A self-hosted travel/trip planner with real-time collaboration, interactive maps, PWA support, SSO, budgets, packing lists, and more.
This report summarizes scanner evidence for liketrek/TREK, a TypeScript project with 14,705 GitHub stars. SynthScan examined 1,044,694 lines of code across 4821 source files, recording 3022 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 7.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 299 finding(s).
Are imports declared and package/API names verified? 96 finding(s).
Are wrappers, guards, and repeated structures necessary? 2711 finding(s).
Which changes need focused human review? 3022 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3022 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugin-sdk/test/checks-parity.test.ts | 51 | // ── 1. the README gate's constants ──────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/test/checks-parity.test.ts | 80 | // ── 2. the registry's real validator, run against an entry we built ─────────── | COMMENT |
| MEDIUM | plugin-sdk/src/index.ts | 397 | // ── integration hook interfaces ────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 39 | // ── decoration ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 50 | // ── cancellation ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 61 | // ── prompts (cancel-checked, stderr-rendered) ──────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 85 | // ── permissions ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/ui.ts | 288 | // ── flag helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 71 | // ── 1. the tag resolves to the pinned commit ──────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 111 | // ── 2. the manifest at the pinned commit matches the entry ────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 160 | // ── 3. the released artifact ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 222 | // ── 4. the README at the pinned commit ────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/network.ts | 294 | // ── 5. owner binding (NEW — the registry has always enforced this) ─────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 38 | // ── manifest ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 266 | // ── code ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 366 | // ── docs ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugin-sdk/src/cli/checks/offline.ts | 483 | // ── release ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/egress-policy.test.ts | 126 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/egress-policy.test.ts | 128 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/plugins/safe-extract.test.ts | 13 | // ── tiny archive builders ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 226 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 228 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 235 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/mcp/tools-prompts.test.ts | 237 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 267 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 269 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 304 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 306 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 372 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 374 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 442 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/mcp/tools-prompts.test.ts | 444 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/db/migration-hygiene.test.ts | 85 | // ── table rebuilds (data preserved) ────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/db/migration-hygiene.test.ts | 97 | // ── photo/journey table rebuilds (data preserved) ──────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 121 | // ── template/cache scaffolding drops (no user content lost) ────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 127 | // ── guarded column drop ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/tests/unit/db/migration-hygiene.test.ts | 131 | // ── targeted, bounded DELETEs ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 50 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 217 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/memories.controller.test.ts | 553 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 16 | // ── DB setup ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 72 | // ── Calendar parts the stub hands back ──────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 118 | // ── Trip feed token ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 218 | // ── User (all-trips) feed token ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 264 | // ── buildTripIcs ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/feeds.service.test.ts | 314 | // ── buildUserIcs ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 13 | // ── DB setup ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 77 | // ── getClientIp (pure, moved 1:1) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/tests/unit/nest/audit.service.test.ts | 114 | // ── writeAudit (real DB) ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 71 | // ── Collaborator stubs ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 182 | // ── Fixtures ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 321 | // ── list / getOne ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 414 | // ── accept: place ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 600 | // ── accept: journal ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 723 | // ── accept: bucket list ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 779 | // ── accept twice / state ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 833 | // ── bucket-list confirmation ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 898 | // ── bucket-list scan (client stubbed, never the network) ───────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 1109 | // ── Atlas ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …r/tests/unit/nest/dawarich-suggestions.service.test.ts | 1260 | // ── What an acceptance tells the rest of the trip ────────────────────────── | COMMENT |
| 2567 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.minio-test.yml | 1 | # Manual, license-gated live-provider test for the env-gated S3 driver | COMMENT |
| LOW | docker-compose.minio-test.yml | 21 | # argument, so `command: minio server /data --license /minio.license` | COMMENT |
| LOW | docker-compose.yml | 21 | - ENCRYPTION_KEY=${ENCRYPTION_KEY:-} # Recommended. Generate with: openssl rand -hex 32. If unset, falls back to d | COMMENT |
| LOW | docker-compose.yml | 41 | # - OIDC_CLIENT_SECRET=supersecret # OpenID Connect client secret | COMMENT |
| LOW | charts/trek/values.yaml | 21 | NODE_ENV: production | COMMENT |
| LOW | charts/trek/values.yaml | 41 | # Also used as the base URL for links in email notifications and other external links. | COMMENT |
| LOW | charts/trek/values.yaml | 61 | # OpenID Connect provider URL. | COMMENT |
| LOW | charts/trek/values.yaml | 81 | # Max MCP API requests per user per minute. Defaults to 300. | COMMENT |
| LOW | charts/trek/values.yaml | 101 | # nothing there. There is no switch in the admin panel on purpose: whether searches leave the instance is decided | COMMENT |
| LOW | charts/trek/values.yaml | 121 | # 2. data/.encryption_key auto-generated on first start (fresh installs) | COMMENT |
| LOW | wiki/Install-Helm.md | 101 | port: 3000 | COMMENT |
| LOW | wiki/Plugin-Development.md | 1561 | # how you sideload a plugin to try it locally. | COMMENT |
| LOW | wiki/Plugin-Development.md | 1581 | COMMENT | |
| LOW | plugin-sdk/examples/koffi/client/index.html | 61 | #puffS, #squint { transform-box: view-box; } | COMMENT |
| LOW | plugin-sdk/examples/trip-doctor/server/index.js | 1 | // Trip Doctor — a hooks-only TREK plugin that showcases the #1429 capabilities. | COMMENT |
| LOW | plugin-sdk/src/cli/dev.ts | 401 | // /__dev/fire/job/refresh · /__dev/fire/scheduled/daily · /__dev/fire/event/place:created | COMMENT |
| LOW | plugin-sdk/src/cli/dev.ts | 461 | // is where the design kit actually renders themed. | COMMENT |
| LOW | plugin-sdk/src/cli/create.ts | 141 | // Floor 4.0.0: the host surface this scaffold is written against — the enforced | COMMENT |
| LOW | plugin-sdk/src/cli/create.ts | 161 | // A notification channel usually targets a SELF-HOSTED service, whose hostname the | COMMENT |
| LOW | server/vitest.config.ts | 41 | // module runs in-process and is unit-tested. | COMMENT |
| LOW | server/tests/setup.console-noise.ts | 1 | // Filters *expected* noise off the test console so real failures stay visible | COMMENT |
| LOW | server/tests/setup.ts | 1 | // Global test setup — runs before every test file. | COMMENT |
| LOW | server/tests/setup.ts | 41 | // Nominatim's rate limit is a property of the real service, not of the code | COMMENT |
| LOW | server/tests/unit/plugins/egress-policy.test.ts | 121 | expect(dgramConnectTarget([53])).toBeNull(); | COMMENT |
| LOW | server/tests/unit/nest/dawarich.helpers.test.ts | 481 | COMMENT | |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 321 | // exactly as the local branch's res.sendFile already does. It must be a | COMMENT |
| LOW | server/tests/unit/services/passwordPolicy.test.ts | 41 | }); | COMMENT |
| LOW | server/tests/integration/storage-stream-abort.test.ts | 201 | .on('error', reject); | COMMENT |
| LOW | server/scripts/entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | server/src/index.ts | 1 | import 'reflect-metadata'; | COMMENT |
| LOW | server/src/index.ts | 81 | let server: http.Server; | COMMENT |
| LOW | server/src/config.ts | 1 | import crypto from 'node:crypto'; | COMMENT |
| LOW | server/src/bootstrap.ts | 101 | ]), | COMMENT |
| LOW | server/src/bootstrap.ts | 181 | // Fail closed on the anonymous surface too: a route that answers without a | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 161 | // sibling subdomain the same operator may still be running over plain | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 221 | "https://nominatim.openstreetmap.org", "https://overpass-api.de", | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 241 | // through fetch to hand it to WebGL, and the prefetch does too, so both were | COMMENT |
| LOW | server/src/middleware/globalMiddleware.ts | 261 | // A self-hosted routing engine, when the instance has one configured. Without | COMMENT |
| LOW | server/src/utils/ssrfGuard.ts | 81 | COMMENT | |
| LOW | server/src/mcp/scopes.ts | 41 | // journey:write. The policy's fallback branch covers both. | COMMENT |
| LOW | server/src/db/migrations.ts | 2361 | // reminder for each todo so we don't spam the same notification | COMMENT |
| LOW | server/src/db/migrations.ts | 2781 | )`, | COMMENT |
| LOW | server/src/db/migrations.ts | 2881 | user_id INTEGER REFERENCES users(id) ON DELETE CASCADE, | COMMENT |
| LOW | server/src/db/migrations.ts | 3661 | // case the activation gate has to catch after a TREK upgrade. Kept nullable: a plugin | COMMENT |
| LOW | server/src/db/migrations.ts | 3841 | // Backfill the three places feature toggles before their read flips from | COMMENT |
| LOW | server/src/db/migrations.ts | 3921 | // #1939 — the Google Places and Unsplash keys are instance configuration and | COMMENT |
| LOW | server/src/db/migrations.ts | 4081 | // column; the storage layer addresses objects as category + bare name, so | COMMENT |
| LOW | server/src/db/migrations.ts | 4101 | // only helps a fresh install — the array is index-addressed against | COMMENT |
| LOW | server/src/db/migrations.ts | 4701 | }, | COMMENT |
| LOW | server/src/db/migrations.ts | 4721 | if (!hasMode) db.exec("ALTER TABLE mcp_tokens ADD COLUMN scope_mode TEXT NOT NULL DEFAULT 'all'"); | COMMENT |
| LOW | server/src/app-config/env.schema.ts | 121 | // Whole milliseconds, and inside setTimeout's 32-bit range. A fractional value | COMMENT |
| LOW | server/src/nest/app.module.ts | 81 | * (weather, notifications, integrations, ...) get registered here as they are | COMMENT |
| LOW | server/src/nest/app.module.ts | 101 | { provide: APP_FILTER, useClass: TrekExceptionFilter }, | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 361 | reviews?: { | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 961 | if (found.length > 0) { | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 2081 | const keyed = this.keyedProvider(userId); | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 2101 | // either, before this branch existed or after. | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 2161 | if (!apiKey) { | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 2281 | // The service's own id form, translated into the one this | COMMENT |
| LOW | server/src/nest/maps/maps.service.ts | 2421 | COMMENT | |
| 126 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugin-sdk/test/checks.test.ts | 20 | author: 'Jane Doe', | CODE |
| LOW | plugin-sdk/src/manifest.ts | 36 | 'key', 'label', 'input_type', 'placeholder', 'hint', 'required', 'secret', 'scope', 'options', 'oauth', 'default', | CODE |
| LOW⚡ | server/tests/unit/nest/oidc.service.test.ts | 1081 | const userInfoData = { sub: 'user-sub', email: 'user@example.com', name: 'User Name' }; | CODE |
| LOW⚡ | server/tests/unit/nest/oidc.service.test.ts | 1090 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW | server/tests/unit/nest/oidc.service.test.ts | 1127 | { sub: 'user-sub', email: 'user@example.com', ...overrides }, | CODE |
| LOW | server/tests/unit/nest/notifications.service.test.ts | 41 | sendMailMock: vi.fn().mockResolvedValue({ accepted: ['test@test.com'] }), | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 192 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 204 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 216 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 227 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 243 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 255 | const result = await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 264 | expect(await newMailer().testSmtp('admin@example.com')).toEqual({ success: true }); | CODE |
| LOW | server/tests/unit/nest/mailer.service.test.ts | 322 | await newMailer().testSmtp('admin@example.com'); | CODE |
| LOW⚡ | server/tests/integration/auth.test.ts | 137 | email: 'admin@example.com', | CODE |
| LOW | server/tests/e2e/place-shadow.e2e.test.ts | 81 | seedUser(db as never, { id: ADMIN, email: 'admin@example.com', role: 'admin' }); | CODE |
| LOW | server/src/nest/plugins/install/manifest.ts | 542 | 'key', 'label', 'input_type', 'placeholder', 'hint', 'required', 'secret', 'scope', 'options', 'oauth', 'default', | CODE |
| LOW | shared/src/maps/maps.schema.spec.ts | 100 | attribution: 'Jane Doe', | CODE |
| LOW | client/tests/unit/stores/authStore.test.ts | 221 | const result = await useAuthStore.getState().login('user@example.com', 'password'); | CODE |
| LOW | …nt/tests/unit/mobile/admin/MAdminUsersSection.test.tsx | 53 | const ME = buildAdminUser({ id: 1, username: 'admin', email: 'admin@example.com', role: 'admin' }); | CODE |
| LOW | …unit/mobile/admin/MAdminDevNotificationsPanel.test.tsx | 13 | const ADMIN = buildAdmin({ id: 7, username: 'testadmin', email: 'admin@example.com' }); | CODE |
| LOW | …unit/mobile/admin/MAdminDevNotificationsPanel.test.tsx | 181 | params: { actor: 'testadmin', invitee: 'admin@example.com' }, | CODE |
| LOW | client/tests/unit/mobile/trip/ImpListStep.test.tsx | 44 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://maps.app.goo.gl/…') | CODE |
| LOW | client/tests/unit/mobile/trip/ImpListStep.test.tsx | 52 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://naver.me/…') | CODE |
| LOW⚡ | client/tests/integration/api/client.test.ts | 857 | await expect(notificationsApi.testSmtp('user@example.com')).resolves.toMatchObject({ ok: true }); | CODE |
| LOW | client/tests/helpers/mobileAdmin.ts | 20 | email: 'admin@example.com', | CODE |
| LOW | client/tests/helpers/msw/handlers/admin.ts | 7 | const admin1 = buildAdmin({ username: 'admin', email: 'admin@example.com' }); | CODE |
| LOW | …components/Settings/DawarichConnectionSection.test.tsx | 184 | expect(keyField()).toHaveAttribute('placeholder', 'Paste your Dawarich API key'); | CODE |
| LOW | …components/Settings/DawarichConnectionSection.test.tsx | 207 | expect(keyField()).toHaveAttribute('placeholder', MASK); | CODE |
| LOW | …components/Settings/DawarichConnectionSection.test.tsx | 311 | expect(keyField()).toHaveAttribute('placeholder', 'Paste your Dawarich API key'); | CODE |
| LOW | …components/Settings/DawarichConnectionSection.test.tsx | 355 | expect(keyField()).toHaveAttribute('placeholder', MASK); | CODE |
| LOW | …components/Settings/DawarichConnectionSection.test.tsx | 589 | expect(keyField()).toHaveAttribute('placeholder', 'Paste your Dawarich API key'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 350 | expect(input).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 956 | expect(tokenInput()).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 1124 | expect(input).toHaveAttribute('placeholder', '••••••••'); | CODE |
| LOW | …ient/src/components/Settings/NotificationsTab.test.tsx | 1130 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'https://discord.com/api/webhooks/...'), | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 316 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 316 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 343 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 343 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 403 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 403 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 577 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 577 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 604 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 604 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 748 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 748 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 775 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 775 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 890 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 890 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 937 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 937 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1202 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1202 | "text": "Lorem ipsum dolor sit amet", | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1229 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW | client/src/components/Studio/bookTemplates.data.ts | 1229 | "text": "Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt | CODE |
| LOW⚡ | client/src/components/Planner/PlaceInspector.test.tsx | 824 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| LOW⚡ | client/src/components/Planner/PlaceInspector.test.tsx | 824 | const longText = 'Lorem ipsum dolor sit amet. '.repeat(200); | CODE |
| 27 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugin-sdk/src/manifest.ts | 531 | function validatePluginDependencies(raw: unknown, selfId: string, errors: string[]): PluginDependency[] { | CODE |
| LOW | server/tests/unit/db/migration-hygiene.test.ts | 52 | function findDestructiveStatements(src: string): DestructiveHit[] { | CODE |
| LOW | server/tests/unit/db/connection.test.ts | 110 | function deleteTripAndWatchTempFiles(db: Database.Database): { | CODE |
| LOW | server/tests/unit/systemNotices/registry.test.ts | 9 | function collectRegisteredActionIds(): Set<string> { | CODE |
| LOW⚡ | server/tests/unit/nest/travel-stats.service.test.ts | 166 | function splitChainThroughHelsinki(tripId: number, onwardDate: string, onwardTime: string) { | CODE |
| LOW⚡ | …rver/tests/unit/nest/notifications.inapp-prefs.test.ts | 220 | function insertBooleanNotification(recipientId: number, senderId: number | null = null): number { | CODE |
| LOW | server/tests/unit/nest/atlas.service.test.ts | 51 | function insertReservationEndpoint( | CODE |
| LOW | server/tests/unit/nest/backup.impl.test.ts | 1037 | function setupSuccessfulExtraction() { | CODE |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 91 | function makeGhostLocalPathFixture(contents: string): Fixture & { driverCalls: string[] } { | CODE |
| LOW | server/tests/unit/nest/storage/storage.service.test.ts | 480 | function makeAbortingStreamFixture(err: { code?: string; syscall?: string; message?: string }) { | CODE |
| LOW | …r/tests/unit/nest/storage/storage-jobs.service.test.ts | 117 | function makePhotosGoogleMigrationWorld() { | CODE |
| LOW | …r/tests/unit/nest/storage/storage-jobs.service.test.ts | 139 | function makeMigrationBackfillWorld() { | CODE |
| LOW⚡ | server/tests/integration/notifications.test.ts | 418 | function insertBooleanNotification(recipientId: number): number { | CODE |
| LOW | server/tests/integration/share.test.ts | 556 | async function setupSharedPlaceWithPhoto() { | CODE |
| LOW | server/tests/helpers/plugin-host.ts | 87 | export function createPluginRpcHostFactory(dbs: DatabaseService): PluginRpcHostFactory { | CODE |
| LOW | server/tests/helpers/notifications.ts | 29 | export function makeNotificationPreferencesService(dbs: DatabaseService): NotificationPreferencesService { | CODE |
| LOW | server/tests/helpers/module-providers.ts | 24 | export function expectRegisteredController(moduleClass: object, controller: object): void { | CODE |
| LOW | server/tests/helpers/accommodations-service.ts | 19 | export function makeAccommodationsService(conn: Database): AccommodationsService { | CODE |
| LOW | server/src/mcp/sessionManager.ts | 39 | export function revokeUserSessionsForClient(userId: number, clientId: string): void { | CODE |
| LOW | server/src/mcp/sessionManager.ts | 75 | export function evictOldestSessionForUser(userId: number): string | null { | CODE |
| LOW | server/src/nest/maps/trek-places.client.ts | 141 | function countsAgainstReachability(err: unknown): boolean { | CODE |
| LOW | server/src/nest/settings/settings.service.ts | 114 | export function isAdminOnlyEndpointSetting(key: string, value: unknown): boolean { | CODE |
| LOW | server/src/nest/auth/ephemeral-tokens.ts | 55 | export function consumeEphemeralTokenWithMeta( | CODE |
| LOW | server/src/nest/llm-parse/llm-config.ts | 44 | export function prepareLlmAddonConfigForWrite( | CODE |
| LOW | server/src/nest/llm-parse/clients/nuextract.ts | 260 | export function nuExtractToKiReservations(parsed: unknown): Record<string, unknown>[] { | CODE |
| LOW | server/src/nest/plugins/plugin-backup.ts | 39 | export function stageExtractedPluginTrees(extractDir: string): boolean { | CODE |
| LOW | server/src/nest/plugins/host/plugin-data.service.ts | 53 | export function checkpointAllPluginDataDbs(): void { | CODE |
| LOW | server/src/nest/public-api/public-api-request.ts | 29 | export function enforcePublicApiRateLimit(rl: RateLimitService, req: Request): void { | CODE |
| LOW | server/src/nest/places/places.helpers.ts | 194 | export function googleMapsFeatureIdFromItem(item: unknown): string | null { | CODE |
| LOW | server/src/nest/places/kml-import.helpers.ts | 102 | export function parseKmlLineStringCoordinates(value: unknown): Array<{ lat: number; lng: number; ele: number | null }> | | CODE |
| LOW | server/src/nest/places/kml-import.helpers.ts | 159 | export function resolveCategoryIdForFolder(folderName: string | null, lookup: Map<string, number>): number | null { | CODE |
| LOW | server/src/nest/platform/mcp-metadata.middleware.ts | 22 | export function createMcpMetadataMiddleware( | CODE |
| LOW | server/src/nest/permissions/permissions-cache.ts | 25 | export function invalidatePermissionsCache(): void { | CODE |
| LOW | server/src/nest/transit/transit-itinerary.helpers.ts | 180 | export function cleanTransitItineraryNames( | CODE |
| LOW | server/src/nest/transit/transit-itinerary.helpers.ts | 208 | export function buildTransitReservationParts( | CODE |
| LOW | server/src/nest/storage/storage-upload.factory.ts | 43 | export function buildStorageUploadOptions(storage: StorageService, opts: StorageUploadOptions) { | CODE |
| LOW | server/src/nest/storage/drivers/s3.driver.ts | 153 | function zeroByteChecksumWorkaround(size: number): { ApplyChecksum: true } | Record<string, never> { | CODE |
| LOW | server/src/nest/integrations/airtrail.mapper.ts | 178 | export function mapFlightsToMultiLegReservation( | CODE |
| LOW | server/src/nest/common/idempotency-cleanup.ts | 21 | export function purgeExpiredIdempotencyKeys( | CODE |
| LOW | server/src/nest/common/rowShape.ts | 12 | export function formatAssignmentWithPlace(a: AssignmentRow, tags: Partial<Tag>[], participants: Participant[]) { | CODE |
| LOW | server/src/nest/atlas/atlas.service.ts | 74 | function countryCodeFromRegionCode(regionCode: string): string { | CODE |
| LOW | server/src/nest/doc-sync/providers/webdav.client.ts | 327 | function repairTruncatedMultistatus(xml: string): string | null { | CODE |
| LOW | server/src/nest/share/share.service.ts | 111 | export function publicReservationMetadata(raw: unknown): string | null { | CODE |
| LOW | shared/src/book/book.schema.ts | 856 | function withoutUnreadableElements(raw: unknown): unknown { | CODE |
| LOW | client/tests/unit/sync/mutationQueue.conflict.test.ts | 43 | function conflictThenAcceptHandler(serverName = 'Theirs') { | CODE |
| LOW | client/src/vacay/schoolHolidayCountries.ts | 24 | export function isSchoolHolidayCountrySupported(country: string): boolean { | CODE |
| LOW | client/src/utils/touchDragPolyfill.ts | 15 | export function maybeInstallTouchDragPolyfill(): Promise<unknown> | void { | CODE |
| LOW | client/src/utils/dayMerge.ts | 87 | export function getTransportRouteEndpoints( | CODE |
| LOW | client/src/utils/connectionsVisibility.ts | 54 | export function resolveEffectiveConnections(stored: StoredConnections | null, alwaysShowRoutesDefault: boolean): StoredC | CODE |
| LOW | client/src/utils/connectionsVisibility.ts | 60 | export function resolveVisibleConnectionIds(effective: StoredConnections, routableIds: number[]): number[] { | CODE |
| LOW | client/src/utils/globalErrorHandlers.ts | 48 | export function installGlobalErrorHandlers(): () => void { | CODE |
| LOW | …/src/components/Settings/AirTrailConnectionSection.tsx | 16 | export default function AirTrailConnectionSection(): React.ReactElement { | CODE |
| LOW | …/src/components/Settings/DawarichConnectionSection.tsx | 23 | export default function DawarichConnectionSection(): React.ReactElement { | CODE |
| LOW | client/src/components/Vacay/holidayRegions.ts | 79 | export async function fetchSchoolHolidayRegionOptions(country: string, lang = activeLanguage()): Promise<{ value: string | CODE |
| LOW | …ient/src/components/Vacay/useSchoolHolidayCountries.ts | 6 | export function useSchoolHolidayCountries(enabled = true) { | CODE |
| LOW | client/src/components/Plugins/PluginFrame.tsx | 270 | function createPluginSessionStorageKeys( | CODE |
| LOW | client/src/components/Plugins/PluginContributions.tsx | 24 | export function usePluginViewContributions(view: ViewName, tripId: string | number | null | undefined) { | CODE |
| LOW | …/components/Planner/DayPlanSidebarTimeConfirmModal.tsx | 22 | export function DayPlanSidebarTimeConfirmModal({ timeConfirm, setTimeConfirm, confirmTimeRemoval, t }: DayPlanSidebarTim | CODE |
| LOW | …ponents/Planner/DayPlanSidebarTransportDetailModal.tsx | 24 | export function DayPlanSidebarTransportDetailModal({ | CODE |
| LOW | client/src/components/Planner/placeOpenStreetMap.ts | 9 | export function getOpenStreetMapUrlForPlace(place: PlaceLike | null | undefined): string | null { | CODE |
| 24 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | server/tests/unit/places/places.rpc.test.ts | 139 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['place:created', 'place:updated', 'place:deleted'] | CODE |
| CRITICAL | server/tests/unit/todo/todo.rpc.test.ts | 92 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['todo:created', 'todo:updated', 'todo:deleted']); | CODE |
| CRITICAL | server/tests/unit/days/days-itinerary.rpc.test.ts | 106 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['day:created', 'day:updated', 'day:deleted', 'day: | CODE |
| CRITICAL | server/tests/unit/days/days-itinerary.rpc.test.ts | 151 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['day:reordered', 'trip:updated']); | CODE |
| CRITICAL | server/tests/unit/budget/costs.rpc.test.ts | 142 | expect(f.realtime.broadcast.mock.calls.map((c) => c[1])).toEqual(['budget:created', 'budget:updated', 'budget:delete | CODE |
| CRITICAL | client/src/components/Map/useDawarichTrailGL.test.ts | 206 | expect(absent.spies.addLayer.mock.calls.map(call => call[1])).toEqual([undefined, undefined]) | CODE |
| CRITICAL | client/src/components/Map/useDawarichTrailGL.test.ts | 210 | expect(none.spies.addLayer.mock.calls.map(call => call[1])).toEqual([undefined, undefined]) | CODE |
| CRITICAL | client/src/components/Map/useDawarichTrailGL.test.ts | 292 | expect(gl.spies.removeLayer.mock.calls.map(call => call[0])).toEqual([LINE_LAYER, CASING_LAYER]) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugin-sdk/test/publish.test.ts | 64 | // publish now gates on the registry's checks BEFORE it packs or releases, so a bare scaffold | COMMENT |
| MEDIUM | plugin-sdk/test/publish.test.ts | 127 | // Deliberately NOT made publishable: this is a fresh scaffold, exactly what a first-time | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 559 | // is how a scaffold could sail through `validate` and then be rejected by the registry. | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 563 | // The scaffold's README references ./docs/screenshot.png and never creates it. The old check | COMMENT |
| MEDIUM | plugin-sdk/test/sdk.test.ts | 687 | // A scaffold-shaped CJS entry that requires the SDK without any node_modules. | COMMENT |
| MEDIUM | plugin-sdk/test/cli.test.ts | 26 | // The scaffold must NOT invent a placeholder — it declares operatorEgress instead, which | COMMENT |
| MEDIUM | plugin-sdk/src/cli/dev.ts | 198 | // one-arg calls work on a fresh scaffold — without this, a fixtures file that omits | COMMENT |
| MEDIUM | plugin-sdk/src/cli/dev.ts | 464 | // hard-coded to 42 while the scaffold seeds trip 1, so the widget's first | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 141 | // Floor 4.0.0: the host surface this scaffold is written against — the enforced | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 158 | // grey square in the store, so the scaffold picks a real one rather than leaving it out. | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 235 | // The README has always linked ./docs/screenshot.png, and the scaffold has never created the | COMMENT |
| MEDIUM | plugin-sdk/src/cli/create.ts | 533 | // The scaffold turns each host into a matching http:outbound:<host> grant. Leaving it | COMMENT |
| MEDIUM | server/src/db/migrations.ts | 3300 | // Migration 155: plugin system scaffold (#plugins). A plugin is a row here; | COMMENT |
| MEDIUM | server/src/nest/plugins/plugins.service.ts | 31 | * Read side of the plugin system (#plugins), M0 scaffold. Lists installed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/tests/integration/auth.test.ts | 14 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 566 | // Step 1: login to get mfa_token | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 573 | // Step 2: verify with a backup code | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 580 | // Step 3: same backup code is now consumed — second login attempt fails | COMMENT |
| LOW⚡ | server/tests/integration/journey.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/trips.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | server/tests/integration/auth.test.ts | 14 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 566 | // Step 1: login to get mfa_token | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 573 | // Step 2: verify with a backup code | COMMENT |
| LOW⚡ | server/tests/integration/auth.test.ts | 580 | // Step 3: same backup code is now consumed — second login attempt fails | COMMENT |
| LOW⚡ | server/tests/integration/journey.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| LOW⚡ | server/tests/integration/trips.test.ts | 11 | // Step 1: Bare in-memory DB — schema applied in beforeAll after mocks register | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | wiki/Troubleshooting.md | 418 | -H "X-Goog-Api-Key: YOUR_API_KEY" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | client/tests/unit/sync/tilePrefetcher.test.ts | 552 | // First-match semantics, like the #1924 harness above, but capturing the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 43 | # - OIDC_ONLY=false # Set true to force SSO-only mode: disables password login and registration, overrides Admin > | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | client/e2e/screenshots/seed.ts | 317 | ['admin', "It's included — kaiseki, 18:30. Added it to the to-dos so we don't forget to confirm."], | CODE |