Double-entry accounting system with a command-line reporting interface
This report summarizes scanner evidence for ledger/ledger, a C++ project with 6,053 GitHub stars. SynthScan examined 40,430 lines of code across 207 source files, recording 214 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 7.8 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 150 finding(s).
Are imports declared and package/API names verified? 16 finding(s).
Are wrappers, guards, and repeated structures necessary? 94 finding(s).
Which changes need focused human review? 214 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 214 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | lefthook.yml | 19 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | lefthook.yml | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | lefthook.yml | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | lefthook.yml | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | test/snapshot.py | 20 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | test/snapshot.py | 22 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | test/snapshot.py | 32 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | test/snapshot.py | 34 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 74 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 76 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 229 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 231 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 328 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 330 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 434 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 436 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 480 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 482 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 522 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 524 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 572 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 574 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 605 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 607 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 682 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 684 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 707 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 709 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 776 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 778 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 806 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 808 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 829 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | test/snapshot.py | 831 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CMakeLists.txt | 601 | COMMENT | |
| LOW | ubsan-suppressions.txt | 1 | # UndefinedBehaviorSanitizer (UBSan) suppression file for known pre-existing issues. | COMMENT |
| LOW | lsan-suppressions.txt | 1 | # LeakSanitizer (LSan) suppression file for known pre-existing leaks. | COMMENT |
| LOW | lefthook.yml | 1 | # lefthook.yml | COMMENT |
| LOW | benchmark/run_benchmark.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | benchmark/profile.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/update_copyright_year.sh | 1 | #!/bin/sh | COMMENT |
| LOW | test/CMakeLists.txt | 41 | add_subdirectory(baseline) | COMMENT |
| LOW | test/GenerateTests.py | 21 | COMMENT | |
| LOW | test/GenerateTests.py | 61 | #p_cerr_bal.stdin.close() | COMMENT |
| LOW | test/regress/2152.py | 1 | import ledger | COMMENT |
| LOW | test/regress/752.py | 1 | import ledger | COMMENT |
| LOW | test/regress/2163.py | 1 | import ledger | COMMENT |
| LOW | test/regress/1019.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/regress/2169.py | 1 | import ledger | COMMENT |
| LOW | test/regress/2098.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/regress/976.py | 1 | import ledger | COMMENT |
| LOW | test/regress/513.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/regress/1796.py | 1 | import ledger | COMMENT |
| LOW | test/regress/3229.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/scripts/mock-getquote-with-exchange.sh | 1 | #!/bin/sh | COMMENT |
| LOW | python/demo.py | 21 | COMMENT | |
| LOW | python/demo.py | 41 | # - Did you use European-style numbers (1.000,00)? | COMMENT |
| LOW | python/demo.py | 101 | COMMENT | |
| LOW | python/demo.py | 241 | # | COMMENT |
| LOW | python/demo.py | 261 | # promotes itself to a Balance object to make the addition valid. | COMMENT |
| LOW | contrib/ledger-completion.bash | 1 | ### Assumption | COMMENT |
| LOW | contrib/ledger-completion.bash | 41 | # Options are found in source code: | COMMENT |
| LOW | contrib/ledger-completion.bash | 81 | return 0 | COMMENT |
| LOW | contrib/non-profit-audit-reports/readcsv.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | contrib/non-profit-audit-reports/csv2ods.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 1 | "ooolib-python - Copyright (C) 2006-2009 Joseph Colton" | COMMENT |
| LOW | contrib/iso4127-commodities/iso4217ledger.sh | 1 | #!/bin/sh | COMMENT |
| LOW | contrib/raw/GenerateLatexExpeneseReport.pl | 121 | COMMENT | |
| LOW | .github/FUNDING.yml | 1 | # These are supported funding model platforms | COMMENT |
| LOW | .github/workflows/nix-flake.yml | 21 | - uses: actions/checkout@v7 | COMMENT |
| LOW | lib/utfcpp/v4/source/utf8/core.h | 41 | #endif | COMMENT |
| LOW | lib/utfcpp/v4/tests/noexceptionstests.cpp | 1 | #include "ftest.h" | COMMENT |
| LOW | lib/utfcpp/v4/tests/ftest.h | 221 | std::cout << __FILE__ << ":" << __LINE__ << ": Failure\n"; \ | COMMENT |
| LOW | lib/utfcpp/v4/tests/apitests.cpp | 1 | #include "ftest.h" | COMMENT |
| LOW | src/amount.h | 721 | #define AMOUNT_PRINT_COLORIZE 0x02 | COMMENT |
| LOW | src/commodity.h | 121 | #define COMMODITY_NOMARKET 0x010 ///< Exclude from market-price valuations (-V/-X). | COMMENT |
| LOW | src/error.h | 101 | /// are separated by newlines. The parser calls this as it enters | COMMENT |
| LOW | src/utils.h | 181 | std::size_t current_memory_size(); | COMMENT |
| LOW | src/utils.h | 401 | #define SHOW_ERROR() \ | COMMENT |
| LOW | src/utils.h | 461 | } \ | COMMENT |
| LOW | src/utils.h | 481 | #define DEBUG_STOP_(name) DEBUG_STOP_(name, _this_category) | COMMENT |
| LOW | src/utils.h | 501 | } // namespace ledger | COMMENT |
| LOW | src/post.h | 101 | public: | COMMENT |
| LOW | src/post.h | 281 | * through the filter chain: running totals, display totals, sort keys, | COMMENT |
| LOW | src/op.h | 341 | /// Compilation resolves identifiers (IDENT) to their definitions in | COMMENT |
| LOW | src/op.h | 361 | /// @param scope The runtime scope providing variable/function bindings. | COMMENT |
| LOW | src/op.h | 441 | temp->set_function(fobj); | COMMENT |
| LOW | src/pool.h | 141 | static std::shared_ptr<commodity_pool_t> current_pool; | COMMENT |
| LOW | src/pool.h | 161 | commodity_t* find(const string& name); | COMMENT |
| LOW | src/pool.h | 181 | /// @} | COMMENT |
| LOW | src/pool.h | 201 | /// @brief Look up an annotated commodity by base commodity reference, | COMMENT |
| LOW | src/query.h | 341 | /// @brief Scan a quoted or delimited pattern (`'...'`, `"..."`, `/.../`). | COMMENT |
| LOW | src/times.h | 121 | /// year for dates whose format lacks a year component (e.g., `01/15`). | COMMENT |
| LOW | src/times.h | 141 | /// Configurable so that `weekly` reports can begin on Monday, etc. | COMMENT |
| 13 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | test/python/PostingTest.py | 50 | def test_posting_amount_value(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 56 | def test_posting_amount_with_cost(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 65 | def test_posting_account_name(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 73 | def test_posting_account_hierarchy(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 111 | def test_posting_given_cost_none(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 116 | def test_posting_has_tag_string(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 124 | def test_posting_get_tag_string(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 132 | def test_posting_get_tag_missing(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 139 | def test_posting_tag_inheritance(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 172 | def test_must_balance_regular(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 177 | def test_must_balance_virtual_balanced(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 184 | def test_must_balance_virtual_unbalanced(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 203 | def test_is_virtual_true_for_balanced_virtual(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 210 | def test_is_virtual_true_for_unbalanced_virtual(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 249 | def test_posting_state_cleared(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 256 | def test_posting_state_uncleared(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 262 | def test_posting_state_pending(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 276 | def test_posting_xact_reference(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 284 | def test_posting_xact_payee_different_transactions(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 292 | def test_posting_xdata_lifecycle(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 343 | def test_posting_iterator_on_xact(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 353 | def test_posting_iterator_counts(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 363 | def test_posting_balancing_amount(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 369 | def test_multiple_queries_xdata_stability(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 539 | def test_posting_no_assigned_amount(self): | CODE |
| LOW | test/python/PostingTest.py | 155 | def test_reported_account_default(self): | CODE |
| LOW | test/python/PostingTest.py | 161 | def test_set_reported_account(self): | CODE |
| LOW | test/python/PostingTest.py | 304 | def test_posting_xdata_create_after_clear(self): | CODE |
| LOW | test/python/PostingTest.py | 382 | def test_query_then_iterate_stability(self): | CODE |
| LOW | test/python/PostingTest.py | 396 | def test_sequential_queries_different_accounts(self): | CODE |
| LOW | test/python/PostingTest.py | 410 | def test_multiple_postings_same_query(self): | CODE |
| LOW | test/python/PostingTest.py | 417 | def test_posting_assigned_amount_none(self): | CODE |
| LOW | test/python/PostingTest.py | 430 | def test_posting_account_identity(self): | CODE |
| LOW | test/python/PostingTest.py | 570 | def test_transaction_level_tag_inherited(self): | CODE |
| LOW | test/python/PostingTest.py | 578 | def test_multiple_tags_on_posting(self): | CODE |
| LOW | test/python/PostingTest.py | 604 | def test_get_tag_value_content(self): | CODE |
| LOW | test/python/PostingTest.py | 612 | def test_get_tag_txn_value_content(self): | CODE |
| LOW⚡ | test/python/PostingTest.py | 40 | def test_basic_posting_access(self): | STRING |
| LOW⚡ | test/python/PostingTest.py | 197 | def test_is_virtual_false_for_real_posting(self): | STRING |
| LOW⚡ | test/python/PostingTest.py | 531 | def test_posting_assigned_amount(self): | STRING |
| LOW | test/python/PostingTest.py | 223 | def test_has_flags_post_virtual(self): | STRING |
| LOW | cmake/strip_pch_flags.py | 22 | def get_compiler_implicit_flags(compiler: str) -> list[str]: | CODE |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 1067 | def parse_content_start_element(self, name, attrs): | CODE |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 1152 | def parse_content_end_element(self, name): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/DocTests.py | 94 | except KeyError: | CODE |
| HIGH | test/DocTests.py | 66 | except IndexError: | CODE |
| HIGH | test/DocTests.py | 192 | except ValueError: | CODE |
| HIGH | test/regress/819.py | 18 | except ImportError: | CODE |
| HIGH | python/demo.py | 149 | except ArithmeticError: | CODE |
| HIGH | contrib/getquote-uk.py | 24 | except: pass | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/DocTests.py | 47 | CODE | |
| LOW | test/DocTests.py | 142 | CODE | |
| LOW | test/CheckTexinfo.py | 20 | CODE | |
| LOW | test/CheckTexinfo.py | 60 | CODE | |
| LOW | test/RegressTests.py | 31 | CODE | |
| LOW | test/RegressTests.py | 101 | CODE | |
| LOW | test/snapshot.py | 356 | CODE | |
| LOW | test/snapshot.py | 438 | CODE | |
| LOW | test/snapshot.py | 837 | CODE | |
| LOW | test/semantic/check_all.py | 63 | CODE | |
| LOW | test/semantic/check_all.py | 133 | CODE | |
| LOW | test/semantic/check_all.py | 159 | CODE | |
| LOW | test/semantic/sweep.py | 154 | CODE | |
| LOW | cmake/strip_pch_flags.py | 22 | CODE | |
| LOW | cmake/strip_pch_flags.py | 94 | CODE | |
| LOW | contrib/non-profit-audit-reports/csv2ods.py | 67 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 420 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 527 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 542 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 787 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 1173 | CODE | |
| LOW | scripts/orchestrator.py | 98 | CODE | |
| LOW | scripts/orchestrator.py | 229 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/semantic/check_all.py | 196 | " 'lake exe cache get && lake build'\n" | CODE |
| HIGH | python/demo.py | 79 | # There are a few built-in commodities: null, %, h, m and s. Normally you | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | benchmark/compare_benchmarks.py | 34 | print("Error: baseline has no benchmark results", file=sys.stderr) | CODE |
| MEDIUM | benchmark/compare_benchmarks.py | 105 | print(f"Error: baseline file not found: {args.baseline}", file=sys.stderr) | CODE |
| MEDIUM | benchmark/compare_benchmarks.py | 108 | print(f"Error: candidate file not found: {args.candidate}", file=sys.stderr) | CODE |
| MEDIUM | test/snapshot.py | 843 | print(f"Error: ledger binary not found: {args.ledger_binary}", file=sys.stderr) | CODE |
| MEDIUM | test/snapshot.py | 846 | print(f"Error: data file not found: {args.data_file}", file=sys.stderr) | CODE |
| MEDIUM | test/snapshot.py | 875 | print(f"Error: no combos found for command '{args.only_command}'", file=sys.stderr) | CODE |
| LOW | scripts/orchestrator.py | 196 | except Exception as e: | CODE |
| LOW | scripts/orchestrator.py | 354 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/CheckOptions.py | 5 | CODE | |
| LOW | test/snapshot.py | 4 | CODE | |
| LOW | test/python/PostingTest.py | 4 | CODE | |
| LOW | test/python/PostingTest.py | 6 | CODE | |
| LOW | test/python/PostingTest.py | 7 | CODE | |
| LOW | test/python/JournalTest.py | 5 | CODE | |
| LOW | test/python/TransactionTest.py | 4 | CODE | |
| LOW | test/python/TransactionTest.py | 6 | CODE | |
| LOW | test/python/TransactionTest.py | 7 | CODE | |
| LOW | test/python/ValueTest.py | 6 | CODE | |
| LOW | test/regress/1205.py | 9 | CODE | |
| LOW | test/regress/B21BF389.py | 3 | CODE | |
| LOW | test/regress/819.py | 17 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/CheckEnvVars.py | 8 | # The standard test harness uses --args-only which skips env var processing, | COMMENT |
| MEDIUM⚡ | test/python/PostingTest.py | 547 | """Dedicated test case for comprehensive tag operations.""" | STRING |
| MEDIUM | test/semantic/check_all.py | 255 | # absence is a harness error, not a quiet omission. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/compare_benchmarks.py | 68 | # Print results table | COMMENT |
| LOW | scripts/orchestrator.py | 155 | # Check if test file was created | COMMENT |
| LOW | scripts/orchestrator.py | 184 | # Check if a test file was partially created before timeout | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | python/demo.py | 50 | # commodity without parsing an amount, you can use the method | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | contrib/getquote-uk.py | 13 | CODE | |
| LOW | contrib/non-profit-audit-reports/ooolib2/__init__.py | 51 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/profile.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/gen_benchmark.py | 35 | "Acme Corp", "Freelance Client", "Bank Interest", | CODE |