pro-test/src/services/checkout.ts	99	function clearPersistedFunnelEvents(): void {	CODE
LOW	pro-test/src/services/checkout.ts	176	function bucketProductIdForAnalytics(productId: string): string {	CODE
LOW	pro-test/src/services/checkout.ts	222	function currentCheckoutRateLimitSeconds(): number {	CODE
LOW	pro-test/src/services/checkout.ts	227	function activateCheckoutRateLimit(retryAfterHeader: string \| null): number {	CODE
LOW	pro-test/src/services/checkout.ts	645	function mountCheckoutInterstitial(): void {	CODE
LOW	pro-test/src/services/checkout.ts	683	function unmountCheckoutInterstitial(): void {	CODE
LOW	pro-test/src/services/checkout.ts	758	function showCheckoutRateLimitToast(retryAfterSeconds: number): void {	CODE
LOW	pro-test/src/services/checkout.ts	813	function prereserveBillingPortalTab(): Window \| null {	CODE
LOW	pro-test/src/services/checkout.ts	873	function resolveProPlanDisplayName(planKey: unknown): string {	CODE
LOW	pro-test/src/services/checkout.ts	912	function showProDuplicateSubscriptionDialog(options: ProDuplicateDialogOptions): void {	CODE
LOW	pro-test/src/services/checkout.ts	991	function showProPendingPaymentDialog(options: ProDuplicateDialogOptions): void {	CODE
LOW	pro-test/src/services/welcome-redirect.ts	10	export function welcomeDashboardRedirectTarget(location: Pick<WelcomeRedirectLocation, 'search' \| 'hash'>): string {	CODE
LOW	pro-test/src/services/welcome-redirect.ts	14	export function maybeRedirectWelcomeVisitor(	CODE
LOW	pro-test/src/services/checkout-rate-limit.ts	9	export function parseCheckoutRetryAfterSeconds(	CODE
LOW	pro-test/src/services/checkout-rate-limit.ts	25	export function checkoutRetryRemainingSeconds(	CODE
LOW	pro-test/src/services/clerk-user-state.ts	19	function applyClientSessionBaseline(current: ClerkUserState, signedIn: boolean): ClerkUserState {	CODE
LOW	server/request-validator.ts	153	export function collapseAdjacentClassQuantifiers(source: string): string {	CODE
LOW	server/auth-session.ts	30	export function getClerkJwtVerifyBaseOptions() {	CODE
LOW	server/auth-session.ts	161	export function isAllowedClerkAuthorizedParty(azp: string): boolean {	CODE
LOW	server/auth-session.ts	306	export async function verifiedSubjectIgnoringExpiry(token: string): Promise<string \| null \| 'unverifiable'> {	CODE
LOW	server/cors.ts	124	function isWorldMonitorGoogleTranslateOrigin(origin: string): boolean {	CODE
LOW	server/cors.ts	167	export function getOriginDeniedCorsHeaders(req: Request): Record<string, string> {	CODE
LOW	server/gateway.ts	178	function internalMcpSignatureDenial(corsHeaders: Record<string, string>): Response {	CODE
LOW	server/gateway.ts	207	function getRateLimitTelemetryReason(	CODE
LOW	server/gateway.ts	217	async function claimInternalMcpReplayNonce(userId: string, nonce: string): Promise<InternalMcpReplayClaim> {	CODE
LOW	server/gateway.ts	667	function isPostToGetCompatibleBodySize(headers: Headers): boolean {	CODE
LOW	server/gateway.ts	753	function applyPostToGetCompatFields(searchParams: URLSearchParams, fields: PostToGetCompatField[]): void {	CODE
LOW	server/gateway.ts	782	function getRequiredBboxQueryProblems(searchParams: URLSearchParams): { missing: string[]; invalid: string[]; allZero: b	CODE
LOW	server/gateway.ts	819	function getRequiredBboxDiagnostic(request: Request, pathname: string): RequiredBboxDiagnostic \| null {	CODE
LOW	server/gateway.ts	833	function attachRequiredBboxDiagnosticHeaders(	CODE
LOW	server/gateway.ts	863	function stripClientTrustedHeaders(request: Request): Request {	CODE
LOW	server/gateway.ts	885	function withTrustedRateLimitPrincipal(	CODE
1830 more matches not shown…

Decorative Section Separators368 hits · 1106 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	docker-compose.yml	1	# =============================================================================	COMMENT
MEDIUM⚡	docker-compose.yml	3	# =============================================================================	COMMENT
MEDIUM⚡	docker-compose.yml	11	# =============================================================================	COMMENT
MEDIUM	server/gateway.ts	1741	// ── Partner-embed keys (`wme_`) ─────────────────────────────────────────	COMMENT
MEDIUM	server/gateway.ts	1852	// ── Active-subscription gate for user API keys (#4611) ──────────────────	COMMENT
MEDIUM	server/gateway.ts	1852	// ── Active-subscription gate for user API keys (#4611) ──────────────────	COMMENT
MEDIUM	server/gateway.ts	2204	// ── Idempotency-Key support (mutation retry-safety) ──────────────────────	COMMENT
MEDIUM	server/gateway.ts	2316	// ── Per-account API rate limit (#3199) ──────────────────────────────	COMMENT
MEDIUM	server/gateway.ts	2316	// ── Per-account API rate limit (#3199) ──────────────────────────────	COMMENT
MEDIUM	server/gateway.ts	2330	// ── Per-account desktop-key meter (plan 2026-10-25-001, KTD6) ────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	188	// ── Market Data: the quotes a question names ─────────────────────────────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	223	// ── Quote currency ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	735	// ── Keyword extraction (shared by GDELT + digest search) ─────────────────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	782	// ── GDELT headlines (materialized, never fetched at request time) ─────────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	972	// ── Digest keyword search ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…r/worldmonitor/intelligence/v1/chat-analyst-context.ts	1067	// ── Source labels ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rldmonitor/intelligence/v1/brief-why-matters-prompt.ts	64	// ── Category-gated context sections ──────────────────────────────────────	COMMENT
MEDIUM	server/worldmonitor/news/v1/list-feed-digest.ts	1588	// ── Linear tag scanners ─────────────────────────────────────────────────────	COMMENT
MEDIUM	server/worldmonitor/news/v1/list-feed-digest.ts	1875	// ── Story persistence tracking ────────────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	78	// ── macroFiscal (5 sub-metrics) ───────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	156	// ── currencyExternal ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	236	// ── tradePolicy (3 sub-metrics) ───────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	293	// ── financialSystemExposure (4 sub-metrics) ───────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	404	// ── cyberDigital (3 sub-metrics) ──────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	451	// ── logisticsSupply (3 sub-metrics) ───────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	498	// ── infrastructure (4 sub-metrics) ────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	560	// ── energy (active production construct = v2) ─────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	673	// ── energy v2 global inputs ───────────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	738	// ── governanceInstitutional (6 sub-metrics, equal weight) ─────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	830	// ── socialCohesion (3 sub-metrics) ────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	882	// ── borderSecurity / "Conflict & Displacement" (2 sub-metrics) ───────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	923	// ── informationCognitive (3 sub-metrics) ──────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	975	// ── education (1 sub-metric) ──────────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1010	// ── healthPublicService (5 sub-metrics) ───────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1087	// ── foodWater (3 sub-metrics) ─────────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1139	// ── fiscalSpace (4 sub-metrics) ──────────────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1212	// ── reserveAdequacy (RETIRED in PR 2 §3.4) ───────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1233	// ── liquidReserveAdequacy (1 sub-metric) ─────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1258	// ── sovereignFiscalBuffer (1 sub-metric) ─────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1302	// ── externalDebtCoverage (1 sub-metric) ──────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1326	// ── importConcentration (1 sub-metric) ───────────────────────────────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1343	// ── stateContinuity (3 sub-metrics, derived from existing keys) ──────────	COMMENT
MEDIUM	…rver/worldmonitor/resilience/v1/_indicator-registry.ts	1390	// ── fuelStockDays (1 sub-metric) ─────────────────────────────────────────	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	581	// ── Risk analytics ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	672	// ── US-equity market session (#4922d) ───────────────────────────────────────	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	672	// ── US-equity market session (#4922d) ───────────────────────────────────────	COMMENT
MEDIUM	…ver/worldmonitor/supply-chain/v1/scenario-templates.ts	124	// ─── Runtime types shared between MapContainer and DeckGLMap ─────────────────	COMMENT
MEDIUM	…nitor/supply-chain/v1/_route-explorer-static-tables.ts	16	// ─── Transit days per TRADE_ROUTES ID ────────────────────────────────────────	COMMENT
MEDIUM	…nitor/supply-chain/v1/_route-explorer-static-tables.ts	54	// ─── Freight estimate per cargo type ─────────────────────────────────────────	COMMENT
MEDIUM	…nitor/supply-chain/v1/_route-explorer-static-tables.ts	72	// ─── Bypass corridor geometry ────────────────────────────────────────────────	COMMENT
MEDIUM	…nitor/supply-chain/v1/_route-explorer-static-tables.ts	90	// ── Sea alternatives (use CHOKEPOINT_REGISTRY for endpoints) ───────────	COMMENT
MEDIUM	…nitor/supply-chain/v1/_route-explorer-static-tables.ts	184	// ── Land-bridge corridors (hand-curated rail/road endpoints) ──────────	COMMENT
MEDIUM	server/__tests__/gateway-user-key-apiaccess.test.ts	506	// ── Absent entitlement with a configured backend ⇒ retryable 503 ──────────	COMMENT
MEDIUM	server/__tests__/gateway-user-key-apiaccess.test.ts	524	// ── The fail-CLOSED half: a RESOLVED row that denies ⇒ 403 ────────────────	COMMENT
MEDIUM	server/__tests__/gateway-user-key-apiaccess.test.ts	554	// ── CLOSED GAP, pinned so it cannot silently reopen ───────────────────────	COMMENT
MEDIUM	server/__tests__/gateway-user-key-apiaccess.test.ts	616	// ── Recovery path ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/__tests__/gateway-user-key-apiaccess.test.ts	632	// ── Harness isolation guard ───────────────────────────────────────────────	COMMENT
MEDIUM	server/_shared/brief-carousel-render.ts	61	// ── Colour palette (must match magazine's aesthetic) ───────────────────────	COMMENT
MEDIUM	server/_shared/brief-carousel-render.ts	73	// ── Layouts ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	server/_shared/brief-carousel-render.ts	319	// ── Public API ─────────────────────────────────────────────────────────────	COMMENT
308 more matches not shown…

Over-Commented Block1075 hits · 948 pts

Severity	File	Line	Snippet	Context
LOW	middleware.ts	61		COMMENT
LOW	middleware.ts	241	const cleaned = crawlerCanonicalUrl(url);	COMMENT
LOW	middleware.ts	321	const topic = liveTopicPageForPath(url.pathname);	COMMENT
LOW	middleware.ts	341	//	COMMENT
LOW	nixpacks.toml	1	# Railway relay build config (root_dir="" — builds from repo root).	COMMENT
LOW	docker-compose.yml	1	# =============================================================================	COMMENT
LOW	docker-compose.yml	141	# Example: echo "sk-or-abc123" > secrets/openrouter_api_key.txt	COMMENT
LOW	playwright.config.ts	61	//	COMMENT
LOW	playwright.config.ts	81	// (#8447). The message is what the client prints when the connection dies	COMMENT
LOW	playwright.config.ts	121	// `on-first-retry` records only the retry attempt. CI runs with	COMMENT
LOW	playwright.config.ts	141	// channel and the command-line equivalent of	COMMENT
LOW	vite.config.ts	381	// Emit dashboard-<variant>.html siblings of dashboard.html for the variant	COMMENT
LOW	vite.config.ts	421	const sourceLength = typeof asset.source === 'string'	COMMENT
LOW	vite.config.ts	1241	manualChunks(id) {	COMMENT
LOW	vite.config.ts	1301	// Clerk remains a runtime dynamic import; the stable chunk name	COMMENT
LOW	vite.config.ts	1321	// eager @/config barrel above. (#4404)	COMMENT
LOW	vite.config.ts	1341	return 'military-bases-data';	COMMENT
LOW	vite.config.ts	1381	}	COMMENT
LOW	pro-test/src/routes.ts	1	export const DASHBOARD_PATH = '/dashboard';	COMMENT
LOW	pro-test/src/App.tsx	1421	// This mount hook used to also call `initOverlay()`, which dynamically	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	101	// WKWebView host-app JS bridge timeout — Apple WebKit emits this exact phrase	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	121	// rejection always belongs to	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	141	// dashboard's. Already suppressed on the dashboard since #4005	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	161	// postMessage` entry above covers the same bridge from the other direction	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	181	// (the `/pro/assets/sentry-*.js` chunk plus `<anonymous>`), which	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	201	// The method slot is "anything but whitespace or a colon", NOT `[\w$]+`:	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	221	/webkit\.messageHandlers/,	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	241	// MARKETING_DOCUMENT_FRAME: welcome.html's WebMCP bootstrap and	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	261	// substring, for the reason the `Error invoking` entry above spells out:	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	281	// The name is SLOTTED rather than enumerated — unlike the `Error invoking`	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	301	// `isTrusted: false` is the browser saying the Event was constructed and	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	321	// the shape: `ReferenceError: _0x58c9 is not defined` on Chrome 152 /	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	341	// not defined` on Chrome 154 / Windows at `/`, an `onerror` capture whose	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	361	//	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	381	// either inline script. The only passkey on this surface is Clerk's own	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	401	/^(?:Error: )?NotSupportedError: Error connecting to Web Authentication service\.$/,	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	421	//	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	441	// spells out: `ignoreErrors` is frame-blind, so an unanchored `A request is	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	621	// Network failures, relocated verbatim from `MARKETING_IGNORE_ERRORS`.	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	661	// The service worker's own script evaluated in a page. `/sw.js` is only ever	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	681	// which are inert data and cannot execute. The document therefore holds no	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	701	//	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	721	// zero-frame stack overflow in WORLDMONITOR-WK.	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	741	// event carrying a first-party `kind` tag, which its checkout and panel	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	761	// An injected script's `eval` refused by our CSP. WORLDMONITOR-129 is the	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	781	// An injected script inserting a `<script>` whose inline source fails to	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	801	&& frames.some((f) => f.filename === '<anonymous>')) return null;	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	821	// `!hasFirstParty` excludes anything attributable to `/pro/assets/*.js`.	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	841	// separate ours from an extension's. The JSON-RPC reserved code range is the	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	861	// its Web3 sign-in helpers rethrow provider errors. They are unreachable	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	881	&& typeof rejectedCode === 'number'	COMMENT
LOW	pro-test/src/sentry-filter-policy.ts	901	//	COMMENT
LOW	pro-test/src/services/checkout.ts	421	// /api/create-checkout round-trip.	COMMENT
LOW	pro-test/src/services/checkout.ts	481	// Confirm with the user before taking them to the portal.	COMMENT
LOW	pro-test/src/services/checkout.ts	541	// Everything the chain above does not name. Previously this arm was a	COMMENT
LOW	pro-test/src/services/checkout.ts	581	showCheckoutErrorToast();	COMMENT
LOW	server/auth-session.ts	21	// Absorb minor issuer/edge clock skew without turning expiration into a broad	COMMENT
LOW	server/gateway.ts	581	'/api/resilience/v1/get-runtime-manifest',	COMMENT
LOW	server/gateway.ts	601	'/api/news/v1/list-label-changes',	COMMENT
LOW	server/gateway.ts	621	// miss). These require a browser session token or an API key in normal traffic;	COMMENT
1015 more matches not shown…

Structural Annotation Overuse98 hits · 177 pts

Severity	File	Line	Snippet	Context
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	58	// Step 1: Pro gate (defense-in-depth).	COMMENT
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	61	// Step 2: queue-depth backpressure (mirrors run-scenario:50).	COMMENT
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	67	// Step 3: derive runId from package pointer; no UUID fallback.	COMMENT
LOW	server/worldmonitor/forecast/v1/trigger-simulation.ts	81	// Step 4: pre-enqueue idempotency fast-path (D5). Authoritative	COMMENT
LOW	server/worldmonitor/forecast/v1/trigger-simulation.ts	104	// Step 5: enqueue.	COMMENT
LOW	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	488	// Step 1: resolve latest pointer -> snapshot_id.	COMMENT
LOW⚡	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	505	// Step 2: resolve snapshot_id -> full snapshot	COMMENT
LOW⚡	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	512	// Step 3: adapt snake_case -> camelCase	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	156	// Step 1: HARD-NEWS VETO. Runs FIRST. Overrides every classification	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	164	// Step 2: STRONG URL pathname segment.	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	169	// Step 3: STRONG headline prefix.	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	172	// Step 4: CORROBORATING ≥3 DISTINCT named-group labels across all	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	267	// Step 1: negative-cache short-circuit.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	270	// Step 2: Convex round-trip.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	319	// Step 3: positive — return WITHOUT caching.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	323	// Step 4: negative — write sentinel and return revoked.	COMMENT
LOW⚡	docs/climate-variant-full.md	26	// Step 1: Fetch current 7-day mean for zone	COMMENT
LOW⚡	docs/climate-variant-full.md	27	// Step 2: Fetch historical 30-year monthly mean for same month	COMMENT
LOW⚡	docs/climate-variant-full.md	29	// Step 3: anomaly = current - historical_mean	COMMENT
LOW	docs/Docs_To_Review/PANELS.md	732	### Step 1: Define the Panel Config	COMMENT
LOW	docs/Docs_To_Review/PANELS.md	743	### Step 2: Create the Component Class	COMMENT
LOW	docs/Docs_To_Review/PANELS.md	782	### Step 3: Register in App.ts	COMMENT
LOW	docs/Docs_To_Review/PANELS.md	794	### Step 4: Wire Data Loading	COMMENT
LOW⚡	docs/Docs_To_Review/PANELS.md	805	### Step 5: Add Refresh Interval (Optional)	COMMENT
LOW⚡	docs/Docs_To_Review/PANELS.md	809	### Step 6: Add Map Layer (Optional)	COMMENT
LOW⚡	docs/Docs_To_Review/PANELS.md	817	### Step 7: Add i18n Key	COMMENT
LOW	docs/Docs_To_Review/PANELS.md	829	### Step 8: Register in Variant Configs	COMMENT
LOW	convex/http.ts	795	// Step 2: the Confirm button pressed in the chat that sent /start.	COMMENT
LOW	convex/http.ts	846	// Step 1: record the chat and ask it to confirm. Nothing is bound yet.	COMMENT
LOW⚡	convex/notificationChannels.ts	293	// Step 1: find the current user's row before cross-account endpoint	COMMENT
LOW⚡	convex/notificationChannels.ts	303	// Step 2: scan for rows with this endpoint across other users and delete	COMMENT
LOW	convex/notificationChannels.ts	323	// Step 3: upsert the current-user row by (userId, channelType).	COMMENT
LOW	convex/notificationChannels.ts	689	// Step 2: the Confirm button. Binds only the chat that staged the token.	COMMENT
LOW⚡	convex/followedCountries.ts	499	// Step 2: empty-input guard.	COMMENT
LOW⚡	convex/followedCountries.ts	504	// Step 3: defensive upper-bound on input length.	COMMENT
LOW⚡	convex/followedCountries.ts	513	// Step 4: ISO-2 registry filter; collect droppedInvalid in input order.	COMMENT
LOW	convex/followedCountries.ts	524	// Step 5: canonicalize — dedupe in first-seen order. Without this, a	COMMENT
LOW⚡	convex/followedCountries.ts	545	// Step 6: read existing rows; build existingSet. Still required for	COMMENT
LOW⚡	convex/followedCountries.ts	554	// Step 7: filter against existing.	COMMENT
LOW	convex/followedCountries.ts	572	// Step 10: insert accepted rows + atomic counter +1 each.	COMMENT
LOW	convex/followedCountries.ts	593	// Step 12: structured warning when free users overflow cap. No	COMMENT
LOW	convex/followedCountries.ts	608	// Step 11: return shape.	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	166	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	172	// Step 2: Simulate subscription.active webhook (with wm_user_id metadata)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	181	// Step 3: Query entitlements for the real user (not fallback)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	187	// Step 4: Assert pro_monthly entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	197	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	203	// Step 2: Simulate subscription.active webhook	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	212	// Step 3: Query entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	218	// Step 4: Assert api_starter entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	230	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	236	// Step 2: Simulate webhook with billing dates both in the past (expired)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	248	// Step 3: Query entitlements -- should return free tier (expired)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	254	// Step 4: Assert free tier defaults	COMMENT
LOW	convex/broadcast/waveRuns.ts	727	// Step 1: claim lease + insert waveRuns row.	COMMENT
LOW	convex/broadcast/waveRuns.ts	745	// Step 2: stream registrations + filter (per-page) + reservoir-sample.	COMMENT
LOW	convex/broadcast/waveRuns.ts	867	// Step 3: create the Resend segment.	COMMENT
LOW	convex/broadcast/waveRuns.ts	881	// Step 4: chunk-persist picked rows. Each chunk is its own mutation so	COMMENT
LOW	convex/broadcast/waveRuns.ts	900	// Step 5: mark pick complete + schedule first push batch.	COMMENT
LOW	convex/broadcast/audienceWaveExport.ts	296	// Step 1: refuse to overlap with an existing wave.	COMMENT
38 more matches not shown…

Verbosity Indicators65 hits · 120 pts

Severity	File	Line	Snippet	Context
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	58	// Step 1: Pro gate (defense-in-depth).	COMMENT
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	61	// Step 2: queue-depth backpressure (mirrors run-scenario:50).	COMMENT
LOW⚡	server/worldmonitor/forecast/v1/trigger-simulation.ts	67	// Step 3: derive runId from package pointer; no UUID fallback.	COMMENT
LOW	server/worldmonitor/forecast/v1/trigger-simulation.ts	81	// Step 4: pre-enqueue idempotency fast-path (D5). Authoritative	COMMENT
LOW	server/worldmonitor/forecast/v1/trigger-simulation.ts	104	// Step 5: enqueue.	COMMENT
LOW	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	488	// Step 1: resolve latest pointer -> snapshot_id.	COMMENT
LOW⚡	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	505	// Step 2: resolve snapshot_id -> full snapshot	COMMENT
LOW⚡	…/worldmonitor/intelligence/v1/get-regional-snapshot.ts	512	// Step 3: adapt snake_case -> camelCase	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	156	// Step 1: HARD-NEWS VETO. Runs FIRST. Overrides every classification	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	164	// Step 2: STRONG URL pathname segment.	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	169	// Step 3: STRONG headline prefix.	COMMENT
LOW⚡	server/_shared/feelgood-classifier.js	172	// Step 4: CORROBORATING ≥3 DISTINCT named-group labels across all	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	267	// Step 1: negative-cache short-circuit.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	270	// Step 2: Convex round-trip.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	319	// Step 3: positive — return WITHOUT caching.	COMMENT
LOW⚡	server/_shared/pro-mcp-token.ts	323	// Step 4: negative — write sentinel and return revoked.	COMMENT
LOW	convex/http.ts	795	// Step 2: the Confirm button pressed in the chat that sent /start.	COMMENT
LOW	convex/http.ts	846	// Step 1: record the chat and ask it to confirm. Nothing is bound yet.	COMMENT
LOW⚡	convex/notificationChannels.ts	293	// Step 1: find the current user's row before cross-account endpoint	COMMENT
LOW⚡	convex/notificationChannels.ts	303	// Step 2: scan for rows with this endpoint across other users and delete	COMMENT
LOW	convex/notificationChannels.ts	323	// Step 3: upsert the current-user row by (userId, channelType).	COMMENT
LOW	convex/notificationChannels.ts	689	// Step 2: the Confirm button. Binds only the chat that staged the token.	COMMENT
LOW⚡	convex/followedCountries.ts	499	// Step 2: empty-input guard.	COMMENT
LOW⚡	convex/followedCountries.ts	504	// Step 3: defensive upper-bound on input length.	COMMENT
LOW⚡	convex/followedCountries.ts	513	// Step 4: ISO-2 registry filter; collect droppedInvalid in input order.	COMMENT
LOW	convex/followedCountries.ts	524	// Step 5: canonicalize — dedupe in first-seen order. Without this, a	COMMENT
LOW⚡	convex/followedCountries.ts	545	// Step 6: read existing rows; build existingSet. Still required for	COMMENT
LOW⚡	convex/followedCountries.ts	554	// Step 7: filter against existing.	COMMENT
LOW	convex/followedCountries.ts	572	// Step 10: insert accepted rows + atomic counter +1 each.	COMMENT
LOW	convex/followedCountries.ts	593	// Step 12: structured warning when free users overflow cap. No	COMMENT
LOW	convex/followedCountries.ts	608	// Step 11: return shape.	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	166	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	172	// Step 2: Simulate subscription.active webhook (with wm_user_id metadata)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	181	// Step 3: Query entitlements for the real user (not fallback)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	187	// Step 4: Assert pro_monthly entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	197	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	203	// Step 2: Simulate subscription.active webhook	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	212	// Step 3: Query entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	218	// Step 4: Assert api_starter entitlements	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	230	// Step 1: Seed product plans + customer mapping	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	236	// Step 2: Simulate webhook with billing dates both in the past (expired)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	248	// Step 3: Query entitlements -- should return free tier (expired)	COMMENT
LOW⚡	convex/__tests__/checkout.test.ts	254	// Step 4: Assert free tier defaults	COMMENT
LOW	convex/broadcast/waveRuns.ts	727	// Step 1: claim lease + insert waveRuns row.	COMMENT
LOW	convex/broadcast/waveRuns.ts	745	// Step 2: stream registrations + filter (per-page) + reservoir-sample.	COMMENT
LOW	convex/broadcast/waveRuns.ts	867	// Step 3: create the Resend segment.	COMMENT
LOW	convex/broadcast/waveRuns.ts	881	// Step 4: chunk-persist picked rows. Each chunk is its own mutation so	COMMENT
LOW	convex/broadcast/waveRuns.ts	900	// Step 5: mark pick complete + schedule first push batch.	COMMENT
LOW	convex/broadcast/audienceWaveExport.ts	296	// Step 1: refuse to overlap with an existing wave.	COMMENT
LOW	convex/broadcast/audienceWaveExport.ts	307	// Step 2: stream registrations, dedup, reservoir-sample N.	COMMENT
LOW⚡	convex/broadcast/audienceWaveExport.ts	358	// Step 3: create the Resend segment FIRST so we never stamp a	COMMENT
LOW⚡	convex/broadcast/audienceWaveExport.ts	366	// Step 4: push picked contacts to the segment, then stamp ONLY on	COMMENT
LOW	api/brief/public/[hash].ts	151	// Step 1: resolve pointer → {userId, issueSlot}.	COMMENT
LOW	api/brief/public/[hash].ts	184	// Step 2: resolve the actual brief envelope.	COMMENT
LOW	src/components/InsightsPanel.ts	348	// Step 1: Signal aggregation (client-side, depends on real-time map data)	COMMENT
LOW	src/components/InsightsPanel.ts	370	// Step 2: Re-sort server stories by ISQ (shallow copy to avoid mutating cache)	COMMENT
LOW	src/components/InsightsPanel.ts	444	// Step 1: Signal aggregation + focal point detection (must run BEFORE ranking)	COMMENT
LOW⚡	src/components/InsightsPanel.ts	519	// Step 2: Analyze sentiment (browser-based, fast)	COMMENT
LOW⚡	src/components/InsightsPanel.ts	528	// Step 3: Generate World Brief (with cooldown)	COMMENT
LOW	src/services/followed-countries.ts	738	// Step 1: parse localStorage (corruption recovery is unconditional).	COMMENT
5 more matches not shown…

Fake / Example Data118 hits · 118 pts

Severity	File	Line	Snippet	Context
LOW	mcp-grant.html	47	<div id="loading"><span class="spinner" aria-hidden="true"></span><span class="placeholder" id="loadingBody">Loadi	CODE
LOW	convex/broadcast/sendBroadcast.ts	79	PRO_LAUNCH_PHYSICAL_ADDRESS.includes("placeholder")	CODE
LOW	e2e/mcp-news-map.spec.ts	230	await expect(app.locator('.search-input:visible')).toHaveAttribute('placeholder', 'Search news');	CODE
LOW	src/locales/zh.json	596	"placeholder": "搜索或输入命令...",	CODE
LOW	src/locales/zh.json	731	"placeholder": {	CODE
LOW	src/locales/zh.json	765	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/zh.json	893	"placeholder": "关键词（逗号分隔）",	CODE
LOW	src/locales/tr.json	598	"placeholder": "Ara veya komut yaz...",	CODE
LOW	src/locales/tr.json	734	"placeholder": {	CODE
LOW	src/locales/tr.json	768	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/tr.json	896	"placeholder": "Anahtar kelimeler (virgul ile ayirin)",	CODE
LOW	src/locales/hu.json	667	"placeholder": "Keresés vagy parancs begépelése...",	CODE
LOW	src/locales/hu.json	803	"placeholder": {	CODE
LOW	src/locales/hu.json	843	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/hu.json	988	"placeholder": "Kulcsszavak (vesszővel elválasztva)",	CODE
LOW	src/locales/nl.json	214	"placeholder": "Zoeken of commando typen...",	CODE
LOW	src/locales/nl.json	336	"placeholder": {	CODE
LOW	src/locales/nl.json	461	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/nl.json	483	"placeholder": "Trefwoorden (door komma's gescheiden)",	CODE
LOW	src/locales/ja.json	596	"placeholder": "検索またはコマンドを入力...",	CODE
LOW	src/locales/ja.json	731	"placeholder": {	CODE
LOW	src/locales/ja.json	765	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/ja.json	893	"placeholder": "キーワード（カンマ区切り）",	CODE
LOW	src/locales/de.json	598	"placeholder": "Suchen oder Befehl eingeben...",	CODE
LOW	src/locales/de.json	734	"placeholder": {	CODE
LOW	src/locales/de.json	845	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/de.json	867	"placeholder": "Schlüsselwörter (durch Kommas getrennt)",	CODE
LOW	src/locales/ru.json	602	"placeholder": "Поиск или введите команду...",	CODE
LOW	src/locales/ru.json	740	"placeholder": {	CODE
LOW	src/locales/ru.json	774	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/ru.json	902	"placeholder": "Ключевые слова (через запятую)",	CODE
LOW	src/locales/pl.json	602	"placeholder": "Szukaj lub wpisz polecenie...",	CODE
LOW	src/locales/pl.json	740	"placeholder": {	CODE
LOW	src/locales/pl.json	851	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/pl.json	873	"placeholder": "Słowa kluczowe (oddzielone przecinkami)",	CODE
LOW	src/locales/uk.json	671	"placeholder": "Шукайте або введіть команду...",	CODE
LOW	src/locales/uk.json	809	"placeholder": {	CODE
LOW	src/locales/uk.json	849	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/uk.json	994	"placeholder": "Ключові слова (розділені комами)",	CODE
LOW	src/locales/pt.json	214	"placeholder": "Pesquisar ou digitar um comando...",	CODE
LOW	src/locales/pt.json	337	"placeholder": {	CODE
LOW	src/locales/pt.json	462	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/pt.json	484	"placeholder": "Palavras-chave (separadas por vírgula)",	CODE
LOW	src/locales/en.json	689	"placeholder": "Search or type a command...",	CODE
LOW	src/locales/en.json	828	"placeholder": {	CODE
LOW	src/locales/en.json	869	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/en.json	1010	"placeholder": "Keywords (comma separated)",	CODE
LOW	src/locales/it.json	600	"placeholder": "Cerca o digita un comando...",	CODE
LOW	src/locales/it.json	737	"placeholder": {	CODE
LOW	src/locales/it.json	848	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/it.json	870	"placeholder": "Parole chiave (separate da virgole)",	CODE
LOW	src/locales/hr.json	670	"placeholder": "Pretraži ili unesite naredbu...",	CODE
LOW	src/locales/hr.json	807	"placeholder": {	CODE
LOW	src/locales/hr.json	847	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/hr.json	995	"placeholder": "Ključne riječi (odvojene zarezom)",	CODE
LOW	src/locales/en.shell.json	822	"placeholder": {	CODE
LOW	src/locales/en.shell.json	877	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
LOW	src/locales/fr.json	600	"placeholder": "Rechercher ou saisir une commande...",	CODE
LOW	src/locales/fr.json	737	"placeholder": {	CODE
LOW	src/locales/fr.json	778	"placeholder": "wm_xxxxxxxxxxxxxxxxxxxxxxxx",	CODE
58 more matches not shown…

AI Slop Vocabulary26 hits · 72 pts

Severity	File	Line	Snippet	Context
MEDIUM	package-lock.json	21137	"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",	CODE
MEDIUM	.agents/skills/verify-worldmonitor/scripts/wm-verify.sh	2	# WorldMonitor verification harness.	COMMENT
MEDIUM	.agents/skills/verify-worldmonitor/scripts/wm-verify.sh	64	# /tests/map-harness.html is the same readiness probe playwright.config.ts uses:	COMMENT
MEDIUM	server/worldmonitor/economic/v1/_bis-shared.ts	45	// Parse BIS CSV using papaparse — robust handling of quoted fields & metadata	COMMENT
MEDIUM	server/worldmonitor/resilience/v1/_dimension-scorers.ts	2291	// #6459 — comprehensive-embargo cap.	COMMENT
MEDIUM	server/worldmonitor/resilience/v1/_dimension-scorers.ts	2565	// #6459 comprehensive-embargo cap. Applied POST-blend so it constrains the	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	177	// Quality / growth / leverage fundamentals parsed from Yahoo's financialData	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	365	// recent >= 3 → trust interval (robust to calendar-boundary drift)	COMMENT
MEDIUM	server/worldmonitor/market/v1/analyze-stock.ts	1100	// Quality/growth/leverage fundamentals from the same financialData module.	COMMENT
MEDIUM	docs/api/MarketService.openapi.json	1	{"components":{"schemas":{"AnalystConsensus":{"properties":{"buy":{"format":"int32","type":"integer"},"hold":{"format":"	CODE
MEDIUM	docs/api/MarketService.openapi.json	1	{"components":{"schemas":{"AnalystConsensus":{"properties":{"buy":{"format":"int32","type":"integer"},"hold":{"format":"	CODE
MEDIUM⚡	docs/perf/news-hybrid-clustering-7782.fixture.json	1	{"capturedAt":"2026-09-06T12:01:48.463288+00:00","source":"https://www.worldmonitor.app/api/news/v1/list-feed-digest?var	CODE
MEDIUM	convex/__tests__/billing.test.ts	3989	// Date.now() call) trips before any row is attempted — robust to however	COMMENT
MEDIUM	public/push-handler.js	98	// origins rather than testing the string's shape, because that is robust to	COMMENT
MEDIUM	.github/workflows/perf-style-layout-budget.yml	8	# Scheduled rather than per-PR on purpose. The harness needs a real browser	COMMENT
MEDIUM	.github/workflows/perf-style-layout-budget.yml	56	# cpu 1 matches the committed baseline capture. A crashed harness must	COMMENT
MEDIUM	.github/workflows/perf-style-layout-budget.yml	68	# harness warning, implausibly low attribution) — nonzero, never green.	COMMENT
MEDIUM	.github/workflows/test.yml	386	# archive's Lua runs against a real server: the relay harness stubs the	COMMENT
MEDIUM	api/a2a.ts	151	// Documented robust (never throws meaningfully; degrades to	COMMENT
MEDIUM	api/mcp/types.ts	617	// `read` returns the wire-ready `content[0].text` and MUST be robust:	COMMENT
MEDIUM	api/mcp/resources/index.ts	299	// `read()` is documented "MUST be robust", but enforce it at the boundary so	COMMENT
MEDIUM	e2e/pro-activation.spec.ts	1070	// #5600: every per-step write in this harness fails (authFetch throws with	COMMENT
MEDIUM	src/components/BreakthroughsTickerPanel.ts	66	// Double the content for seamless infinite scroll	COMMENT
MEDIUM	src/e2e/map-harness.ts	227	throw new Error('Missing #app container for map harness');	CODE
MEDIUM	src/e2e/mobile-map-harness.ts	33	throw new Error('Missing #app container for mobile popup harness');	CODE
MEDIUM	src/e2e/mobile-map-integration-harness.ts	58	throw new Error('Missing #app container for mobile map integration harness');	CODE

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	docs/railway-seed-consolidation-runbook.md	1601	.then(r=>r.json()).then(d=>d.data.project.services.edges.forEach(e=>{	CODE
CRITICAL	integrations/zapier/test/latest-events.test.js	45	const keys = App.searches.latest_events.operation.inputFields.map((f) => f.key);	CODE
CRITICAL	src/app/country-intel.ts	1250	protests = this.ctx.intelligenceCache.protests.events.filter((e) =>	CODE
CRITICAL	src/app/country-intel.ts	1309	thermalEscalations = this.ctx.intelligenceCache.thermalEscalation.clusters.filter(	CODE

Synthetic Comment Markers7 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH	docs/api/IntelligenceService.openapi.json	1	{"components":{"schemas":{"ActorState":{"description":"ActorState is one geopolitical actor's leverage score in the regi	CODE
HIGH	docs/api/IntelligenceService.openapi.json	1	{"components":{"schemas":{"ActorState":{"description":"ActorState is one geopolitical actor's leverage score in the regi	CODE
HIGH	docs/api/TradeService.openapi.json	1	{"components":{"schemas":{"BillingVerificationError":{"description":"Returned with HTTP 503 when paid access cannot be c	CODE
HIGH⚡	docs/perf/news-hybrid-clustering-7782.fixture.json	1	{"capturedAt":"2026-09-06T12:01:48.463288+00:00","source":"https://www.worldmonitor.app/api/news/v1/list-feed-digest?var	CODE
HIGH⚡	docs/perf/news-hybrid-clustering-7782.fixture.json	1	{"capturedAt":"2026-09-06T12:01:48.463288+00:00","source":"https://www.worldmonitor.app/api/news/v1/list-feed-digest?var	CODE
HIGH	api/mcp/skill-extension/generated.ts	470	"text": "---\nname: fetch-country-brief\nversion: 2\ndescription: Open the WorldMonitor country interface in a UI-ca	CODE
HIGH	api/mcp/skill-extension/generated.ts	470	"text": "---\nname: fetch-country-brief\nversion: 2\ndescription: Open the WorldMonitor country interface in a UI-ca	CODE

Modern AI Meta-Vocabulary12 hits · 32 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/railway-seed-consolidation-runbook.md	27	## Deployment safety guardrails	COMMENT
MEDIUM	…of-hormuz-transit-report-2026-07/distribution-brief.md	5	from the repository owner before sending (per #5668 guardrails), and nothing	CODE
MEDIUM	docs/methodology/indicator-sources.yaml	1	# Resilience scorer indicator-source manifest (PR 0 scaffold, 2026-04-22).	COMMENT
MEDIUM	docs/architecture/pro-monetization.md	115	├── checkout.ts # Hosted checkout orchestration	CODE
MEDIUM	public/llms-full.txt	2513	Cache prefix bumps. `resilience:score:v15:` → `:v16:` → `:v17:` → `:v18:` → `:v19:` → `:v20:` → `:v21:` → `:v22:` →	CODE
MEDIUM	public/llms-full.txt	2575	- T1.6 (#2949 scaffold, #2962 full grid): per-dimension confidence grid in the widget. The full grid adds an imputat	CODE
MEDIUM	.github/workflows/feed-validation.yml	17	# The --ci flag enforces three guardrails inside scripts/validate-rss-feeds.mjs:	COMMENT
MEDIUM	.github/workflows/deploy-gate.yml	8	# (#5479): event-driven evaluation alone can strand a PR — the check-runs API	COMMENT
MEDIUM	workers/api-cors-preflight/src/index.js	14	// the Worker visible to code review, greptile, and CI guardrails.	COMMENT
MEDIUM	…tent/blog/ai-powered-intelligence-without-the-cloud.md	70	### Semantic Search (RAG)	COMMENT
MEDIUM	src/app/panel-layout.ts	265	// it honest: `tests/panel-config-guardrails.test.mjs` fails CI on drift, and	COMMENT
MEDIUM	src/app/panel-layout.ts	329	// it in the app (CI also catches drift via panel-config-guardrails).	COMMENT

Empty Error Handlers3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/_gem-geojson-to-canonical.py	123	except (LookupError, KeyError):	CODE
HIGH	scripts/_gem-geojson-to-canonical.py	181	except (TypeError, ValueError):	CODE
HIGH	scripts/_gem-geojson-to-canonical.py	167	except (TypeError, ValueError):	CODE

Cross-Language Confusion (JS/TS)1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	src/utils/export-report.ts	310	print(): void;	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/prepush-attest.sh	26	# Usage:	COMMENT

Modern Structural Boilerplate1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	sdk/python/src/worldmonitor_sdk/__init__.py	319	__all__ = [	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/convert-zh-tw.py	54		CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/_gem-geojson-to-canonical.py	135		CODE

koala73/worldmonitor

Open-Source Code Quality, Security and Technical Debt Review