2.9

Adjusted Signal

2.9

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

5.8K

Stars

Language

155.8K

Lines of Code

715

Files

357

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 289 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 60 finding(s).

Agent Over-Engineering Ratio 1.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 33 finding(s).

PR Review Velocity Impact 12.8/100 · LOW

Which changes need focused human review? 357 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 5MEDIUM 23LOW 329

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 357 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block220 hits · 220 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.yml	261	# This network represents the data-center internal network. It is used for	COMMENT
LOW	docker-compose.yml	281	driver: bridge	COMMENT
LOW	test.sh	81	rm "${result_file}"	COMMENT
LOW	test.sh	321	# Note: Some of the tools we use seemingly don't understand ./vendor yet, and	COMMENT
LOW	va/http_test.go	781		COMMENT
LOW	va/http.go	21	"github.com/letsencrypt/boulder/identifier"	COMMENT
LOW	va/http.go	61	func (e *dialerMismatchError) Error() string {	COMMENT
LOW	va/http.go	161	// against the given URL, including port. This may involve querying DNS for the	COMMENT
LOW	va/dns_persist.go	121	}	COMMENT
LOW	va/caa.go	201	case "iodef":	COMMENT
LOW	va/caa.go	281	// given FQDN. The returned result also contains the raw CAA response, and an	COMMENT
LOW	va/caa.go	301	// checkCAARecords fetches the CAA records for the given identifier and then	COMMENT
LOW	va/caa.go	421	// ASCII without whitespace/semi-colons.	COMMENT
LOW	va/va.go	61	// 0x00 0x00 0x?? 0x04 0x00 0x00 0x00 0x00	COMMENT
LOW	va/va.go	101	type vaMetrics struct {	COMMENT
LOW	va/va.go	601	}	COMMENT
LOW	va/config/config.go	21	//	COMMENT
LOW	cmd/config.go	61	// less than MaxIdleConns, then MaxIdleConns will be reduced to	COMMENT
LOW	cmd/config.go	221	Certificates: []tls.Certificate{cert},	COMMENT
LOW	cmd/config.go	241	}	COMMENT
LOW	cmd/config.go	261	type GRPCClientConfig struct {	COMMENT
LOW	cmd/config.go	281	// name = "foo"	COMMENT
LOW	cmd/config.go	301		COMMENT
LOW	cmd/config.go	321	// In a Consul configuration file you would specify 'foo.service.consul' as:	COMMENT
LOW	cmd/config.go	341		COMMENT
LOW	cmd/config.go	441	type GRPCServerConfig struct {	COMMENT
LOW	cmd/config.go	461	// server interceptor.	COMMENT
LOW	cmd/config.go	481	// is being overloaded, and we otherwise handle sampling in the collectors.	COMMENT
LOW	cmd/config.go	501	// unspecified it will default to '53'. If this field is left unspecified	COMMENT
LOW	cmd/config.go	521	// tags = ["udp"]	COMMENT
LOW	cmd/shell.go	161	// function to be deferred.	COMMENT
LOW	cmd/boulder-va/main.go	21	)	COMMENT
LOW	cmd/boulder-va/main.go	41	// given validation was performed, as specified in the "Phased	COMMENT
LOW	cmd/boulder-va/main.go	61		COMMENT
LOW	cmd/boulder-wfe2/main.go	81	// local and remote nonce-service instances.	COMMENT
LOW	cmd/boulder-wfe2/main.go	101		COMMENT
LOW	cmd/boulder-wfe2/main.go	121	// header of the WFE1 instance and the legacy 'reg' path component. This	COMMENT
LOW	cmd/boulder-wfe2/main.go	161	// Redis contains the configuration necessary to connect to Redis	COMMENT
LOW	cmd/boulder-wfe2/main.go	181	// OverridesFromDB causes the WFE and RA to retrieve rate limit	COMMENT
LOW	cmd/boulder-wfe2/main.go	201	// feature.	COMMENT
LOW	cmd/sfe/main.go	81	}	COMMENT
LOW	cmd/boulder-ca/main.go	41	// by the RA during NewOrder and Finalize requests. Must match a	COMMENT
LOW	cmd/boulder-ca/main.go	61	// NewCertificateAuthorityImpl.	COMMENT
LOW	cmd/ceremony/cert.go	41	// NotBefore should contain the requested NotBefore date for the	COMMENT
LOW	cmd/ceremony/cert.go	241	}	COMMENT
LOW	cmd/ceremony/main.go	721	// certificate-to-cross-sign-path: int-e6.cert.pem	COMMENT
LOW	cmd/admin/main.go	41	type subcommand interface {	COMMENT
LOW	cmd/crl-updater/main.go	41	// WARNING: When this number is changed, the "JSON Array of CRL URLs" field	COMMENT
LOW	cmd/crl-updater/main.go	61		COMMENT
LOW	cmd/crl-updater/main.go	81	// new versions of every CRL shard. The Baseline Requirements, Section 4.9.7:	COMMENT
LOW	cmd/crl-updater/main.go	101	// a single CRL shard. A higher number increases the likelihood of a fully	COMMENT
LOW	cmd/crl-updater/main.go	121	// CacheControl is a string passed verbatim to the crl-storer to store on	COMMENT
LOW	cmd/bad-key-revoker/main.go	301	MaximumRevocations int `validate:"gte=0"`	COMMENT
LOW	cmd/boulder-mtpublisher/main.go	41		COMMENT
LOW	cmd/boulder-ra/main.go	61	// Defaults is a path to a YAML file containing default rate limits.	COMMENT
LOW	cmd/boulder-ra/main.go	81	// OverridesFromDB causes the WFE and RA to retrieve rate limit overrides	COMMENT
LOW	cmd/boulder-ra/main.go	101	// FinalizeTimeout is how long the RA is willing to wait for the Order	COMMENT
LOW	cmd/cert-checker/main.go	581	// <hostname\|IPv4\|[IPv6]>:<port> of the DNS server to be used for resolution	COMMENT
LOW	cmd/cert-checker/main.go	601	// is populated, the cert-checker will perform static checks against the	COMMENT
LOW	cmd/cert-checker/main.go	621		COMMENT
160 more matches not shown…

Self-Referential Comments17 hits · 72 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	test/v2_integration.py	139	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	143	# Create a broken HTTP redirect similar to a sort we see frequently "in the wild"	COMMENT
MEDIUM⚡	test/v2_integration.py	197	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	201	# Create a HTTP redirect from the challenge's validation path to itself	COMMENT
MEDIUM⚡	test/v2_integration.py	217	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	221	# Create a HTTP redirect from the challenge's validation path to a host with	COMMENT
MEDIUM⚡	test/v2_integration.py	238	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	242	# Create a HTTP redirect from the challenge's validation path to a bare IP	COMMENT
MEDIUM⚡	test/v2_integration.py	259	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	263	# Create a HTTP redirect from the challenge's validation path to whacky	COMMENT
MEDIUM⚡	test/v2_integration.py	280	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	289	# Create a HTTP redirect from the challenge's validation path to some other	COMMENT
MEDIUM⚡	test/v2_integration.py	338	# Create an authz for a random domain and get its HTTP-01 challenge token	COMMENT
MEDIUM⚡	test/v2_integration.py	347	# Create a HTTP redirect from the challenge's validation path to an HTTPS	COMMENT
MEDIUM	test/v2_integration.py	77	# Create a random domains.	COMMENT
MEDIUM	test/vtcomboserver/setup_vschema_folder.sh	56	# Create a vschema.json file only if the number of shards are more than 1	COMMENT
MEDIUM	test/certs/generate.sh	20	# Create a generic cert which can be used by our test-only services that	COMMENT

Fake / Example Data32 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	csr/csr_test.go	66	signedReqWithEmailAddress.EmailAddresses = []string{"foo@bar.com"}	CODE
LOW	test/config/zendesk-test-srv.json	3	"expectedTokenEmail": "admin@example.com",	CODE
LOW	test/ct-test-srv/log_list.json	7	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	73	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	109	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	126	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	147	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	164	"email": ["fake@example.org"],	CODE
LOW	test/ct-test-srv/log_list.json	185	"email": ["fake@example.org"],	CODE
LOW	test/config-next/zendesk-test-srv.json	3	"expectedTokenEmail": "admin@example.com",	CODE
LOW	test/config-next/sfe.json	70	"tokenEmail": "admin@example.com",	CODE
LOW	…lints/cpcps/lint_subscriber_server_certificate_test.go	149	tmpl.EmailAddresses = []string{"admin@example.com"}	CODE
LOW	sfe/overridesimporter_test.go	128	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	164	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	173	expectOrgComment: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	181	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	190	expectOrgComment: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	198	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	207	expectOrgComment: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	215	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	222	expectOrgComment: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	230	OrganizationFieldName: "Acme Corp",	CODE
LOW⚡	sfe/overridesimporter_test.go	239	expectOrgComment: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	327	tickerFields: map[string]string{OrganizationFieldName: "Acme Corp"},	CODE
LOW	sfe/overridesimporter_test.go	338	OrganizationFieldName: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	351	OrganizationFieldName: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	364	OrganizationFieldName: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	378	OrganizationFieldName: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	391	OrganizationFieldName: "Acme Corp",	CODE
LOW	sfe/overridesimporter_test.go	404	OrganizationFieldName: "Acme Corp",	CODE
LOW	wfe2/wfe_test.go	1735	contacts: []string{"mailto:a@example.org"},	CODE
LOW	salesforce/exporter_test.go	77	wantContacts := []string{"test@example.com", "user@example.com"}	CODE

Unused Imports28 hits · 20 pts

Severity	File	Line	Context
LOW	start.py	15	CODE
LOW	test/chisel2.py	16	CODE
LOW	test/chisel2.py	19	CODE
LOW	test/chisel2.py	20	CODE
LOW	test/startservers.py	8	CODE
LOW	test/integration-test.py	20	CODE
LOW	test/v2_integration.py	5	CODE
LOW	test/v2_integration.py	9	CODE
LOW	test/v2_integration.py	15	CODE
LOW	test/v2_integration.py	16	CODE
LOW	test/v2_integration.py	19	CODE
LOW	test/v2_integration.py	23	CODE
LOW	test/v2_integration.py	23	CODE
LOW	test/v2_integration.py	24	CODE
LOW	test/v2_integration.py	25	CODE
LOW	test/v2_integration.py	30	CODE
LOW	test/v2_integration.py	32	CODE
LOW	test/v2_integration.py	33	CODE
LOW	test/v2_integration.py	34	CODE
LOW	test/v2_integration.py	35	CODE
LOW	test/v2_integration.py	36	CODE
LOW	test/helpers.py	2	CODE
LOW	test/helpers.py	4	CODE
LOW	test/helpers.py	7	CODE
LOW	test/helpers.py	8	CODE
LOW	test/helpers.py	14	CODE
LOW	test/load-generator/latency-charter.py	6	CODE
LOW	test/load-generator/latency-charter.py	11	CODE

Empty Error Handlers4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	test/v2_integration.py	1100	except x509.ExtensionNotFound:	CODE
HIGH	test/v2_integration.py	188	except errors.ValidationError as e:	CODE
HIGH	test/v2_integration.py	424	except:	CODE
HIGH	test/v2_integration.py	706	except requests.exceptions.ConnectionError:	CODE

Hyper-Verbose Identifiers25 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	test/challtestsrv.py	150	def clear_http_request_history(self, host):	CODE
LOW	test/challtestsrv.py	245	def clear_dns_request_history(self, host):	CODE
LOW⚡	test/v2_integration.py	117	def test_http_challenge_dns_err():	CODE
LOW⚡	test/v2_integration.py	124	def test_dns_challenge_dns_err():	CODE
LOW⚡	test/v2_integration.py	131	def test_http_challenge_broken_redirect():	CODE
LOW⚡	test/v2_integration.py	194	def test_http_challenge_loop_redirect():	CODE
LOW⚡	test/v2_integration.py	214	def test_http_challenge_badport_redirect():	CODE
LOW⚡	test/v2_integration.py	235	def test_http_challenge_badhost_redirect():	CODE
LOW⚡	test/v2_integration.py	256	def test_http_challenge_badproto_redirect():	CODE
LOW⚡	test/v2_integration.py	277	def test_http_challenge_http_redirect():	CODE
LOW⚡	test/v2_integration.py	335	def test_http_challenge_https_redirect():	CODE
LOW	test/v2_integration.py	168	def test_failed_validation_limit():	CODE
LOW	test/v2_integration.py	413	class SlowHTTPRequestHandler(BaseHTTPRequestHandler):	CODE
LOW	test/v2_integration.py	433	def test_http_challenge_timeout():	CODE
LOW	test/v2_integration.py	476	def test_overlapping_wildcard():	CODE
LOW	test/v2_integration.py	512	def test_wildcard_exactblacklist():	CODE
LOW	test/v2_integration.py	525	def test_wildcard_authz_reuse():	CODE
LOW	test/v2_integration.py	558	def test_bad_overlap_wildcard():	CODE
LOW	test/v2_integration.py	572	def test_order_reuse_failed_authz():	CODE
LOW	test/v2_integration.py	628	def test_only_return_existing_reg():	CODE
LOW	test/v2_integration.py	770	def test_http_multiva_threshold_pass():	CODE
LOW	test/v2_integration.py	787	def test_http_multiva_primary_fail_remote_pass():	CODE
LOW	test/v2_integration.py	823	def test_http_multiva_threshold_fail():	CODE
LOW	test/v2_integration.py	929	def test_new_order_policy_errs():	CODE
LOW	test/v2_integration.py	959	def test_delete_unused_challenges():	CODE

Verbosity Indicators9 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	ca/ca.go	213	// Step 1: Locally process the gRPC request and its embedded CSR to extract	COMMENT
LOW	ca/ca.go	274	// Step 2: Persist the serial and minimal metadata, to ensure that we never	COMMENT
LOW	ca/ca.go	286	// Step 3: Issue the linting precert, persist it to the database, and then	COMMENT
LOW	ca/ca.go	371	// Step 4: Get SCTs for inclusion in the final certificate.	COMMENT
LOW	ca/ca.go	387	// Step 5: Issue and save the final certificate.	COMMENT
LOW	ra/ra.go	894	// Step 1: Set up logging/tracing and validate the Order	COMMENT
LOW	ra/ra.go	915	// Step 2: Set the Order to Processing status	COMMENT
LOW⚡	ra/ra.go	1194	// Step 3: Issue the Certificate	COMMENT
LOW⚡	ra/ra.go	1199	// Step 4: Fail the order if necessary, and update metrics and log fields	COMMENT

Structural Annotation Overuse9 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	ca/ca.go	213	// Step 1: Locally process the gRPC request and its embedded CSR to extract	COMMENT
LOW	ca/ca.go	274	// Step 2: Persist the serial and minimal metadata, to ensure that we never	COMMENT
LOW	ca/ca.go	286	// Step 3: Issue the linting precert, persist it to the database, and then	COMMENT
LOW	ca/ca.go	371	// Step 4: Get SCTs for inclusion in the final certificate.	COMMENT
LOW	ca/ca.go	387	// Step 5: Issue and save the final certificate.	COMMENT
LOW	ra/ra.go	894	// Step 1: Set up logging/tracing and validate the Order	COMMENT
LOW	ra/ra.go	915	// Step 2: Set the Order to Processing status	COMMENT
LOW⚡	ra/ra.go	1194	// Step 3: Issue the Certificate	COMMENT
LOW⚡	ra/ra.go	1199	// Step 4: Fail the order if necessary, and update metrics and log fields	COMMENT

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	va/caa.go	290	// Essentially: check CAA records for the FDQN to be issued, and all	COMMENT
MEDIUM	test/certs.go	23	// most tests and isn't a robust example of a complete end entity certificate.	COMMENT
MEDIUM	grpc/noncebalancer/noncebalancer.go	167	// be robust to the possibility there are more.	COMMENT
MEDIUM	sfe/overrides.go	366	// Validation here is nuanced: we accept a well-formed Let's Encrypt	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	test/integration/revocation_test.go	403	// The ones done byAccount will succeed as requested, but will not	COMMENT

Excessive Try-Catch Wrapping4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	test/startservers.py	229	except Exception as e:	CODE
MEDIUM	test/startservers.py	230	print("Error querying DNS. Is consul running? `docker compose ps bconsul`. %s" % (e))	CODE
LOW	test/startservers.py	251	except Exception as e:	CODE
MEDIUM	test/startservers.py	252	print("Error starting service %s: %s" % (service.name, e))	CODE

Deep Nesting4 hits · 3 pts

Severity	File	Line	Context
LOW	test/chisel2.py	190	CODE
LOW	test/startservers.py	215	CODE
LOW	test/v2_integration.py	69	CODE
LOW	test/v2_integration.py	335	CODE

letsencrypt/boulder

Open-Source Code Quality, Security and Technical Debt Review