An ACME-based certificate authority, written in Go.
This report presents the forensic synthetic code analysis of letsencrypt/boulder, a Go project with 5,735 GitHub stars. SynthScan v2.0 examined 130,859 lines of code across 645 source files, recording 310 pattern matches distributed across 11 syntactic categories. The overall adjusted score of 2.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 310 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 261 | # This network is used for two things in the integration tests: | COMMENT |
| LOW | test.sh | 81 | # | COMMENT |
| LOW | test.sh | 301 | exit 1 | COMMENT |
| LOW | va/http_test.go | 861 | COMMENT | |
| LOW | va/http.go | 21 | "github.com/letsencrypt/boulder/identifier" | COMMENT |
| LOW | va/http.go | 61 | func (e *dialerMismatchError) Error() string { | COMMENT |
| LOW | va/http.go | 161 | type httpValidationTarget struct { | COMMENT |
| LOW | va/dns_persist.go | 121 | } | COMMENT |
| LOW | va/caa.go | 221 | // the criticalUnknown bit if there are critical iodef tags. | COMMENT |
| LOW | va/caa.go | 301 | func (va *ValidationAuthorityImpl) getCAA(ctx context.Context, hostname string) (*caaResult, error) { | COMMENT |
| LOW | va/caa.go | 541 | COMMENT | |
| LOW | va/va.go | 61 | // bytes of an arbitrarily sized HTTP/2 SETTINGS frame: | COMMENT |
| LOW | va/va.go | 101 | COMMENT | |
| LOW | va/va.go | 601 | } | COMMENT |
| LOW | va/config/config.go | 21 | // | COMMENT |
| LOW | cmd/config.go | 61 | // database. If MaxIdleConns is greater than 0 and MaxOpenConns is | COMMENT |
| LOW | cmd/config.go | 221 | // HTTP/2 requires us to advertise h2 in the TLS ALPN. | COMMENT |
| LOW | cmd/config.go | 241 | // will use to construct a SRV DNS query to lookup backends. | COMMENT |
| LOW | cmd/config.go | 261 | // hostname the gRPC client will resolve it via the system DNS. If the | COMMENT |
| LOW | cmd/config.go | 281 | // tags = ["tcp"] | COMMENT |
| LOW | cmd/config.go | 301 | // construct a list of backends to connect to. For more details, see the | COMMENT |
| LOW | cmd/config.go | 321 | // id = "some-unique-id-1" | COMMENT |
| LOW | cmd/config.go | 341 | HostOverride string `validate:"omitempty,hostname"` | COMMENT |
| LOW | cmd/config.go | 441 | // These service names must match the service names advertised by gRPC itself, | COMMENT |
| LOW | cmd/config.go | 461 | COMMENT | |
| LOW | cmd/config.go | 501 | } | COMMENT |
| LOW | cmd/config.go | 521 | // contain 'udp' and the 'port' field MUST be a valid port. In a Consul | COMMENT |
| LOW | cmd/config.go | 541 | // Consul) then you should be able to resolve the following dig query: | COMMENT |
| LOW | cmd/boulder-va/main.go | 21 | ) | COMMENT |
| LOW | cmd/boulder-va/main.go | 41 | // given validation was performed, as specified in the "Phased | COMMENT |
| LOW | cmd/boulder-va/main.go | 61 | COMMENT | |
| LOW | cmd/boulder-wfe2/main.go | 81 | // local and remote nonce-service instances. | COMMENT |
| LOW | cmd/boulder-wfe2/main.go | 101 | COMMENT | |
| LOW | cmd/boulder-wfe2/main.go | 121 | // header of the WFE1 instance and the legacy 'reg' path component. This | COMMENT |
| LOW | cmd/boulder-wfe2/main.go | 161 | // limiting. | COMMENT |
| LOW | cmd/boulder-wfe2/main.go | 181 | OverridesFromDB bool | COMMENT |
| LOW | cmd/boulder-wfe2/main.go | 201 | COMMENT | |
| LOW | cmd/sfe/main.go | 81 | } | COMMENT |
| LOW | cmd/boulder-ca/main.go | 61 | // generating them. The minimum value is "01" to ensure that at least | COMMENT |
| LOW | cmd/boulder-ca/main.go | 81 | COMMENT | |
| LOW | cmd/ceremony/cert.go | 41 | // NotBefore should contain the requested NotBefore date for the | COMMENT |
| LOW | cmd/ceremony/main.go | 701 | // certificate-to-cross-sign-path: int-e6.cert.pem | COMMENT |
| LOW | cmd/admin/main.go | 41 | type subcommand interface { | COMMENT |
| LOW | cmd/crl-updater/main.go | 41 | // WARNING: When this number is changed, the "JSON Array of CRL URLs" field | COMMENT |
| LOW | cmd/crl-updater/main.go | 61 | // UpdatePeriod controls how frequently the crl-updater runs and publishes | COMMENT |
| LOW | cmd/crl-updater/main.go | 81 | // MaxAttempts control how many times the updater will attempt to generate | COMMENT |
| LOW | cmd/crl-updater/main.go | 101 | COMMENT | |
| LOW | cmd/bad-key-revoker/main.go | 281 | // progress until this is addressed. | COMMENT |
| LOW | cmd/boulder-ra/main.go | 61 | // enable rate limiting. If any individual rate limit is not set, | COMMENT |
| LOW | cmd/boulder-ra/main.go | 81 | OverridesFromDB bool | COMMENT |
| LOW | cmd/boulder-ra/main.go | 101 | // if the AsyncFinalization feature flag is enabled. Any systems which | COMMENT |
| LOW | cmd/cert-checker/main.go | 561 | // the resource record is 'foo.service.consul', then the 'Service' is 'foo' | COMMENT |
| LOW | cmd/remoteva/main.go | 21 | COMMENT | |
| LOW | cmd/remoteva/main.go | 41 | // - LACNIC | COMMENT |
| LOW | cmd/email-exporter/main.go | 21 | // PerDayLimit enforces the daily request limit imposed by the Pardot | COMMENT |
| LOW | unpause/unpause.go | 101 | // API version of the JWT. This function validates that the JWT is: | COMMENT |
| LOW | tools/fetch-and-verify-go.sh | 21 | # "old block vs new block" is only a subkey update: | COMMENT |
| LOW | bdns/servers.go | 101 | // addresses, and refreshes it regularly using a goroutine started by its | COMMENT |
| LOW | bdns/servers.go | 121 | cancel chan any | COMMENT |
| LOW | core/objects.go | 121 | // a challenge validation with the IPv6 first flag on and the ::1 address | COMMENT |
| 119 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | test/v2_integration.py | 139 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 143 | # Create a broken HTTP redirect similar to a sort we see frequently "in the wild" | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 197 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 201 | # Create a HTTP redirect from the challenge's validation path to itself | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 217 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 221 | # Create a HTTP redirect from the challenge's validation path to a host with | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 238 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 242 | # Create a HTTP redirect from the challenge's validation path to a bare IP | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 259 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 263 | # Create a HTTP redirect from the challenge's validation path to whacky | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 280 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 289 | # Create a HTTP redirect from the challenge's validation path to some other | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 338 | # Create an authz for a random domain and get its HTTP-01 challenge token | COMMENT |
| MEDIUM⚡ | test/v2_integration.py | 347 | # Create a HTTP redirect from the challenge's validation path to an HTTPS | COMMENT |
| MEDIUM | test/v2_integration.py | 77 | # Create a random domains. | COMMENT |
| MEDIUM | test/vtcomboserver/setup_vschema_folder.sh | 56 | # Create a vschema.json file only if the number of shards are more than 1 | COMMENT |
| MEDIUM | test/certs/generate.sh | 20 | # Create a generic cert which can be used by our test-only services that | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | csr/csr_test.go | 65 | signedReqWithEmailAddress.EmailAddresses = []string{"foo@bar.com"} | CODE |
| LOW | test/config/zendesk-test-srv.json | 3 | "expectedTokenEmail": "admin@example.com", | CODE |
| LOW | test/ct-test-srv/log_list.json | 7 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 73 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 109 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 126 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 147 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 164 | "email": ["fake@example.org"], | CODE |
| LOW | test/ct-test-srv/log_list.json | 185 | "email": ["fake@example.org"], | CODE |
| LOW | test/config-next/zendesk-test-srv.json | 3 | "expectedTokenEmail": "admin@example.com", | CODE |
| LOW | test/config-next/sfe.json | 70 | "tokenEmail": "admin@example.com", | CODE |
| LOW | sfe/overridesimporter_test.go | 128 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 164 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 173 | expectOrgComment: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 181 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 190 | expectOrgComment: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 198 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 207 | expectOrgComment: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 215 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 222 | expectOrgComment: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 230 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW⚡ | sfe/overridesimporter_test.go | 239 | expectOrgComment: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 327 | tickerFields: map[string]string{OrganizationFieldName: "Acme Corp"}, | CODE |
| LOW | sfe/overridesimporter_test.go | 338 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 351 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 364 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 378 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 391 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | sfe/overridesimporter_test.go | 404 | OrganizationFieldName: "Acme Corp", | CODE |
| LOW | wfe2/wfe_test.go | 1731 | contacts: []string{"mailto:a@example.org"}, | CODE |
| LOW | salesforce/exporter_test.go | 77 | wantContacts := []string{"test@example.com", "user@example.com"} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | start.py | 15 | CODE | |
| LOW | test/chisel2.py | 16 | CODE | |
| LOW | test/chisel2.py | 19 | CODE | |
| LOW | test/chisel2.py | 20 | CODE | |
| LOW | test/integration-test.py | 20 | CODE | |
| LOW | test/v2_integration.py | 5 | CODE | |
| LOW | test/v2_integration.py | 9 | CODE | |
| LOW | test/v2_integration.py | 15 | CODE | |
| LOW | test/v2_integration.py | 16 | CODE | |
| LOW | test/v2_integration.py | 19 | CODE | |
| LOW | test/v2_integration.py | 23 | CODE | |
| LOW | test/v2_integration.py | 23 | CODE | |
| LOW | test/v2_integration.py | 24 | CODE | |
| LOW | test/v2_integration.py | 25 | CODE | |
| LOW | test/v2_integration.py | 30 | CODE | |
| LOW | test/v2_integration.py | 32 | CODE | |
| LOW | test/v2_integration.py | 33 | CODE | |
| LOW | test/v2_integration.py | 34 | CODE | |
| LOW | test/v2_integration.py | 35 | CODE | |
| LOW | test/v2_integration.py | 36 | CODE | |
| LOW | test/helpers.py | 2 | CODE | |
| LOW | test/helpers.py | 4 | CODE | |
| LOW | test/helpers.py | 7 | CODE | |
| LOW | test/helpers.py | 8 | CODE | |
| LOW | test/helpers.py | 14 | CODE | |
| LOW | test/load-generator/latency-charter.py | 6 | CODE | |
| LOW | test/load-generator/latency-charter.py | 11 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/challtestsrv.py | 150 | def clear_http_request_history(self, host): | CODE |
| LOW | test/challtestsrv.py | 245 | def clear_dns_request_history(self, host): | CODE |
| LOW⚡ | test/v2_integration.py | 117 | def test_http_challenge_dns_err(): | CODE |
| LOW⚡ | test/v2_integration.py | 124 | def test_dns_challenge_dns_err(): | CODE |
| LOW⚡ | test/v2_integration.py | 131 | def test_http_challenge_broken_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 194 | def test_http_challenge_loop_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 214 | def test_http_challenge_badport_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 235 | def test_http_challenge_badhost_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 256 | def test_http_challenge_badproto_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 277 | def test_http_challenge_http_redirect(): | CODE |
| LOW⚡ | test/v2_integration.py | 335 | def test_http_challenge_https_redirect(): | CODE |
| LOW | test/v2_integration.py | 168 | def test_failed_validation_limit(): | CODE |
| LOW | test/v2_integration.py | 413 | class SlowHTTPRequestHandler(BaseHTTPRequestHandler): | CODE |
| LOW | test/v2_integration.py | 433 | def test_http_challenge_timeout(): | CODE |
| LOW | test/v2_integration.py | 476 | def test_overlapping_wildcard(): | CODE |
| LOW | test/v2_integration.py | 512 | def test_wildcard_exactblacklist(): | CODE |
| LOW | test/v2_integration.py | 525 | def test_wildcard_authz_reuse(): | CODE |
| LOW | test/v2_integration.py | 558 | def test_bad_overlap_wildcard(): | CODE |
| LOW | test/v2_integration.py | 572 | def test_order_reuse_failed_authz(): | CODE |
| LOW | test/v2_integration.py | 628 | def test_only_return_existing_reg(): | CODE |
| LOW | test/v2_integration.py | 770 | def test_http_multiva_threshold_pass(): | CODE |
| LOW | test/v2_integration.py | 787 | def test_http_multiva_primary_fail_remote_pass(): | CODE |
| LOW | test/v2_integration.py | 823 | def test_http_multiva_threshold_fail(): | CODE |
| LOW | test/v2_integration.py | 929 | def test_new_order_policy_errs(): | CODE |
| LOW | test/v2_integration.py | 959 | def test_delete_unused_challenges(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ca/ca.go | 216 | // Step 1: Locally process the gRPC request and its embedded CSR to extract | COMMENT |
| LOW | ca/ca.go | 272 | // Step 2: Persist the serial and minimal metadata, to ensure that we never | COMMENT |
| LOW | ca/ca.go | 284 | // Step 3: Issue the linting precert, persist it to the database, and then | COMMENT |
| LOW | ca/ca.go | 367 | // Step 4: Get SCTs for inclusion in the final certificate. | COMMENT |
| LOW | ca/ca.go | 383 | // Step 5: Issue and save the final certificate. | COMMENT |
| LOW | ra/ra.go | 891 | // Step 1: Set up logging/tracing and validate the Order | COMMENT |
| LOW | ra/ra.go | 912 | // Step 2: Set the Order to Processing status | COMMENT |
| LOW⚡ | ra/ra.go | 1182 | // Step 3: Issue the Certificate | COMMENT |
| LOW⚡ | ra/ra.go | 1187 | // Step 4: Fail the order if necessary, and update metrics and log fields | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ca/ca.go | 216 | // Step 1: Locally process the gRPC request and its embedded CSR to extract | COMMENT |
| LOW | ca/ca.go | 272 | // Step 2: Persist the serial and minimal metadata, to ensure that we never | COMMENT |
| LOW | ca/ca.go | 284 | // Step 3: Issue the linting precert, persist it to the database, and then | COMMENT |
| LOW | ca/ca.go | 367 | // Step 4: Get SCTs for inclusion in the final certificate. | COMMENT |
| LOW | ca/ca.go | 383 | // Step 5: Issue and save the final certificate. | COMMENT |
| LOW | ra/ra.go | 891 | // Step 1: Set up logging/tracing and validate the Order | COMMENT |
| LOW | ra/ra.go | 912 | // Step 2: Set the Order to Processing status | COMMENT |
| LOW⚡ | ra/ra.go | 1182 | // Step 3: Issue the Certificate | COMMENT |
| LOW⚡ | ra/ra.go | 1187 | // Step 4: Fail the order if necessary, and update metrics and log fields | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | va/caa.go | 306 | // Essentially: check CAA records for the FDQN to be issued, and all | COMMENT |
| MEDIUM | test/certs.go | 23 | // most tests and isn't a robust example of a complete end entity certificate. | COMMENT |
| MEDIUM | grpc/noncebalancer/noncebalancer.go | 167 | // be robust to the possibility there are more. | COMMENT |
| MEDIUM | sfe/overrides.go | 366 | // Validation here is nuanced: we accept a well-formed Let's Encrypt | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/integration/revocation_test.go | 402 | // The ones done byAccount will succeed as requested, but will not | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/startservers.py | 230 | except Exception as e: | CODE |
| MEDIUM | test/startservers.py | 231 | print("Error querying DNS. Is consul running? `docker compose ps bconsul`. %s" % (e)) | CODE |
| LOW | test/startservers.py | 252 | except Exception as e: | CODE |
| MEDIUM | test/startservers.py | 253 | print("Error starting service %s: %s" % (service.name, e)) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/chisel2.py | 190 | CODE | |
| LOW | test/startservers.py | 216 | CODE | |
| LOW | test/v2_integration.py | 69 | CODE | |
| LOW | test/v2_integration.py | 335 | CODE |