2.0

Adjusted Signal

2.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

20.3K

Stars

TypeScript

Language

7.3M

Lines of Code

13.9K

Files

7.9K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 4790 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 133 finding(s).

Agent Over-Engineering Ratio 7.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 5855 finding(s).

PR Review Velocity Impact 9.3/100 · LOW

Which changes need focused human review? 7928 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 63MEDIUM 3046LOW 4818

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 7928 distinct pattern matches across 23 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators2913 hits · 8808 pts

Severity	File	Line	Snippet	Context
MEDIUM	self-host/terraform/variables.tf	13	# ── Required ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	26	# ── DNS ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	46	# ── Naming / tags ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	60	# ── Instance ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	86	# ── Networking ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	112	# ── Data volume ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	126	# ── Backups (DLM snapshot schedule for the data volume) ────────────────────	COMMENT
MEDIUM	self-host/terraform/variables.tf	146	# ── kortix self-host bootstrap ──────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/prod/main.tf	1	# ── prod environment — api.kortix.com on ECS Fargate (autoscaled, HA) ─────────	COMMENT
MEDIUM	infra/terraform/environments/prod/main.tf	91	# ── Project snapshot object store (S3 config provider) ────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/prod/main.tf	105	# ── Audit-event archive (WORM) ────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/prod/main.tf	117	# ── Kortix Capture store ──────────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/prod/main.tf	193	# ── Gateway (LLM proxy) — its own ECS Fargate service + CF-validated cert ─────	COMMENT
MEDIUM	infra/terraform/environments/dev-web-us-east-2/main.tf	1	# ── dev-web-us-east-2 — dev's ECS web service in us-east-2 ──────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	67	# ── Network (VPC + public/private subnets + NAT) ──────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	81	# ── Project snapshot object store (S3 config provider) ────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	90	# ── Audit-event archive (WORM) ────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	130	# ── Kortix Capture store ──────────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	197	# ── Gateway (LLM proxy) as its own ECS Fargate service ────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/staging-eu-west-2/main.tf	233	# ── DNS: this stack's origin hostnames ────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	1	# ── dev-us-east-2 — dev's API/gateway, colocated with the dev database ────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	62	# ── Network (VPC + public/private subnets + NAT) ──────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	72	# ── TLS cert (ACM, DNS-validated via Cloudflare) ───────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	92	# ── ECS Fargate API service (autoscaled) ──────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	97	# ── Project snapshot object store (S3 config provider) ────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	108	# ── Audit-event archive (WORM) ────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	123	# ── Kortix Capture store ──────────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	187	# ── Gateway (LLM proxy) as its own ECS Fargate service ────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	221	# ── Gateway → API inside the VPC ──────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/environments/dev-us-east-2/main.tf	287	# ── DNS: this stack's origin hostnames ────────────────────────────────────────	COMMENT
MEDIUM	…a/terraform/environments/staging-web-eu-west-2/main.tf	1	# ── staging-web-eu-west-2 — staging's ECS web service in eu-west-2 ──────────	COMMENT
MEDIUM	infra/terraform/compliance-monitoring/use2-security.tf	29	# ── Regional alert delivery ──────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/compliance-monitoring/use2-security.tf	191	# ── WAF and ALB monitoring ────────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/compliance-monitoring/use2-security.tf	547	# ── SQS manifest queue monitoring (Drata test 115) ───────────────────────────	COMMENT
MEDIUM	infra/terraform/compliance-monitoring/use2-security.tf	585	# ── Backup failure monitoring ─────────────────────────────────────────────────	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	3	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	15	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	18	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	196	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	201	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/main.tf	424	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/main.tf	428	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/main.tf	436	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/main.tf	441	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	596	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/main.tf	601	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	11	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	13	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	37	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	336	# ── One-shot adoption of the live role (created out-of-band) ──────────────────	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-groups.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-groups.tf	6	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/providers.tf	1	# ── Account-level security baseline (SOC 2 / Drata) ──────────────────────────	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-tf-plan.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-tf-plan.tf	20	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-tf-apply.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-tf-apply.tf	23	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	infra/terraform/security-baseline/iam-gha-tf-apply.tf	119	# ── Account-global roots: compliance-monitoring + security-baseline ──────────	COMMENT
2853 more matches not shown…

Hyper-Verbose Identifiers2849 hits · 2904 pts

Severity	File	Line	Snippet	Context
LOW	…-monitoring/functions/test_compliance_alerts_logger.py	28	def test_logs_every_sns_notification_and_reports_success(self):	CODE
LOW	…-monitoring/functions/test_compliance_alerts_logger.py	46	def test_logs_subscription_confirmation_without_raising(self):	CODE
LOW	…-monitoring/functions/test_compliance_alerts_logger.py	69	def test_never_raises_on_unexpected_event_shapes(self):	CODE
LOW	…-monitoring/functions/test_ec2_cpu_alarm_reconciler.py	55	def test_creates_a_drata_compatible_alarm_for_every_running_instance(self):	CODE
LOW	…-monitoring/functions/test_ec2_cpu_alarm_reconciler.py	81	def test_does_not_rewrite_an_already_compliant_alarm(self):	CODE
LOW	…-monitoring/functions/test_ec2_cpu_alarm_reconciler.py	105	def test_repairs_an_alarm_with_no_notification_action(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	123	def test_creates_four_drata_compatible_alarms_for_each_application_lb(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	208	def test_creates_distinct_target_alarms_for_multiple_target_groups(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	236	def test_does_not_rewrite_compliant_alarms(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	247	def test_repairs_stale_dimensions_and_missing_notification_actions(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	284	def test_deletes_per_target_group_response_time_variants_and_repairs_the_lb_alarm(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	327	def test_deletes_legacy_compliance_alb_alarms_but_not_cpu_alarms(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	357	def test_never_deletes_a_desired_alarm(self):	CODE
LOW	…ance-monitoring/functions/test_alb_alarm_reconciler.py	369	def test_deletes_its_own_alarms_for_a_load_balancer_that_is_gone(self):	CODE
LOW	…erraform/scripts/test_audit_archive_tag_readability.py	60	def assert_tags_are_drata_readable(source: str, scanned_resources) -> None:	CODE
LOW	…erraform/scripts/test_audit_archive_tag_readability.py	74	def test_module_tags_are_drata_readable() -> None:	CODE
LOW	…erraform/scripts/test_audit_archive_tag_readability.py	79	def test_opaque_tags_are_rejected() -> None:	CODE
LOW	…erraform/scripts/test_audit_archive_tag_readability.py	93	def test_missing_tags_are_rejected() -> None:	STRING
LOW⚡	…ra/terraform/scripts/test_alb_log_bucket_versioning.py	31	def assert_alb_logs_versioning_enabled(source: str) -> None:	CODE
LOW⚡	…ra/terraform/scripts/test_alb_log_bucket_versioning.py	41	def test_module_enables_alb_log_bucket_versioning() -> None:	CODE
LOW⚡	…ra/terraform/scripts/test_alb_log_bucket_versioning.py	45	def test_missing_versioning_is_rejected() -> None:	CODE
LOW⚡	…ra/terraform/scripts/test_alb_log_bucket_versioning.py	54	def test_suspended_versioning_is_rejected() -> None:	CODE
LOW⚡	infra/terraform/scripts/test_internal_tag_boundary.py	37	def test_environment_inventory_maps(self):	CODE
LOW⚡	infra/terraform/scripts/test_internal_tag_boundary.py	45	def test_opaque_expressions_are_not_literal_maps(self):	CODE
LOW⚡	infra/terraform/scripts/test_internal_tag_boundary.py	51	def test_literal_map_and_missing_keys(self):	CODE
LOW	infra/terraform/scripts/test_web_waf_associations.py	16	def test_ecs_module_exposes_alb_arn(self):	CODE
LOW	infra/terraform/scripts/test_web_waf_associations.py	21	def test_each_web_environment_owns_a_regional_waf_association(self):	CODE
LOW	infra/terraform/scripts/test_web_waf_associations.py	38	def test_compliance_stack_does_not_compete_for_web_albs(self):	CODE
LOW	infra/terraform/scripts/test_web_waf_associations.py	47	def test_common_rules_exclude_only_registered_oauth_loopback_authorize_requests(self):	CODE
LOW	…raform/scripts/test_alb_target_response_time_alarms.py	47	def test_every_regional_alb_family_has_a_target_response_time_alarm(self):	CODE
LOW	…raform/scripts/test_alb_target_response_time_alarms.py	66	def test_thresholds_stay_above_by_design_streaming_traffic(self):	CODE
LOW	…raform/scripts/test_alb_target_response_time_alarms.py	88	def test_no_removed_block_unmanages_the_alarm_again(self):	CODE
LOW	…raform/scripts/test_alb_target_response_time_alarms.py	98	def test_reconciler_repairs_the_same_alarm_family(self):	CODE
LOW	…raform/scripts/test_alb_target_response_time_alarms.py	111	def test_every_terraform_managed_alarm_topic_is_subscribed(self):	CODE
LOW	infra/terraform/scripts/test_reconciler_iam_coverage.py	54	def test_every_lambda_api_call_is_granted(self):	CODE
LOW	infra/terraform/scripts/test_reconciler_iam_coverage.py	68	def test_alb_reconciler_detection_sees_the_known_calls(self):	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	79	def test_fixed_ruleset_is_clean():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	94	def test_module_baseline_is_clean():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	110	def test_default_vpc_acl_is_caught():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	116	def test_deny_before_allow_wins():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	129	def test_allow_before_deny_still_fails():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	135	def test_narrow_source_is_not_a_finding():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	171	def test_first_wide_rule_of_each_family_decides():	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	182	def test_narrow_and_other_family_rules_never_decide():	CODE
LOW	infra/terraform/scripts/test_sqs_message_age_alarms.py	39	def test_both_dev_manifest_queues_have_a_message_age_alarm(self):	CODE
LOW	infra/terraform/scripts/test_sqs_message_age_alarms.py	73	def test_module_composes_the_alarmed_names(self):	CODE
LOW	infra/terraform/scripts/test_sqs_message_age_alarms.py	86	def test_alarm_thresholds_fire_on_a_sustained_stall(self):	CODE
LOW	infra/terraform/scripts/test_sqs_message_age_alarms.py	107	def test_no_removed_block_unmanages_the_family_again(self):	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	50	def _extract_variable_default(text: str, name: str) -> str \| None:	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	80	def discover_environment_roots() -> list[str]:	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	98	def test_region_map_points_at_real_roots(self):	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	109	def test_every_authoritative_root_declares_both_regions(self):	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	127	def test_api_region_matches_database_region(self):	CODE
LOW⚡	infra/scripts/test-ecs-preview-runtime.py	299	def test_the_preview_origin_is_credential_free_https(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	93	def test_preview_label_approves_one_exact_sha(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	132	def test_every_later_job_consumes_the_approved_sha_not_the_event_sha(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	145	def test_deploy_revalidates_permission_label_and_sha_before_publishing(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	154	def test_the_sandbox_refuses_to_run_any_other_sha(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	169	def test_no_checkout_persists_credentials(self):	CODE
LOW	infra/scripts/test-ecs-preview-runtime.py	179	def test_build_jobs_have_no_secret_no_registry_and_no_push(self):	CODE
2789 more matches not shown…

Over-Commented Block1717 hits · 1646 pts

Severity	File	Line	Snippet	Context
LOW	.hadolint.yaml	1	# Hadolint settings for every Dockerfile in this repo (security-scan.yml runs	COMMENT
LOW	bunfig.toml	1	[test]	COMMENT
LOW	.gitleaks.toml	1	# gitleaks config — consumed by .github/workflows/secret-scan.yml (gitleaks 8.x	COMMENT
LOW	self-host/terraform/main.tf	1	# self-host/terraform — AWS/EC2 provisioner for Kortix self-host.	COMMENT
LOW	infra/terraform/environments/prod/main.tf	81	}	COMMENT
LOW	infra/terraform/environments/prod/main.tf	181	cpu_target = 55	COMMENT
LOW	infra/terraform/environments/prod/main.tf	221	container_port = 8090	COMMENT
LOW	infra/terraform/environments/prod/variables.tf	121	type = map(string)	COMMENT
LOW	infra/terraform/environments/staging-eu-west-2/main.tf	1	# ── staging-eu-west-2 — staging's API/gateway, colocated with the staging DB ──	COMMENT
LOW	infra/terraform/environments/staging-eu-west-2/main.tf	81	# ── Project snapshot object store (S3 config provider) ────────────────────────	COMMENT
LOW	infra/terraform/environments/dev-us-east-2/main.tf	1	# ── dev-us-east-2 — dev's API/gateway, colocated with the dev database ────────	COMMENT
LOW	infra/terraform/environments/dev-us-east-2/main.tf	221	# ── Gateway → API inside the VPC ──────────────────────────────────────────────	COMMENT
LOW	…ompliance-monitoring/functions/alb_alarm_reconciler.py	21	# covered by elb-5xx, unhealthy-hosts, and zero-healthy-hosts regardless.	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-ecs-deploy.tf	21	# IAM while the release announced anyway: the policy was missing the eu-west-2	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	61	tags = local.tags	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	81	# scoped to a resource ARN. The Drata Compliance-as-Code scanner (testId 8025	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	121	}	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	181	}	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	201	}	COMMENT
LOW	infra/terraform/security-baseline/iam-groups.tf	241	# administrators group instantly DENIES every non-MFA API call for its members	COMMENT
LOW	infra/terraform/security-baseline/providers.tf	1	# ── Account-level security baseline (SOC 2 / Drata) ──────────────────────────	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-tf-plan.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-tf-apply.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-tf-apply.tf	121	# These two roots are not environment infrastructure. They manage the account	COMMENT
LOW	infra/terraform/security-baseline/iam-gha-nacl-audit.tf	1	# ════════════════════════════════════════════════════════════════════════════	COMMENT
LOW	infra/terraform/security-baseline/patch-management.tf	1	# Automated weekly security patching for the EC2 worker fleet.	COMMENT
LOW	infra/terraform/examples/selfhost-ec2/main.tf	1	# Example root module: a single self-hosted Kortix VPS on EC2.	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/main.tf	1	# selfhost-ec2 — a thin, optional convenience provisioner for `kortix	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/main.tf	21	subnet_id = var.subnet_id != "" ? var.subnet_id : data.aws_subnets.default[0].ids[0]	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/storage.tf	1	# Separate EBS data volume holding ALL durable self-host state, so it survives	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/storage.tf	21	data_mount_path = "/mnt/kortix-data"	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/monitoring.tf	1	# Minimal, boring CloudWatch monitoring: an EC2 status-check alarm (no	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/monitoring.tf	201	# software/hardware issue) — never triggered by anything happening inside the	COMMENT
LOW	infra/terraform/modules/selfhost-ec2/monitoring.tf	241		COMMENT
LOW	…modules/selfhost-ec2/scripts/check-data-volume-safe.sh	1	#!/usr/bin/env bash	COMMENT
LOW	infra/terraform/modules/ecs-api/main.tf	21	name = var.name	COMMENT
LOW	…fra/terraform/modules/project-snapshots-bucket/main.tf	1	# ── Project snapshot object store ─────────────────────────────────────────────	COMMENT
LOW	infra/terraform/modules/capture-store/main.tf	1	# ── Kortix Capture store ──────────────────────────────────────────────────────	COMMENT
LOW	infra/terraform/modules/audit-archive-bucket/main.tf	1	# ── Audit-event archive ───────────────────────────────────────────────────────	COMMENT
LOW	infra/cloudflare/workers/pi-js-router/wrangler.toml	1	# Cloudflare Worker that serves `pi-js.kortix.com` — the stable name for the JS	COMMENT
LOW	infra/cloudflare/workers/api-router/wrangler.toml	1	# Cloudflare Worker that fronts the public API and routes to the active backend.	COMMENT
LOW	infra/cloudflare/workers/apps-router/wrangler.toml	21	# PREVIEW_EDGE_SECRET are Worker secrets. Each value must equal	COMMENT
LOW	infra/scripts/ecs-deploy.sh	1	#!/usr/bin/env bash	COMMENT
LOW	infra/scripts/ecs-deploy.sh	21	# omitted, it is DERIVED from the image tag if the tag is a clean	COMMENT
LOW	infra/scripts/ecs-deploy.sh	41	# health check, so "no old task left with desired status RUNNING"	COMMENT
LOW	infra/scripts/ecs-deploy.sh	61	# replaces matching values from the running task and preserves every other	COMMENT
LOW	infra/scripts/ecs-deploy.sh	141	case "$1" in	COMMENT
LOW	infra/scripts/ecs-deploy.sh	581	# Terraform and this script register into the SAME family, and every	COMMENT
LOW	infra/scripts/ecs-deploy.sh	621	--arg cpu "$DESIRED_CPU" --arg memory "$DESIRED_MEMORY" \	COMMENT
LOW	infra/scripts/copy-env-secret.sh	1	#!/usr/bin/env bash	COMMENT
LOW	infra/scripts/carry-web-static.sh	1	#!/usr/bin/env bash	COMMENT
LOW	infra/scripts/test-ecs-preview-runtime.py	261	self.assertIn("name: previewSandboxName(input.prNumber),", PREVIEW_CORE)	COMMENT
LOW	tests/playwright.config.ts	121	// deployed lanes.	COMMENT
LOW	tests/unit/host-no-v1-session-types.test.ts	1	import { execFileSync } from 'node:child_process';	COMMENT
LOW	tests/unit/sandbox-workflow.test.ts	101	// It used to wait on `ss -ltnH`, which lists LISTENING sockets only and so	COMMENT
LOW	tests/unit/no-docs-tree.test.ts	61	// The runner runs this lane concurrently with the DB lane's 192 throwaway	COMMENT
LOW	tests/unit/session-page-find-guard.test.ts	1	import { execFileSync } from 'node:child_process';	COMMENT
LOW	tests/unit/kortixd-package-boundary.test.ts	1	import { execFileSync } from 'node:child_process';	COMMENT
LOW	tests/bin/sandbox-preview.ts	141	apiUrl: value('PLATINUM_API_URL', 'https://api.platinum.dev'),	COMMENT
1657 more matches not shown…

Modern AI Meta-Vocabulary97 hits · 278 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/spec/end-to-end.md	1952	One session sends another a message, as Claude Code's cross-session messaging does (`send_message`, `list_agents`; contr	CODE
MEDIUM	tests/src/flows/cli-resources.flow.ts	691	// Scope `enabled` to the daily block. The scaffold ships another, ENABLED	COMMENT
MEDIUM	tests/src/flows/skills.flow.ts	15	// every other Kortix skill and the seeded project scaffold reference by name.	COMMENT
MEDIUM	tests/src/flows/config-releases.flow.ts	503	// clear the starter's scaffold (STARTER_SCAFFOLD_PATHS) in the same commit.	COMMENT
MEDIUM	tests/src/flows/cli-ship.flow.ts	625	// Establish the link via a first managed ship (clean push of the scaffold).	COMMENT
MEDIUM	…reign-listeners-before-starting-an-agentic-test-sta.md	5	# Reject foreign listeners before starting an agentic test stack	COMMENT
MEDIUM	…/learnings/work/my-kortix-multi-agent-parity/README.md	8	# My Kortix multi-agent parity	COMMENT
MEDIUM	.agents/skills/e2e/SKILL.md	6	# e2e: agentic end-to-end tests in TypeScript	COMMENT
MEDIUM	.agents/skills/e2e/references/running.md	9	npx e2e init [directory] [--yes] # scaffold a project, refresh the agent skill	CODE
MEDIUM	packages/ui/src/session/thread/transcript.tsx	1505	// renderer drew a full-height turn scaffold per attempt — a retry loop	COMMENT
MEDIUM	packages/ui/src/session/thread/chat-minimap-items.ts	231	// A Slack, Teams or Telegram turn is a scaffold around a person's words: the	COMMENT
MEDIUM	packages/ui/src/session/thread/session-chat.tsx	1232	// UI doesn't flicker between agentic steps. NOT a 2s debounce.	COMMENT
MEDIUM	packages/shared/src/sandbox/defaults.ts	351	// Canonical scaffold repo (bare). Its root commit matches every seeded	COMMENT
MEDIUM	packages/starter/scripts/write-managed-skills.ts	27	// `kortix-cli` (the one managed skill deliberately left in the scaffold). Both	COMMENT
MEDIUM	packages/starter/src/index.test.ts	264	// `kortix-cli` is the sole managed skill left in the scaffold; the rest of the	COMMENT
MEDIUM	packages/starter/src/index.ts	114	// disk here, so a filter in only one place means the two paths scaffold	COMMENT
MEDIUM	packages/starter/src/index.ts	306	// a root the scaffold actually needs is worth throwing over.	COMMENT
MEDIUM	…ckages/sdk/src/react/use-opencode-sessions/sessions.ts	52	// With the scaffold-warm seed, opencode is ALREADY 'ok' for /workspace and a	COMMENT
MEDIUM	packages/registry/src/schema.ts	47	'registry:project', // a whole Kortix project (full repo scaffold)	CODE
MEDIUM	packages/db/scripts/generate-safety-header.test.ts	79	// The template and lint-migrations.ts must not drift apart: a scaffold that	COMMENT
MEDIUM	apps/tui/SPEC.md	440	## 10. Waves (orchestration plan)	COMMENT
MEDIUM	apps/web/content/posts/ai-transformation-company-os.md	18	The market is already pointing this way. [Accenture AI Refinery](https://www.accenture.com/us-en/services/ai-data/ai-ref	CODE
MEDIUM	apps/web/content/posts/getting-started-with-kortix.md	21	## Install the CLI and scaffold	COMMENT
MEDIUM⚡	…tent/posts/how-to-build-reliable-ai-agent-workflows.md	32	Anthropic separates a workflow from an agent ([Anthropic](https://www.anthropic.com/engineering/building-effective-agent	CODE
MEDIUM⚡	…tent/posts/how-to-build-reliable-ai-agent-workflows.md	34	Google Cloud reaches the same conclusion from the design side: start with a single agent so you can refine the core logi	CODE
MEDIUM⚡	…tent/posts/how-to-build-reliable-ai-agent-workflows.md	38	The loop is where an agent's flexibility turns expensive. Google Cloud describes a loop pattern that repeats subagents u	CODE
MEDIUM⚡	…tent/posts/how-to-build-reliable-ai-agent-workflows.md	46	Anthropic warns that agents carry "the potential for compounding errors", so a wrong step should not quietly become the	CODE
MEDIUM⚡	…tent/posts/how-to-build-reliable-ai-agent-workflows.md	48	Some actions should never run unattended. Google Cloud asks whether a task involves high-stakes decisions, safety-critic	CODE
MEDIUM	apps/web/content/posts/kortix-vs-claude-cowork.md	42	- One usage pool. Everything you do with Claude [counts toward your plan's usage limits](https://support.claude.com/	CODE
MEDIUM	apps/web/content/posts/kortix-vs-claude-cowork.md	59	Cowork runs on Claude models, so the engine choice is made for you. Anthropic's [API list prices](https://claude.com/pri	CODE
MEDIUM	apps/web/content/posts/agentic-operating-system.md	6	canonical: "https://kortix.com/blog/agentic-operating-system"	CODE
MEDIUM⚡	apps/web/content/posts/agentic-operating-system.md	22	MindStudio calls an agentic OS "a structural pattern" rather than software you install ([mindstudio.ai](https://www.mind	CODE
MEDIUM⚡	apps/web/content/posts/agentic-operating-system.md	24	Slack's guide calls it "an operating layer for AI" that "coordinates autonomous agents, connects them to your data and a	CODE
MEDIUM⚡	apps/web/content/posts/agentic-operating-system.md	28	Lyzr drops the analogy on purpose: "an agentic OS means an enterprise AI agent orchestration platform", and "we are not	CODE
MEDIUM	apps/web/content/posts/agentic-operating-system.md	79	## What to ask any agentic OS vendor	COMMENT
MEDIUM	…ontent/posts/open-source-claude-cowork-alternatives.md	53	## Eigent: a multi-agent desktop, team features still landing	COMMENT
MEDIUM	apps/cli/README.md	21	kortix projects use <project_id> # select it without a local scaffold	CODE
MEDIUM	apps/cli/DESIGN.md	251	scaffold.ts # init scaffold (existing)	CODE
MEDIUM	apps/cli/scripts/e2e-cloud.sh	228	# …then scaffold a Kortix project so link CAN succeed.	COMMENT
MEDIUM	apps/cli/src/index.ts	429	// project scaffold — `kortix <new-project-name>` used to, which turned	COMMENT
MEDIUM	…tests__/projects-link-host-credential.blackbox.test.ts	73	// `projects link` refuses directories without a `.kortix/` scaffold.	COMMENT
MEDIUM	apps/cli/src/__tests__/init-new-project.test.ts	20	// default flow the --force path has always overshadowed: scaffold a fresh	COMMENT
MEDIUM	apps/cli/src/__tests__/init-new-project.test.ts	46	// The scaffold landed and the primary + extras are all wired.	COMMENT
MEDIUM	apps/cli/src/__tests__/init-new-project.test.ts	51	// The parent dir holds ONLY the project — no stray scaffold at top level.	COMMENT
MEDIUM	apps/cli/src/commands/init.ts	238	// scaffold into an existing non-empty folder — a Kortix project is standalone.	COMMENT
MEDIUM	apps/cli/src/commands/ship.ts	445	// WE own the first commit: this folder is already a `kortix init` scaffold	COMMENT
MEDIUM	…ndbox-agent-server/scripts/workspace-provider-bench.ts	86	// ── scaffold: the project's shared root commit, and nothing else ────────────	COMMENT
MEDIUM	…ndbox-agent-server/scripts/workspace-provider-bench.ts	169	// Which Git route the daemon actually took (scaffold zero-network, scaffold	COMMENT
MEDIUM	…ndbox-agent-server/scripts/workspace-provider-bench.ts	170	// + API delta bundle, scaffold + remote bundle, or a full clone) — the	COMMENT
MEDIUM	…s/kortix-sandbox-agent-server/src/harness/pi/config.ts	47	// Cloud subagent guardrails (cloud-subagent.ts): children one parent waits on at	COMMENT
MEDIUM	…ox-agent-server/src/__tests__/materialize-repo.test.ts	74	// The image bakes /opt/kortix/scaffold.git; a Kortix box would answer the	COMMENT
MEDIUM	…ox-agent-server/src/__tests__/materialize-repo.test.ts	75	// scaffold fast path for every rig. Point the reset at an absent path so this	COMMENT
MEDIUM	…ox-agent-server/src/__tests__/materialize-repo.test.ts	803	// bakes the image scaffold (every Kortix sandbox) would take the scaffold	COMMENT
MEDIUM	…box-agent-server/src/__tests__/fast-boot-delta.test.ts	122	// scaffold clone leaves origin/main on the scaffold root, so a bundle that	COMMENT
MEDIUM	…box-agent-server/src/__tests__/fast-boot-delta.test.ts	164	// that commit over the scaffold tree and applies the bundle on it.	COMMENT
MEDIUM	…box-agent-server/src/__tests__/fast-boot-delta.test.ts	210	// A delta the scaffold cannot prove must never land a wrong tree: it falls	COMMENT
MEDIUM	…-agent-server/src/__tests__/workspace-provider.test.ts	338	// The Git fallback's zero-network scaffold path: a bare copy whose HEAD IS	COMMENT
MEDIUM	…-agent-server/src/__tests__/workspace-provider.test.ts	341	git(root, 'clone', '-q', '--bare', `file://${source.checkout}`, scaffold)	CODE
MEDIUM	…ent-server/src/services/workspace-provider/checkout.ts	357	// the baked content IS this session's base — i.e. a fresh scaffold-rooted	COMMENT
MEDIUM	…ent-server/src/services/workspace-provider/checkout.ts	359	// (an imported repo / diverged project), the baked scaffold is the WRONG	COMMENT
37 more matches not shown…

Cross-Language Confusion23 hits · 150 pts

Severity	File	Line	Snippet	Context
HIGH⚡	infra/scripts/test-ecs-preview-runtime.py	295	self.assertIn("sandbox.name === persistent && owner === 'kortix-branch-env'", PREVIEW_CORE)	CODE
HIGH⚡	infra/scripts/test-ecs-preview-runtime.py	307	self.assertIn("if (url.protocol !== 'https:' \|\| url.username \|\| url.password)", PREVIEW_PROVIDERS)	CODE
HIGH	infra/scripts/test-ecs-preview-runtime.py	536	self.assertIn("return !activeSha \|\| activeSha !== sandbox.metadata?.git_sha;", PREVIEW_CORE)	CODE
HIGH	infra/scripts/test-ecs-preview-runtime.py	545	self.assertIn("if (sandbox.name === undefined) return false;", PREVIEW_CORE)	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	110	if (cs.backgroundImage && cs.backgroundImage !== 'none') return true;	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	112	if (bg && bg !== 'rgba(0, 0, 0, 0)' && bg !== 'transparent') return true;	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	113	if (cs.borderStyle && cs.borderStyle !== 'none' && cs.borderWidth !== '0px') return true;	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	114	if (cs.boxShadow && cs.boxShadow !== 'none') return true;	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	124	if (!el \|\| el.nodeType !== 1) return [];	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	127	if (r.width === 0 \|\| r.height === 0) return [];	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	133	out.push({type:'visual', captureId:cid, x:r.left, y:r.top, width:r.width, height:r.height, tag:el.tagName.to	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	135	for (const ch of el.children) out.push(...walk(ch, depth+1));	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	141	if (el.textContent && el.textContent.trim()) {	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	158	if (!el \|\| el.nodeType !== 1) return [];	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	162	if (r.width === 0 \|\| r.height === 0) return [];	CODE
HIGH⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	170	out.push({	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	182	for (const ch of el.children) out.push(...extract(ch));	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	221	if (!root && orig.tagName !== 'svg' && orig.tagName !== 'SVG' &&	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	225	for (let j=0; j<orig.children.length && j<cl.children.length; j++)	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	313	if (el.textContent && el.textContent.trim()) {	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	325	if (Math.abs(r.left-v.x)<5 && Math.abs(r.top-v.y)<5 &&	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	326	Math.abs(r.width-v.width)<5 && Math.abs(r.height-v.height)<5) {	CODE
HIGH	apps/capture/scripts/render_processed_trace_html.py	1373	const visible = typeof checked === 'boolean' ? checked : Boolean(input && input.checked);	CODE

Empty Error Handlers24 hits · 115 pts

Severity	File	Line	Snippet	Context
HIGH	…lates/marketplace/skills/instagram-reels/scripts/kx.py	35	except Exception: pass	CODE
HIGH	…lates/marketplace/skills/instagram-reels/scripts/kx.py	37	except OSError: pass	CODE
HIGH	…tplace/skills/domain-research/scripts/domain-lookup.py	85	except Exception:	CODE
HIGH	…tplace/skills/domain-research/scripts/domain-lookup.py	96	except Exception:	CODE
HIGH	…tplace/skills/domain-research/scripts/domain-lookup.py	381	except Exception:	CODE
HIGH	…tplace/skills/domain-research/scripts/domain-lookup.py	638	except Exception:	CODE
HIGH	…ketplace/skills/instagram-content-studio/scripts/kx.py	35	except Exception: pass	CODE
HIGH	…ketplace/skills/instagram-content-studio/scripts/kx.py	37	except OSError: pass	CODE
HIGH	…tplace/skills/instagram-content-studio/scripts/card.py	19	except OSError: pass	CODE
HIGH	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	154	except Exception:	CODE
HIGH	…plates/general-knowledge-worker/skills/pdf/formfill.py	110	except (KeyError, TypeError, AttributeError):	CODE
HIGH	…dge-worker/skills/presentations/scripts/convert_pdf.py	104	except Exception:	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	295	except Exception:	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	393	except Exception:	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	491	except Exception:	CODE
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	286	except Exception:	CODE
HIGH	…nowledge-worker/skills/presentations/scripts/unpack.py	71	except Exception:	CODE
HIGH	…nowledge-worker/skills/presentations/scripts/unpack.py	82	except Exception:	CODE
HIGH	…nowledge-worker/skills/presentations/scripts/slides.py	72	except ValueError:	CODE
HIGH	…eneral-knowledge-worker/skills/docx/scripts/comment.py	213	except ValueError:	CODE
HIGH	…general-knowledge-worker/skills/docx/scripts/unpack.py	103	except Exception:	CODE
HIGH	…general-knowledge-worker/skills/docx/scripts/unpack.py	116	except Exception:	CODE
HIGH	apps/capture/scripts/ci_update_test.py	121	except OSError:	CODE
HIGH	apps/capture/scripts/stress_processor_resources.py	344	except psutil.NoSuchProcess:	CODE

Fake / Example Data73 hits · 75 pts

Severity	File	Line	Snippet	Context
LOW	self-host/README.md	130	admin_email = "admin@example.com"	CODE
LOW	…i/src/workspace/sidebar/modal/session-labels-modal.tsx	108	placeholder={t('placeholder')}	CODE
LOW	…i/src/workspace/sidebar/modal/session-labels-modal.tsx	109	aria-label={t('placeholder')}	CODE
LOW	packages/ui/src/workspace/layout/project-home.tsx	368	? tFirstChat('placeholder')	CODE
LOW	…ckages/ui/src/workspace/new/new-workspace-form.test.ts	194	name: 'Acme Inc',	CODE
LOW	…ckages/ui/src/workspace/new/new-workspace-form.test.ts	213	const foreign1: KortixAccount = { account_id: 'org-1', name: 'Acme Inc', account_role: 'admin' };	CODE
LOW	…ckages/ui/src/workspace/new/new-workspace-form.test.ts	256	name: 'Acme Inc',	CODE
LOW	…ages/ui/src/workspace/new/use-create-workspace.test.ts	223	name: 'Acme Inc',	CODE
LOW	packages/ui/src/i18n/en.ts	229	"placeholder": "Project name"	CODE
LOW	packages/ui/src/i18n/en.ts	1252	"placeholder": "Add a label and press Enter",	CODE
LOW	packages/ui/src/i18n/en.ts	1558	"placeholder": "Type your message...",	CODE
LOW	packages/ui/src/i18n/en.ts	2136	"placeholder": "Tell Kortix what you're working on",	CODE
LOW	packages/ui/src/i18n/en.ts	7084	"placeholder": "Ask anything about this tab",	CODE
LOW	packages/ui/src/i18n/en.ts	8257	"placeholder": "Write, or type / for blocks",	CODE
LOW	packages/ui/src/i18n/en.ts	8638	"placeholder": "Tell {place} something to remember…",	CODE
LOW	packages/ui/src/session/panel/easy/app-preview.tsx	447	}: Omit<ComponentProps<typeof SandboxAddressBar>, 'hasPreview' \| 'placeholder'> & {	CODE
LOW	…ages/ui/src/session/composer/editor/suggestion.test.ts	56	expect(matchFor('@', key, 'user@example.com')).toBeNull();	CODE
LOW	packages/ui/src/session/agents/subagent-dialog.test.tsx	196	expect(input.getAttribute('placeholder')).toBe('Message namer…');	CODE
LOW	…/ui/src/session/thread/session-context-metrics.test.ts	76	name: id === 'kortix' ? 'Kortix' : 'Acme Corp',	CODE
LOW	…/ui/src/session/thread/session-context-metrics.test.ts	214	expect(getSessionContextMetrics(thread([msg]), providersOf('acme', {}), freeLookup).context?.providerLabel).toBe('Ac	CODE
LOW	…tarter/templates/managed/skills/kortix-design/SKILL.md	71	("Save changes"). No lorem ipsum, no invented numbers or logos.	CODE
LOW	…tarter/templates/managed/skills/kortix-design/SKILL.md	197	- Fake screenshots, fake stats, fake logos, "Acme", "John Doe".	CODE
LOW	…ter/templates/managed/skills/kortix-artifacts/SKILL.md	60	names of things, the user's own terms. Never use lorem ipsum. If data is	CODE
LOW	…s/managed/skills/kortix-artifacts/references/design.md	88	real numbers with units and dates, never lorem ipsum. Missing data? Say so on	CODE
LOW	…rc/core/rest/projects-client/connector-gateway.test.ts	134	label: 'user@example.com',	CODE
LOW	apps/capture/scripts/verify_pii_dataset.py	35	"email": ["alice@example.com", "alice+refund@example.org", "o'connor@example.net", "élise@example.com"],	CODE
LOW	apps/web/src/features/artifacts/doc-editor.tsx	261	node.type.name === 'codeBlock' ? '' : node.type.name === 'heading' ? t('placeholderHeading') : t('placeholde	CODE
LOW	…s/workspace/project-selector/project-selector.test.tsx	31	email: 'user@example.com',	CODE
LOW	…ps/web/src/features/chrome/panel/chrome-panel-home.tsx	391	placeholder={tabs.length ? t('placeholder') : t('placeholderNoTab')}	CODE
LOW	…s/web/src/components/iam/audit-session-picker.test.tsx	163	expect(input()?.getAttribute('placeholder')).toBe('Search or paste a session ID');	CODE
LOW	apps/cli/src/__tests__/host-notice.test.ts	147	user_email: 'user@example.com',	CODE
LOW	apps/mobile/locales/zh.json	280	"placeholder": "给 Kortix 一个任务...",	CODE
LOW	apps/mobile/locales/zh.json	988	"placeholder": "定义你的员工应该如何行为......",	CODE
LOW	apps/mobile/locales/ja.json	280	"placeholder": "Kortixにタスクを...",	CODE
LOW	apps/mobile/locales/ja.json	988	"placeholder": "従業員がどのように行動すべきかを定義します...",	CODE
LOW	apps/mobile/locales/de.json	280	"placeholder": "Gib Kortix eine Aufgabe...",	CODE
LOW	apps/mobile/locales/de.json	988	"placeholder": "Definieren Sie, wie sich Ihr Mitarbeiter verhalten soll...",	CODE
LOW	apps/mobile/locales/pt.json	280	"placeholder": "Dê uma tarefa para o Kortix...",	CODE
LOW	apps/mobile/locales/pt.json	988	"placeholder": "Defina como seu funcionário deve se comportar...",	CODE
LOW	apps/mobile/locales/en.json	280	"placeholder": "Give Kortix a task...",	CODE
LOW	apps/mobile/locales/en.json	1035	"placeholder": "Define how your worker should behave...",	CODE
LOW	apps/mobile/locales/it.json	280	"placeholder": "Dai a Kortix un compito...",	CODE
LOW	apps/mobile/locales/it.json	988	"placeholder": "Definisci come dovrebbe comportarsi il tuo lavoratore...",	CODE
LOW	apps/mobile/locales/fr.json	280	"placeholder": "Donne une tâche à Kortix...",	CODE
LOW	apps/mobile/locales/fr.json	994	"placeholder": "Définissez comment votre travailleur doit se comporter...",	CODE
LOW	apps/mobile/locales/es.json	280	"placeholder": "Dale a Kortix una tarea...",	CODE
LOW	apps/mobile/locales/es.json	994	"placeholder": "Define cómo debe comportarse tu trabajador...",	CODE
LOW	…e/components/kortix/selectable-markdown-genui.test.tsx	20	const ImagesContext = React.createContext<string>('placeholder');	CODE
LOW	…e/components/kortix/selectable-markdown-genui.test.tsx	102	function render(text: string, options: { isDark?: boolean; remoteImages?: 'load' \| 'placeholder' } = {}) {	CODE
LOW	apps/mobile/components/kortix/search-pill.tsx	23	inputProps?: Omit<React.ComponentProps<typeof Input>, 'value' \| 'onChangeText' \| 'placeholder'>;	CODE
LOW	apps/mobile/components/kortix/selectable-markdown.tsx	123	* file): remote http(s) images load, as on web. Default `'placeholder'`.	COMMENT
LOW	apps/mobile/components/kortix/selectable-markdown.tsx	653	function SelectableMarkdownText({ children, isDark: isDarkProp, isStreaming, remoteImages = 'placeholder', surface }:	CODE
LOW	apps/mobile/components/kortix/search-list-header.tsx	24	inputProps?: Omit<TextInputProps, 'value' \| 'onChangeText' \| 'placeholder' \| 'placeholderTextColor' \| 'style'>;	CODE
LOW	apps/mobile/components/settings/AccountPage.test.tsx	68	useProfileEditor: () => ({ avatarUrl: null, displayName: 'Test User', email: 'user@example.com' }),	CODE
LOW	apps/mobile/components/markdown/markdown-image.test.tsx	59	function render(element: React.ReactElement, remote: 'load' \| 'placeholder' = 'placeholder') {	CODE
LOW	apps/mobile/components/markdown/markdown-image.test.tsx	120	<MarkdownImagesContext.Provider value="placeholder">	CODE
LOW	apps/mobile/components/markdown/markdown-image.tsx	38	export type MarkdownRemoteImages = 'load' \| 'placeholder';	CODE
LOW	apps/mobile/components/markdown/markdown-image.tsx	41	export const MarkdownImagesContext = createContext<MarkdownRemoteImages>('placeholder');	CODE
LOW	apps/api/src/connectors/policy-conditions.test.ts	39	expect(resolve({ to: 'admin@example.com' }).action).toBe('require_approval');	CODE
LOW	apps/api/src/connectors/policy-conditions.test.ts	65	expect(resolve({ to: ['owner@example.com', 'admin@example.com'] }).action).toBe(	CODE
13 more matches not shown…

Excessive Try-Catch Wrapping65 hits · 75 pts

Severity	File	Line	Snippet	Context
LOW	infra/terraform/scripts/audit-nacl-admin-ports.py	107	except Exception as exc: # noqa: BLE001 - surfaced verbatim to the operator	CODE
LOW	infra/terraform/scripts/audit-nacl-admin-ports.py	116	except Exception as exc: # noqa: BLE001	CODE
LOW	…lates/marketplace/skills/instagram-reels/scripts/kx.py	35	except Exception: pass	CODE
LOW	…rketplace/skills/instagram-reels/scripts/ig_publish.py	76	except Exception:	CODE
LOW	…rketplace/skills/instagram-reels/scripts/ig_publish.py	85	except Exception as e:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	85	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	96	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	117	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	202	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	225	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	381	except Exception:	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	638	except Exception:	CODE
LOW	…arketplace/skills/legal-writer/scripts/verify-legal.py	469	except Exception as e:	CODE
LOW	…ketplace/skills/instagram-content-studio/scripts/kx.py	35	except Exception: pass	CODE
LOW	…/skills/instagram-content-studio/scripts/ig_publish.py	76	except Exception:	CODE
LOW	…/skills/instagram-content-studio/scripts/ig_publish.py	85	except Exception as e:	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	61	except Exception:	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	95	except Exception:	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	141	except Exception:	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	154	except Exception:	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	175	except Exception as e:	CODE
LOW	…al-knowledge-worker/skills/xlsx/scripts/pivot_table.py	92	except Exception:	CODE
LOW	…al-knowledge-worker/skills/xlsx/scripts/pivot_table.py	105	except Exception:	CODE
LOW	…al-knowledge-worker/skills/xlsx/scripts/pivot_table.py	314	except Exception as e:	CODE
MEDIUM	…nowledge-worker/skills/presentations/scripts/repair.py	23	print(f"Error: {src} not found", file=sys.stderr)	CODE
LOW	…nowledge-worker/skills/presentations/scripts/repair.py	64	except Exception:	CODE
LOW	…-knowledge-worker/skills/presentations/scripts/pack.py	64	except Exception as exc:	CODE
LOW	…dge-worker/skills/presentations/scripts/convert_pdf.py	87	except Exception as e:	STRING
LOW	…dge-worker/skills/presentations/scripts/convert_pdf.py	104	except Exception:	STRING
LOW⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	278	except Exception:	CODE
LOW⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	286	except Exception:	CODE
LOW⚡	…ge-worker/skills/presentations/scripts/convert_pptx.py	295	except Exception:	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	341	except Exception:	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	393	except Exception:	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	445	except Exception:	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	464	except Exception as e:	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	491	except Exception:	CODE
LOW	…nowledge-worker/skills/presentations/scripts/unpack.py	71	except Exception:	CODE
LOW	…nowledge-worker/skills/presentations/scripts/unpack.py	82	except Exception:	CODE
MEDIUM	…nowledge-worker/skills/presentations/scripts/slides.py	315	print(f"Error: {layout_path} not found", file=sys.stderr)	CODE
MEDIUM	…nowledge-worker/skills/presentations/scripts/slides.py	343	print(f"Error: {source_path} not found", file=sys.stderr)	CODE
LOW	…nowledge-worker/skills/presentations/scripts/slides.py	474	except Exception:	CODE
MEDIUM	…nowledge-worker/skills/presentations/scripts/slides.py	511	print("Error: No slides found", file=sys.stderr)	CODE
MEDIUM⚡	…nowledge-worker/skills/presentations/scripts/slides.py	543	print(f"Error: {unpacked} not found", file=sys.stderr)	CODE
MEDIUM⚡	…nowledge-worker/skills/presentations/scripts/slides.py	557	print(f"Error: {unpacked} not found", file=sys.stderr)	CODE
MEDIUM⚡	…nowledge-worker/skills/presentations/scripts/slides.py	565	print(f"Error: Invalid PowerPoint file: {args.input}", file=sys.stderr)	CODE
LOW⚡	…nowledge-worker/skills/presentations/scripts/slides.py	575	except Exception as e:	CODE
MEDIUM⚡	…nowledge-worker/skills/presentations/scripts/slides.py	576	print(f"Error: {e}", file=sys.stderr)	CODE
LOW	…s/general-knowledge-worker/skills/docx/scripts/pack.py	69	except Exception as e:	CODE
LOW	…general-knowledge-worker/skills/docx/scripts/unpack.py	103	except Exception:	CODE
LOW⚡	…general-knowledge-worker/skills/docx/scripts/unpack.py	116	except Exception:	CODE
LOW	.github/workflows/capture-build.yml	1703	except Exception:	CODE
LOW	.github/workflows/capture-build.yml	1745	except Exception:	CODE
LOW	apps/capture/scripts/compare_trace_artifacts.py	730	except Exception as exc: # Keep output machine-readable even on parser/data failures.	CODE
LOW	apps/capture/scripts/compare_screenshot_sync.py	83	except Exception:	CODE
LOW	apps/capture/scripts/ci_update_test.py	392	except Exception as e: # noqa: BLE001	CODE
MEDIUM	apps/capture/scripts/ci_update_test.py	95	def read_json(path, root=False):	CODE
LOW	apps/capture/scripts/compare_a11y_artifacts.py	166	except Exception as exc: # noqa: BLE001 - report malformed artifact context.	CODE
LOW	apps/capture/scripts/check_resource_soak_summary.py	54	except Exception as exc: # pragma: no cover - used as CLI guard	CODE
LOW	apps/capture/scripts/verify_pii_local.py	307	except Exception:	CODE
5 more matches not shown…

AI Slop Vocabulary25 hits · 71 pts

Severity	File	Line	Snippet	Context
LOW	self-host/terraform/variables.tf	1	# All variables here just pass through to modules/selfhost-ec2 — see that	COMMENT
MEDIUM	packages/ui/src/primitives/sidebar-panel.tsx	173	// wrapper, so the band ahead of the incoming panel is seamless and	COMMENT
MEDIUM	…kages/ui/src/session/panel/advanced/advanced-panel.tsx	53	// Jump to the tool the user clicked in the chat (focus by callID, robust to	COMMENT
MEDIUM	packages/ui/src/session/models/model-grouping.ts	21	// The robust fix (per the live /v1/models trace): the gateway now serves an	COMMENT
MEDIUM	packages/ui/src/session/thread/detect-command.ts	109	// Fallback: robust full-template match where placeholders are wildcards.	COMMENT
MEDIUM	packages/ui/src/session/thread/session-chat.tsx	3159	// drive the agent through the SAME robust path the input uses — optimistic	COMMENT
MEDIUM	packages/sdk/src/core/models/model-visibility.ts	37	// the robust path — the gateway now serves it directly, so grouping/gating	COMMENT
MEDIUM	packages/sdk/src/react/use-session.ts	1887	// lands (count grows) — robust to server-normalized text where a text-equality	COMMENT
MEDIUM	packages/api-contract/src/session-log/model-view.ts	358	* - call ids become ordinals (#1, #2, ...), so a harness may re-mint ids;	COMMENT
MEDIUM	apps/desktop-electron/src/main.js	310	// Same size + center as the main window so swapping splash → app is seamless	COMMENT
MEDIUM	apps/web/src/app/[locale]/(system)/debug/tools/page.tsx	537	'# App Router\n\nThe App Router is a new paradigm for building applications using React’s latest features.',	CODE
MEDIUM	apps/cli/scripts/build.sh	8	# are produced the same way (CI, dev-local.sh, the snapshot test harness).	COMMENT
LOW⚡	apps/cli/src/kortix-tools.generated.json	5	"show": "/*\n show: the Kortix tool that presents an existing output (a file, an image, a\n * URL, inline text) to	CODE
MEDIUM	apps/cli/src/commands/ship.ts	417	// GitHub origin → the seamless import (one-click App install, or --github-token).	COMMENT
MEDIUM	…agent-server/src/__tests__/static-web-curl.e2e.test.ts	23	// Capture body + status + content-type in one shot. Markers keep parsing robust	COMMENT
MEDIUM	…ox-agent-server/src/services/workspace-provider/git.ts	33	// Rename the unborn branch to `base` — version-robust vs `git init -b`, which	COMMENT
MEDIUM⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
MEDIUM⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
MEDIUM⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
MEDIUM⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
MEDIUM⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
MEDIUM	apps/api/src/middleware/request-deadline.ts	143	// Any SSE client explicitly asks for an event stream — robust catch-all for	COMMENT
MEDIUM	apps/api/src/projects/routes/project-from-repository.ts	114	// needed — either a caller-supplied token (the seamless `kortix ship` flow	COMMENT
MEDIUM	…pi/src/__tests__/unit-kortix-projects-security.test.ts	7	// this safety check is robust to where the sandbox-lookup handler lives.	COMMENT
MEDIUM	apps/api/src/__tests__/unit-sentry-noise-filter.test.ts	119	// Driver code anchor (robust across driver versions).	COMMENT

Deep Nesting53 hits · 50 pts

Severity	File	Line	Context
LOW	infra/terraform/scripts/audit-nacl-admin-ports.py	64	CODE
LOW	…rketplace/skills/instagram-reels/scripts/ig_publish.py	18	CODE
LOW	…tplace/skills/document-review/scripts/annotate_pptx.py	212	CODE
LOW	…tplace/skills/document-review/scripts/annotate_xlsx.py	68	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	77	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	100	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	410	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	513	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	607	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	707	CODE
LOW	…arketplace/skills/legal-writer/scripts/verify-legal.py	52	CODE
LOW	…rketplace/skills/legal-writer/scripts/courtlistener.py	182	CODE
LOW	…rketplace/skills/legal-writer/scripts/courtlistener.py	235	CODE
LOW	…marketplace/skills/legal-writer/scripts/ecfr_lookup.py	45	CODE
LOW	…marketplace/skills/legal-writer/scripts/ecfr_lookup.py	241	CODE
LOW	…/skills/instagram-content-studio/scripts/ig_publish.py	18	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	65	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	82	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	102	CODE
LOW	…general-knowledge-worker/skills/xlsx/scripts/recalc.py	117	CODE
LOW	…al-knowledge-worker/skills/xlsx/scripts/pivot_table.py	109	CODE
LOW	…emplates/general-knowledge-worker/skills/pdf/layout.py	158	CODE
LOW	…plates/general-knowledge-worker/skills/pdf/formfill.py	143	CODE
LOW	…plates/general-knowledge-worker/skills/pdf/formfill.py	300	CODE
LOW	…nowledge-worker/skills/presentations/scripts/repair.py	20	CODE
LOW	…-knowledge-worker/skills/presentations/scripts/pack.py	22	CODE
LOW	…-knowledge-worker/skills/presentations/scripts/pack.py	47	CODE
LOW	…dge-worker/skills/presentations/scripts/convert_pdf.py	40	CODE
LOW	…ge-worker/skills/presentations/scripts/convert_pptx.py	348	CODE
LOW	…nowledge-worker/skills/presentations/scripts/slides.py	138	CODE
LOW	…s/general-knowledge-worker/skills/docx/scripts/pack.py	22	CODE
LOW	…s/general-knowledge-worker/skills/docx/scripts/pack.py	47	CODE
LOW	…eneral-knowledge-worker/skills/docx/scripts/comment.py	182	CODE
LOW	…eneral-knowledge-worker/skills/docx/scripts/comment.py	199	CODE
LOW	…general-knowledge-worker/skills/docx/scripts/unpack.py	160	CODE
LOW	…general-knowledge-worker/skills/docx/scripts/unpack.py	198	CODE
LOW	…general-knowledge-worker/skills/docx/scripts/unpack.py	253	CODE
LOW	apps/capture/scripts/compare_trace_artifacts.py	371	CODE
LOW	apps/capture/scripts/render_processed_trace_html.py	89	CODE
LOW	apps/capture/scripts/compare_a11y_artifacts.py	119	CODE
LOW	apps/capture/scripts/verify_pii_local.py	99	CODE
LOW	apps/capture/scripts/verify_pii_local.py	134	CODE
LOW	apps/capture/scripts/verify_pii_local.py	223	CODE
LOW	apps/capture/scripts/verify_pii_local.py	290	CODE
LOW	apps/capture/scripts/verify_pii_local.py	229	CODE
LOW	apps/capture/scripts/stress_processor_resources.py	35	CODE
LOW	apps/capture/scripts/stress_processor_resources.py	210	CODE
LOW	apps/capture/scripts/stress_processor_resources.py	383	CODE
LOW	apps/capture/scripts/install_privacy_runtime.py	26	CODE
LOW	apps/capture/scripts/verify_pii_dataset.py	54	CODE
LOW	…ite-label/lumen/agent-kit/lumen-kit/lumen_kit/tools.py	98	CODE
LOW	…-label/lumen/agent-kit/lumen-kit/lumen_kit/validate.py	20	CODE
LOW	…-label/lumen/agent-kit/lumen-kit/lumen_kit/validate.py	38	CODE

Cross-Language Confusion (JS/TS)9 hits · 45 pts

Severity	File	Line	Snippet	Context
HIGH	…tomize/sections/view/gateway/gateway-api-reference.tsx	37	print(response.choices[0].message.content)`;	CODE
HIGH	…tomize/sections/view/gateway/gateway-api-reference.tsx	49	print(chunk.choices[0].delta.content or "", end="")`;	CODE
HIGH	…tomize/sections/view/gateway/gateway-api-reference.tsx	63	print(message.content)`;	CODE
HIGH	…tomize/sections/view/gateway/gateway-api-reference.tsx	75	print(text, end="")`;	CODE
HIGH	…tomize/sections/view/gateway/gateway-api-reference.tsx	192	print(response.choices[0].message.content)`;	CODE
HIGH	apps/white-label/lumen/convex/kit/bundle.generated.ts	44	"content": "\"\"\"Documents, anchors and citation checks.\n\nLumen writes one `Text/<doc_id>.md` per document. A comm	CODE
HIGH	apps/white-label/lumen/convex/kit/bundle.generated.ts	48	"content": "\"\"\"Tracked-change redlines in DOCX: each edit becomes w:del + w:ins by \"Lumen\", with a comment.\n\nA	CODE
HIGH	apps/white-label/lumen/convex/kit/bundle.generated.ts	60	"content": "\"\"\"A JSON Schema subset validator for the kit's own schemas (stdlib only).\n\nSupports: type, required	CODE
HIGH	apps/api/src/connectors/oauth2.ts	57	return None();	CODE

Structural Annotation Overuse23 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	…r/templates/marketplace/skills/draft-outreach/SKILL.md	125	### Step 1: Parse Request	COMMENT
LOW	…r/templates/marketplace/skills/draft-outreach/SKILL.md	135	### Step 2: Research First (Always)	COMMENT
LOW	…r/templates/marketplace/skills/draft-outreach/SKILL.md	150	### Step 3: Identify Hook	COMMENT
LOW	…r/templates/marketplace/skills/draft-outreach/SKILL.md	161	### Step 4: Draft Message	COMMENT
LOW	…r/templates/marketplace/skills/draft-outreach/SKILL.md	193	### Step 5: Create Email Draft	COMMENT
LOW	…templates/marketplace/skills/account-research/SKILL.md	181	### Step 1: Parse Request	COMMENT
LOW	…templates/marketplace/skills/account-research/SKILL.md	191	### Step 2: Web Search (Always)	COMMENT
LOW	…templates/marketplace/skills/account-research/SKILL.md	212	### Step 3: Enrichment (If Connected)	COMMENT
LOW	…templates/marketplace/skills/account-research/SKILL.md	229	### Step 4: CRM Check (If Connected)	COMMENT
LOW	…templates/marketplace/skills/account-research/SKILL.md	245	### Step 5: Synthesize	COMMENT
LOW	…eral-knowledge-worker/skills/website-building/SKILL.md	81	### Step 0: Load ALL mandatory files (do this FIRST, in parallel)	COMMENT
LOW⚡	…eral-knowledge-worker/skills/website-building/SKILL.md	94	### Step 1: Generate unique palette	COMMENT
LOW⚡	…eral-knowledge-worker/skills/website-building/SKILL.md	102	### Step 2: Design & Build	COMMENT
LOW⚡	…eral-knowledge-worker/skills/website-building/SKILL.md	106	### Step 3: Preview	COMMENT
LOW	…eral-knowledge-worker/skills/website-building/SKILL.md	168	## Step 1: Art Direction — Infer Before You Ask, Ask Before You Default	COMMENT
LOW	…eral-knowledge-worker/skills/website-building/SKILL.md	194	## Step 2: Publish	COMMENT
LOW⚡	…-worker/skills/website-building/shared/09-technical.md	30	### Step 1: Design Direction	COMMENT
LOW⚡	…-worker/skills/website-building/shared/09-technical.md	33	### Step 2: Build	COMMENT
LOW⚡	…-worker/skills/website-building/shared/09-technical.md	36	### Step 3: Preview Locally	COMMENT
LOW	…-worker/skills/website-building/shared/09-technical.md	50	### Step 4: Verify	COMMENT
LOW	…-worker/skills/website-building/shared/09-technical.md	53	### Step 5: Deliver	COMMENT
LOW⚡	…c/app/[locale]/(auth)/auth/phone-verification/page.tsx	122	// Step 1: Enroll the phone number	COMMENT
LOW⚡	…c/app/[locale]/(auth)/auth/phone-verification/page.tsx	128	// Step 2: Create a challenge (sends SMS)	COMMENT

Synthetic Comment Markers4 hits · 30 pts

Severity	File	Line	Snippet	Context
HIGH⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
HIGH⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
HIGH⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE
HIGH⚡	apps/api/src/connectors/mcp-tools.json	1	{"https://404.directory/mcp":[["understand_webpage","Reads one public human-facing webpage and returns a compact, eviden	CODE

Unused Imports27 hits · 26 pts

Severity	File	Line	Context
LOW	…ompliance-monitoring/functions/alb_alarm_reconciler.py	3	CODE
LOW	…iance-monitoring/functions/ec2_cpu_alarm_reconciler.py	3	CODE
LOW	…iance-monitoring/functions/compliance_alerts_logger.py	3	CODE
LOW	infra/terraform/scripts/test_audit_nacl_admin_ports.py	15	CODE
LOW	infra/terraform/scripts/audit-nacl-admin-ports.py	23	CODE
LOW	infra/terraform/scripts/test_region_colocation.py	31	CODE
LOW	scripts/secrets-sm-parity.py	17	CODE
LOW	…etplace/skills/instagram-reels/scripts/render_short.py	13	CODE
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	28	CODE
LOW	…tplace/skills/instagram-content-studio/scripts/card.py	10	CODE
LOW	…tplace/skills/instagram-content-studio/scripts/card.py	11	CODE
LOW	…kills/instagram-content-studio/scripts/render_short.py	13	CODE
LOW	apps/capture/scripts/compare_trace_artifacts.py	4	CODE
LOW	apps/capture/scripts/compare_screenshot_sync.py	4	CODE
LOW	apps/capture/scripts/ci_update_test.py	29	CODE
LOW	apps/capture/scripts/ci_update_test.py	30	CODE
LOW	apps/capture/scripts/ci_update_test.py	36	CODE
LOW	apps/capture/scripts/render_processed_trace_html.py	4	CODE
LOW	apps/capture/scripts/compare_a11y_artifacts.py	4	CODE
LOW	apps/capture/scripts/analyze_recording_fps.py	4	CODE
LOW	apps/capture/scripts/test_compare_screenshot_sync.py	4	CODE
LOW	apps/capture/scripts/check_resource_soak_summary.py	4	CODE
LOW	apps/capture/scripts/stress_processor_resources.py	4	CODE
LOW	apps/capture/scripts/render_trace_review_sheet.py	4	CODE
LOW	apps/capture/scripts/verify_pii_dataset.py	13	CODE
LOW	…capture/scripts/render_processed_trace_review_sheet.py	4	CODE
LOW	apps/web/scripts/kortix-themes/generate.py	8	CODE

Cross-File Repetition3 hits · 15 pts

Severity	File	Snippet	Context
HIGH	…dge-worker/skills/presentations/scripts/convert_pdf.py	auto-detect chromium executable path for the current platform.	STRING
HIGH	…-worker/skills/presentations/scripts/validate_slide.py	auto-detect chromium executable path for the current platform.	STRING
HIGH	…ge-worker/skills/presentations/scripts/convert_pptx.py	auto-detect chromium executable path for the current platform.	STRING

Example Usage Blocks7 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW	…modules/selfhost-ec2/scripts/check-data-volume-safe.sh	13	# Usage:	COMMENT
LOW	infra/scripts/ecs-deploy.sh	11	# Usage:	COMMENT
LOW	infra/scripts/copy-env-secret.sh	9	# Usage:	COMMENT
LOW⚡	scripts/nuke-local.sh	13	# Usage:	COMMENT
LOW	apps/cli/scripts/e2e-cloud.sh	23	# Usage:	COMMENT
LOW	apps/cli/scripts/e2e-cr.sh	9	# Usage:	COMMENT
LOW	…/src/self-host/assets/supabase/docker-compose.logs.yml	5	# Usage:	COMMENT

Redundant / Tautological Comments7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	…tplace/skills/domain-research/scripts/domain-lookup.py	271	# Check if we only got TLD-level info with no domain data	COMMENT
LOW	…arketplace/skills/legal-writer/scripts/verify-legal.py	150	# Check if the term appears outside its definition	COMMENT
LOW	…arketplace/skills/legal-writer/scripts/verify-legal.py	183	# Check if it might be a top-level section	COMMENT
LOW	apps/mobile/scripts/start-android.sh	20	# Check if emulator is already running	COMMENT
LOW	apps/mobile/scripts/start-android.sh	26	# Check if AVD exists	COMMENT
LOW	apps/mobile/scripts/start-android.sh	48	# Check if dev client is installed	COMMENT
LOW	apps/mobile/scripts/setup-android.sh	16	# Check if running on macOS	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	…rc/customize/sections/view/gateway/gateway-routing.tsx	710	const inherited = routing.data.effective.defaultFallback.models.filter(	CODE

Slop Phrases3 hits · 7 pts

Severity	File	Line	Snippet	Context
MEDIUM	…est-schema/src/__tests__/rewrite-manifest-text.test.ts	29	'# More you can add here: sandbox.templates, tools, triggers.',	CODE
MEDIUM	packages/starter/templates/base/kortix.yaml	32	# More you can add here, each with an example in the reference:	COMMENT
MEDIUM	apps/api/src/projects/lib/my-kortix-prompt.ts	24	- End with one concrete next step you can take, phrased as an offer: "Want me to run it every Monday?" Never end wit	CODE

Verbosity Indicators2 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW⚡	…c/app/[locale]/(auth)/auth/phone-verification/page.tsx	122	// Step 1: Enroll the phone number	COMMENT
LOW⚡	…c/app/[locale]/(auth)/auth/phone-verification/page.tsx	128	// Step 2: Create a challenge (sends SMS)	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/ui/src/customize/sections/gateway-view.tsx	54	* ## This module is also the dialog	COMMENT

AI Structural Patterns1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…rketplace/skills/legal-writer/scripts/courtlistener.py	158		CODE

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…box-agent-server/src/services/static-web/static-web.ts	423	function handleRequest(req: Request, port: number, denied: readonly string[]): Response {	CODE

kortix-ai/suna

Open-Source Code Quality, Security and Technical Debt Review