2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

11.8K

Stars

Language

418.7K

Lines of Code

1.9K

Files

507

Pattern Hits

2026-10-31

Scan Date

0.03

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 428 finding(s).

Hallucinated Dependency & Supply Chain Risk 5.0/100 · LOW

Are imports declared and package/API names verified? 70 finding(s).

Agent Over-Engineering Ratio 0.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 10 finding(s).

PR Review Velocity Impact 11.7/100 · LOW

Which changes need focused human review? 507 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 55HIGH 0MEDIUM 19LOW 433

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 507 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators55 hits · 410 pts

Severity	File	Line	Snippet	Context
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	85	object.kind != kind) \|\| (!has(object.spec.template.spec.volumes)) \|\| object.spec.template.spec.volumes.all(vol,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	89	\|\| object.spec.jobTemplate.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	221	['Deployment','ReplicaSet','DaemonSet','StatefulSet', 'Job'].all(kind, object.kind != kind) \|\| object.spec.templat	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	229	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, !(has(container.s	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	422	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| object.spec.template	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	426	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.res	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	752	object.kind != kind) \|\| object.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	757	- expression: object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	810	object.kind != kind) \|\| object.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	813	- expression: object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	906	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| !has(object.spec.tem	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	947	object.kind != 'CronJob' \|\| !has(object.spec.jobTemplate.spec.template.spec.volumes) \|\| object.spec.jobTemplate.sp	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1271	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| object.spec.template	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1283	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, !has(container.po	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1343	object.kind != kind) \|\| !object.spec.template.spec.containers.exists(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1346	- expression: object.kind != 'CronJob' \|\| !object.spec.jobTemplate.spec.template.spec.containers.exists(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1403	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| (!has(object.spec.te	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1411	object.kind != 'CronJob' \|\| (!has(object.spec.jobTemplate.spec.template.spec.volumes)) \|\| object.spec.jobTemplate.	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1530	object.kind != kind) \|\| !has(object.spec.template.spec.volumes) \|\| object.spec.template.spec.volumes.all(vol,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1534	\|\| object.spec.jobTemplate.spec.template.spec.volumes.all(vol, !(has(vol.hostPath)))	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1589	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| object.spec.template	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1593	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, (!(!(has(containe	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1645	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| (has(object.spec.tem	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1648	object.kind != 'CronJob' \|\| (has(object.spec.jobTemplate.metadata) && has(object.spec.jobTemplate.metadata.annotat	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1698	object.kind != kind) \|\| object.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1701	- expression: object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1867	object.kind != kind) \|\| object.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1870	- expression: object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1951	['Deployment','ReplicaSet','DaemonSet','StatefulSet', 'Job'].all(kind, object.kind != kind) \|\| !(has(object.spec.t	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	1959	object.kind != 'CronJob' \|\| !(has(object.spec.jobTemplate.spec.template.spec.volumes)) \|\| object.spec.jobTemplate.	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2023	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| object.spec.template	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2034	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, !(	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2110	!(object.spec.template.metadata.labels.all(label, params.settings.recommendedLabels.all(	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2125	!(object.spec.jobTemplate.metadata.labels.all(label, params.settings.recommendedLabels.all(	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2198	!(object.spec.template.metadata.labels.all(label, params.settings.k8sRecommendedLabels.all(	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2213	!(object.spec.jobTemplate.metadata.labels.all(label, params.settings.k8sRecommendedLabels.all(	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2276	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| object.spec.template	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	2284	object.kind != 'CronJob' \|\| object.spec.jobTemplate.spec.template.spec.containers.all(container, params.settings.i	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	3008	['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) \|\| !has(object.spec.tem	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	3012	object.kind != 'CronJob' \|\| !has(object.spec.jobTemplate.spec.template.spec.volumes) \|\| object.spec.jobTemplate.sp	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4129	object.spec.jobTemplate.spec.selector.matchLabels.all(key,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4135	object.spec.jobTemplate.spec.selector.matchExpressions.all(e,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4280	has(object.spec.podTemplate) && has(object.spec.podTemplate.spec) && has(object.spec.podTemplate.spec.containers)	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4286	object.spec.podTemplate.spec.initContainers.all(c,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4333	!['Sandbox', 'SandboxTemplate'].exists(k, object.kind == k) \|\| (has(object.spec.podTemplate) && has(object.spec.po	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4338	object.spec.podTemplate.spec.initContainers.all(c,	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4388	params == null \|\| !has(params.settings) \|\| !has(params.settings.imageRepositoryAllowList) \|\| size(params.settings.	CODE
CRITICAL	…l/vapdata/kubescape-validating-admission-policies.yaml	4393	object.spec.podTemplate.spec.initContainers.all(c,	CODE
CRITICAL	core/pkg/resourcehandler/handlepullresources_test.go	75	assert.Equal(t, "context-a", session.Metadata.ContextMetadata.ClusterContextMetadata.CloudMetadata.GetFullName())	CODE
CRITICAL	httphandler/storage/apiserver_test.go	60	assert.True(t, scan.Spec.Metadata.Report.CreatedAt.Time.Equal(generatedAt))	CODE
CRITICAL	httphandler/storage/apiserver_test.go	1300	assert.True(t, merged.Metadata.Report.CreatedAt.Time.Equal(refreshedCreatedAt.Time))	CODE
CRITICAL	httphandler/storage/apiserver_test.go	1313	assert.True(t, merged.Metadata.Report.CreatedAt.Time.Equal(initialCreatedAt.Time))	CODE
CRITICAL	httphandler/storage/apiserver_test.go	1326	assert.True(t, merged.Metadata.Report.CreatedAt.Time.Equal(newCreatedAt.Time))	CODE
CRITICAL	httphandler/storage/apiserver_test.go	1587	assert.True(t, stored.Spec.Metadata.Report.CreatedAt.Time.Equal(initialGeneratedAt))	CODE
CRITICAL	httphandler/storage/apiserver_test.go	1596	assert.True(t, stored.Spec.Metadata.Report.CreatedAt.Time.Equal(refreshedGeneratedAt))	CODE

Over-Commented Block396 hits · 396 pts

Severity	File	Line	Snippet	Context
LOW	.goreleaser.yaml	81	# every published asset, so signing that one file transitively binds all of	COMMENT
LOW	install.sh	61	sha256sum "$1" \| awk '{ print $1 }'	COMMENT
LOW	install.sh	81	# deliberately left manual: each needs a tool that is not present on a stock	COMMENT
LOW	cmd/shared/image_scan.go	41	return nil	COMMENT
LOW	cmd/scan/fleetscan.go	81	// subcommand - Scan/ScanContext, HandleResults, and every threshold/drift	COMMENT
LOW	cmd/scan/fleetscan.go	101	// sequentially, writing one report per context. It's the --kube-contexts	COMMENT
LOW	cmd/scan/fleetscan.go	121	// validation use this so invalid fleet invocations still print usage.	COMMENT
LOW	cmd/scan/fleetscan.go	141	if fleetReport != "" && strings.TrimSpace(fleetReport) == "" {	COMMENT
LOW	cmd/scan/fleetscan.go	281	// validateFleetReportPath rejects a --fleet-report path that would land on top	COMMENT
LOW	cmd/scan/fleetscan.go	441	return nil, false	COMMENT
LOW	cmd/scan/fleetscan.go	641	func (e interruptedError) Error() string { return e.err.Error() }	COMMENT
LOW	cmd/scan/fleetscan.go	661	//	COMMENT
LOW	cmd/scan/fleetscan_test.go	181	assert.ErrorContains(t, err, "report.prod_us-east-1.json")	COMMENT
LOW	cmd/scan/fleetscan_test.go	1861	}	COMMENT
LOW	cmd/scan/scan_test.go	581	// Reaches fleetScan (which then reaches ScanContext once per context via	COMMENT
LOW	cmd/scan/scan_test.go	861		COMMENT
LOW	cmd/patch/patch.go	101	patchCmd.PersistentFlags().BoolVarP(&scanInfo.VerboseMode, "verbose", "v", false, "Display full report. Default to fals	COMMENT
LOW	cmd/operator/scan_test.go	41	err = cmd.RunE(&cobra.Command{}, []string{"vulnerabilities"})	COMMENT
LOW	cmd/vap/vap.go	321	// library, in apply order (the CRD first, then the configuration, then the	COMMENT
LOW	cmd/vap/vap.go	481	return true	COMMENT
LOW	cmd/vap/vap.go	781	// is a cluster fact, so this is reported rather than refused.	COMMENT
LOW	cmd/vap/vap.go	901	// resourceSelectorReach resolves what a namespaceSelector does to one resource a	COMMENT
LOW	cmd/vap/vap.go	941	return reachAlwaysMatches	COMMENT
LOW	cmd/vap/vap.go	1021	return reach	COMMENT
LOW	cmd/vap/vap.go	1061	groups: narrowWildcards(constraint.APIGroups, bindingRules[i].APIGroups),	COMMENT
LOW	cmd/vap/vap.go	1081	// out — "*" by definition, and one this version does not know because a scope it	COMMENT
LOW	cmd/mcpserver/analysis_concurrency_probe_test.go	1	package mcpserver	COMMENT
LOW	cmd/mcpserver/rbac_escalation.go	21	var serviceAccountGVR = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "serviceaccounts"}	COMMENT
LOW	cmd/mcpserver/analysis_coalesce.go	21	structured analysisStructured	COMMENT
LOW	cmd/mcpserver/analysis_coalesce.go	41	// are ever introduced, the caller identity must become part of the key.	COMMENT
LOW	cmd/mcpserver/service_exposure.go	21	var ingressGVR = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresses"}	COMMENT
LOW	cmd/mcpserver/scan_helper.go	221		COMMENT
LOW	cmd/mcpserver/vulnerability_list.go	101		COMMENT
LOW	cmd/mcpserver/lifecycle.go	21	mcpDrainPeriod = 20 * time.Second	COMMENT
LOW	cmd/mcpserver/iac_scan_controls.go	61	// Degraded mirrors runScan's signal: the scan did not fully complete,	COMMENT
LOW	cmd/mcpserver/vulnerability_exposure.go	301	// the same relationship kube-proxy itself uses to route a Service's traffic	COMMENT
LOW	cmd/mcpserver/vulnerability_exposure.go	421		COMMENT
LOW	cmd/mcpserver/remediation.go	41	// cluster resource has no file, so its fix is rendered from the scanned object	COMMENT
LOW	cmd/mcpserver/mcpserver.go	161	}	COMMENT
LOW	cmd/mcpserver/mcpserver.go	301	return nil, fmt.Errorf("kubernetes client initialization returned nil")	COMMENT
LOW	core/core/clusterfix.go	61		COMMENT
LOW	core/core/download_test.go	301		COMMENT
LOW	core/core/patch.go	441	}	COMMENT
LOW	core/core/image_scan.go	141		COMMENT
LOW	core/core/image_scan.go	161	// 1. known local-source scheme (docker-archive:, oci-dir:, dir:, purl:,	COMMENT
LOW	core/core/image_scan.go	201	}	COMMENT
LOW	core/core/image_scan.go	721	// selectorLocal: the remainder is opaque local content; the input is	COMMENT
LOW	core/core/image_scan.go	1201		COMMENT
LOW	core/core/download.go	41	TargetExceptions: downloadExceptions,	COMMENT
LOW	core/core/scan.go	901	// count because sessionObj.AllResources is populated asynchronously by the	COMMENT
LOW	core/core/patch_integration_test.go	1	//go:build integration_patch	COMMENT
LOW	core/core/scan_test.go	121	assert.Equal(t, apis.StatusSkipped, controlSummary.GetStatus().Status())	COMMENT
LOW	core/cautils/helmchart.go	221	// Helm passed through unchanged: no "{{" anywhere. The moment a	COMMENT
LOW	core/cautils/helmchart.go	241	// later open, so "unchanged by rendering" and "safe to index" are	COMMENT
LOW	core/cautils/helmchart.go	261	// yamlWorkloadDocuments(), the compacted list of workload-bearing	COMMENT
LOW	core/cautils/helmchart.go	341	workloads []workloadinterface.IMetadata	COMMENT
LOW	core/cautils/helmchart.go	421	// call a file templated, which only costs a missed opportunity to show a	COMMENT
LOW	core/cautils/clustercontext.go	1	package cautils	COMMENT
LOW	core/cautils/operatorscaninfo.go	141	// Supported actions: `annotate`, `quarantine` and `revert`; the `cordon` action	COMMENT
LOW	core/cautils/fileutils.go	81	// Helm value overrides and release identity supplied via valueOpts are merged over the chart defaults before rendering.	COMMENT
336 more matches not shown…

Decorative Section Separators6 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	examples/helm_chart/values.yaml	6	# ┌────────────── timezone (optional)	COMMENT
MEDIUM⚡	examples/helm_chart/values.yaml	7	# \| ┌───────────── minute (0 - 59)	COMMENT
MEDIUM⚡	examples/helm_chart/values.yaml	8	# \| │ ┌───────────── hour (0 - 23)	COMMENT
MEDIUM⚡	examples/helm_chart/values.yaml	9	# \| │ │ ┌───────────── day of the month (1 - 31)	COMMENT
MEDIUM⚡	examples/helm_chart/values.yaml	10	# \| │ │ │ ┌───────────── month (1 - 12)	COMMENT
MEDIUM⚡	examples/helm_chart/values.yaml	11	# \| │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;	COMMENT

Redundant / Tautological Comments17 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	core/cautils/getter/testdata/NSA.json	617	"rule": "package armo_builtins\n\n\n# Check if container has limits\ndeny[msga] {\n \tpods := [pod \| pod = in	CODE
LOW	core/cautils/getter/testdata/NSA.json	1687	"rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\	CODE
LOW	core/cautils/getter/testdata/NSA.json	1747	"rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for GKE\nde	CODE
LOW	core/cautils/getter/testdata/NSA.json	1790	"rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native	CODE
LOW	core/cautils/getter/testdata/NSA.json	1850	"rule": "package armo_builtins\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_	CODE
LOW	core/cautils/getter/testdata/NSA.json	1893	"rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled f	CODE
LOW	core/cautils/getter/testdata/NSA.json	1955	"rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input	CODE
LOW	core/cautils/getter/testdata/NSA.json	1998	"rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod :=	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2251	"rule": "package armo_builtins\n\ndeny[msga] {\n\tdeployment := input[_]\n\tdeployment.kind == \"Deployment\"\	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2311	"rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for GKE\nde	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2354	"rule": "package armo_builtins\nimport data.cautils as cautils\n\n# Check if audit logs is enabled for native	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2414	"rule": "package armo_builtins\n\n\n# Check if encryption in etcd in enabled for EKS\ndeny[msga] {\n\tcluster_	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2457	"rule": "package armo_builtins\n\nimport data.cautils as cautils\n\n# Check if encryption in etcd is enabled f	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2517	"rule": "package armo_builtins\n\n\n# Check if PSP is enabled for GKE\ndeny[msga] {\n\tcluster_config := input	CODE
LOW	core/cautils/getter/testdata/MITRE.json	2560	"rule": "package armo_builtins\n\n\n# Check if psp is enabled for native k8s\ndeny[msga] {\n\tapiserverpod :=	CODE
LOW	…processor/cel/vapdata/basic-control-configuration.yaml	8	# Set this to eks, aks or gke to make C-0020 check that cloud's credential	COMMENT
LOW	smoke_testing/test_version.py	24	# Check if RELEASE (with or without 'v' prefix) is in the output	COMMENT

Fake / Example Data15 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	cmd/mcpserver/secret_exposure.go	55	"placeholder": {},	CODE
LOW	cmd/mcpserver/secret_exposure_test.go	2325	{"db.password", "placeholder", false},	CODE
LOW	cmd/mcpserver/secret_exposure_test.go	2328	{"api.key", "placeholder", false},	CODE
LOW	core/pkg/fixhandler/unfixed_test.go	622	"placeholder": {Path: sc + ".seccompProfile.type", Value: "YOUR_VALUE"},	CODE
LOW	core/pkg/fixhandler/unfixed_test.go	638	"placeholder": {Path: sc + ".seccompProfile", Value: "YOUR_VALUE"},	CODE
LOW	core/pkg/fixhandler/unfixed_test.go	641	want: []string{"placeholder", "sibling"},	CODE
LOW	core/pkg/reportcrypto/decrypt_test.go	63	"John Doe",	CODE
LOW	core/pkg/reportcrypto/decrypt_test.go	164	"John Doe",	CODE
LOW	core/pkg/reportcrypto/decrypt_test.go	356	"John Doe",	CODE
LOW	core/pkg/reportcrypto/decrypt_test.go	452	"John Doe",	CODE
LOW	core/pkg/anonymizer/session_test.go	971	CommitterName: "John Doe",	CODE
LOW	core/pkg/anonymizer/session_test.go	1087	CommitterName: "John Doe",	CODE
LOW	httphandler/main_test.go	445	token: fake-token	CODE
LOW	httphandler/listener/setup_test.go	75	t.Setenv("KS_CERT_FILE", "placeholder") // registers cleanup/restore	CODE
LOW	httphandler/listener/setup_test.go	88	t.Setenv("KS_KEY_FILE", "placeholder") // registers cleanup/restore	CODE

AI Slop Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	core/pkg/k8scveindex/data/official-cve-feed.json	1	{"_kubernetes_io":{"feed_refresh_job":"https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",	CODE
MEDIUM⚡	core/pkg/k8scveindex/data/official-cve-feed.json	1	{"_kubernetes_io":{"feed_refresh_job":"https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",	CODE
MEDIUM⚡	core/pkg/k8scveindex/data/official-cve-feed.json	1	{"_kubernetes_io":{"feed_refresh_job":"https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",	CODE
MEDIUM	core/pkg/hostsensorutils/utils_test.go	65	// Essentially, unless we hit some extreme edge case, we never get an error to be added to the map.	COMMENT
MEDIUM	.github/scripts/goreleaser-post-e2e.sh	5	# A small, robust POSIX shell script intended to be called from the goreleaser	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/vap/vap.go	42	# Create a policy binding by Kubescape control ID	COMMENT
MEDIUM	cmd/vap/vap.go	44	# Create a policy binding by ValidatingAdmissionPolicy name	COMMENT
MEDIUM	core/pkg/fixhandler/postrenderer.go	104	# Create an isolated temporary workspace for this execution	COMMENT
MEDIUM	examples/cloud-vendor-integration/aws.sh	35	# Create a kubescape policy	COMMENT

Modern AI Meta-Vocabulary2 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	core/pkg/k8scveindex/data/official-cve-feed.json	1	{"_kubernetes_io":{"feed_refresh_job":"https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",	CODE
MEDIUM	docs/architecture.md	320	The outbound connections in [Actors and actions](#actors-and-actions). A scan of a cluster, an image or a remote reposit	CODE

Excessive Try-Catch Wrapping3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	smoke_testing/smoke_utils.py	17	except Exception as e:	CODE
MEDIUM	smoke_testing/smoke_utils.py	7	def run_command(command, stdin=subprocess.PIPE, stderr=subprocess.STDOUT):	CODE
LOW	smoke_testing/test_scan.py	73	except Exception as e:	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	core/pkg/k8scveindex/data/official-cve-feed.json	1	{"_kubernetes_io":{"feed_refresh_job":"https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed",	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	.github/scripts/goreleaser-post-e2e.sh	9	# Usage:	COMMENT

TODO Padding1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	core/core/initutils_test.go	646	}, // TODO: Add test "If CloudReportURL is set"	CODE

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	smoke_testing/test_scan.py	48	def scan_all_format_pretty_printer(kubescape_exec: str):	CODE

kubescape/kubescape

Open-Source Code Quality, Security and Technical Debt Review