🚂 🦀 The one-person framework for Rust for side-projects and startups
This report summarizes scanner evidence for loco-rs/loco, a Rust project with 9,426 GitHub stars. SynthScan examined 104,040 lines of code across 616 source files, recording 497 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 6.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 489 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 4 finding(s).
Which changes need focused human review? 497 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 497 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | deny.toml | 1 | # cargo-deny — supply-chain policy for the dependency tree. | COMMENT |
| LOW | evals/tasks/user-search/wiring/config/test.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | evals/tasks/user-search/wiring/config/test.yaml | 61 | # Initializers Configuration | COMMENT |
| LOW | evals/hidden/links_behavior.rs | 1 | //! Hidden behavioural test. | COMMENT |
| LOW | loco-new/tests/wizard/new.rs | 21 | COMMENT | |
| LOW | loco-new/tests/wizard/new.rs | 41 | // Serialized: every combo builds into one shared CARGO_TARGET_DIR (see | COMMENT |
| LOW | loco-new/tests/wizard/new.rs | 81 | true, | COMMENT |
| LOW | loco-new/tests/wizard/new.rs | 141 | env_map.insert("DB_IDLE_TIMEOUT".into(), "2000".into()); | COMMENT |
| LOW | loco-new/tests/wizard/new.rs | 421 | COMMENT | |
| LOW | loco-new/tests/wizard/new.rs | 561 | // .stderr_null() | COMMENT |
| LOW | loco-new/tests/templates/frontend.rs | 1 | //! Coverage for the clientside SPA the wizard emits. | COMMENT |
| LOW | loco-new/tests/templates/config.rs | 1 | //! Every generated config file must be usable by the app that receives it. | COMMENT |
| LOW | loco-new/tests/templates/agent_skill.rs | 1 | //! Coverage for the agent material every generated app ships. | COMMENT |
| LOW | loco-new/base_template/src/models/users.rs | 281 | /// Sets the email verification information for the user and | COMMENT |
| LOW | loco-new/base_template/src/models/users.rs | 301 | /// database. | COMMENT |
| LOW | loco-new/base_template/src/models/users.rs | 321 | /// email. | COMMENT |
| LOW | loco-new/base_template/src/controllers/page.rs | 1 | use loco_rs::prelude::*; | COMMENT |
| LOW | loco-new/base_template/src/controllers/auth.rs | 161 | #[debug_handler] | COMMENT |
| LOW | loco-new/src/lib.rs | 21 | /// published 1.0.x, which renders the YAML-safe `<%= ... %>` config delimiters | COMMENT |
| LOW | loco-new/src/lib.rs | 61 | #[cfg_attr(unix, default)] | COMMENT |
| LOW | loco-new/src/wizard.rs | 81 | #[derive( | COMMENT |
| LOW | loco-new/src/generator/executer/mod.rs | 41 | /// | COMMENT |
| LOW | loco-new/src/generator/executer/mod.rs | 61 | COMMENT | |
| LOW | website/src/env.d.ts | 1 | /// <reference types="@astrojs/starlight/virtual" /> | COMMENT |
| LOW | tests/controller/middlewares.rs | 81 | handle.abort(); | COMMENT |
| LOW | examples/demo/config/test.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/demo/config/test.yaml | 61 | # Initializers Configuration | COMMENT |
| LOW | examples/demo/config/production.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/demo/config/production.yaml | 41 | COMMENT | |
| LOW | examples/demo/config/production.yaml | 61 | secure: true | COMMENT |
| LOW | examples/demo/config/development.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/demo/config/development.yaml | 61 | # Override the SMTP hello name (default is the machine's hostname) | COMMENT |
| LOW | examples/demo/src/models/users.rs | 281 | /// generates a unique reset password token, and updates it in the | COMMENT |
| LOW | examples/demo/src/models/users.rs | 301 | /// This method sets the timestamp when the user successfully verifies their | COMMENT |
| LOW | examples/demo/src/controllers/auth.rs | 161 | #[debug_handler] | COMMENT |
| LOW | examples/reference_spa/config/test.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/reference_spa/config/test.yaml | 61 | # password: | COMMENT |
| LOW | examples/reference_spa/config/production.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/reference_spa/config/production.yaml | 61 | port: <%= get_env(name="MAILER_PORT", default="587") %> | COMMENT |
| LOW | examples/reference_spa/config/development.yaml | 1 | # Loco configuration file documentation | COMMENT |
| LOW | examples/reference_spa/config/development.yaml | 61 | # user: | COMMENT |
| LOW | examples/reference_spa/tests/models/posts.rs | 21 | // query your model, e.g.: | COMMENT |
| LOW | examples/reference_spa/src/models/users.rs | 281 | /// generates a unique reset password token, and updates it in the | COMMENT |
| LOW | examples/reference_spa/src/models/users.rs | 301 | /// This method sets the timestamp when the user successfully verifies their | COMMENT |
| LOW | examples/reference_spa/src/dtos/common.rs | 1 | use loco_rs::model::query::PageResponse; | COMMENT |
| LOW | examples/reference_spa/src/controllers/auth.rs | 161 | #[debug_handler] | COMMENT |
| LOW | .github/workflows/lint-future.yml | 1 | name: "[lint:future]" | COMMENT |
| LOW | .github/workflows/loco-rs-ci-sanity.yml | 1 | # To optimize CI runtime: | COMMENT |
| LOW | .github/workflows/docs.yml | 101 | # types. It was never wired up, and by the time it was it | COMMENT |
| LOW | .github/workflows/loco-rs-ci.yml | 1 | name: "[loco_rs:ci]" | COMMENT |
| LOW | xtask/src/docs_syntax.rs | 1 | //! Parse every fenced `rust` block in the docs tree and fail on the ones that | COMMENT |
| LOW | xtask/src/eval.rs | 1 | //! The Loco agent eval: does an agent actually write idiomatic Loco? | COMMENT |
| LOW | xtask/src/eval.rs | 21 | //! The judge never scores a submission alone. Every task ships a curated | COMMENT |
| LOW | xtask/src/eval.rs | 81 | COMMENT | |
| LOW | xtask/src/eval.rs | 641 | /// | COMMENT |
| LOW | xtask/src/versions.rs | 21 | const CRATE_VERSION: (&str, &str) = ("Cargo.toml", r"(?m)^version.*$"); | COMMENT |
| LOW | xtask/src/agent_skill.rs | 1 | //! Keeps the `loco` agent skill correct and single-sourced. | COMMENT |
| LOW | xtask/src/agent_skill.rs | 21 | //! | COMMENT |
| LOW | xtask/src/agent_skill.rs | 41 | const SKILL_DIR: &str = "skills/loco"; | COMMENT |
| LOW | xtask/src/agent_skill.rs | 61 | /// `.claude/skills/` is the Agent Skills convention; the generated app's | COMMENT |
| 344 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | loco-new/tests/wizard/new.rs | 52 | // full-stack SPA: db + clientside — the flagship `generate scaffold` path | COMMENT |
| MEDIUM | loco-new/tests/templates/frontend.rs | 78 | // The scaffold injects nav entries here. Without the anchor the generated | COMMENT |
| MEDIUM | loco-new/tests/templates/frontend.rs | 79 | // app is a dead end: you scaffold a resource and nothing links to it. | COMMENT |
| MEDIUM | loco-new/tests/templates/config.rs | 185 | // The development JWT secret is generated into the file at scaffold time. | COMMENT |
| MEDIUM | loco-new/base_template/frontend/src/routes.tsx | 7 | // scaffold:imports | COMMENT |
| MEDIUM | loco-new/base_template/frontend/src/routes.tsx | 20 | // scaffold:routes | COMMENT |
| MEDIUM | …/src/content/docs/docs/explanation/coming-from-axum.md | 19 | | A hand-rolled `ApiContext` struct + `AddExtensionLayer`/`State` | `AppContext` (8 fields: `environment`, `db`, `queue_ | CODE |
| MEDIUM | …ite/src/content/docs/docs/how-to/override-templates.md | 36 | # override every template under a folder (e.g. all the scaffold's frontend pages) | COMMENT |
| MEDIUM | …ite/src/content/docs/docs/how-to/override-templates.md | 61 | # edit .loco-templates/scaffold/api/controller.t | COMMENT |
| MEDIUM | website/src/content/docs/docs/how-to/paginate.md | 95 | ## 5. The scaffold's typed envelope | COMMENT |
| MEDIUM | website/src/content/docs/docs/how-to/build-a-spa.md | 98 | | `frontend/src/routes.tsx` | imports and routes, injected at the `// scaffold:imports` and `// scaffold:routes` anchors | CODE |
| MEDIUM | website/src/content/docs/docs/how-to/build-a-spa.md | 194 | [`examples/reference_spa`](https://github.com/loco-rs/loco/tree/master/examples/reference_spa) in the Loco repository is | CODE |
| MEDIUM | website/src/content/docs/docs/how-to/use-generators.md | 12 | `cargo loco generate` (alias `g`) is compiled only in debug builds — `#[cfg(debug_assertions)]` gates the whole subcomma | CODE |
| MEDIUM | website/src/content/docs/docs/tutorials/the-tour.md | 21 | ## Models and controllers: a scaffold, and a plain model with a relation | COMMENT |
| MEDIUM | website/src/content/docs/docs/reference/generators.md | 8 | `cargo loco generate <kind>` (alias `cargo loco g <kind>`) scaffolds application code from templates baked into the `loc | CODE |
| MEDIUM | website/src/content/docs/docs/reference/generators.md | 30 | ### Model, migration, scaffold | COMMENT |
| MEDIUM | website/src/content/docs/docs/reference/generators.md | 47 | # scaffold (model + DTOs + controller; adds React hooks/pages if the app has a frontend/) | COMMENT |
| MEDIUM | website/src/content/docs/docs/reference/cli.md | 172 | `enum ComponentArg`, `src/cli.rs:173-382` — only present in debug builds (`#[cfg(debug_assertions)]` on `Commands::Gener | CODE |
| MEDIUM | examples/reference_spa/frontend/src/routes.tsx | 7 | // scaffold:imports | COMMENT |
| MEDIUM | examples/reference_spa/frontend/src/routes.tsx | 24 | // scaffold:routes | COMMENT |
| MEDIUM | examples/reference_spa/tests/requests/posts.rs | 66 | /// scaffold's old hand-rolled arithmetic and the framework's `query::paginate` | COMMENT |
| MEDIUM | examples/reference_spa/tests/requests/posts.rs | 68 | /// `total_pages` -- which the scaffold's own envelope did not even carry -- | COMMENT |
| MEDIUM | xtask/src/eval.rs | 91 | /// Flags passed to `loco new`. Tasks sharing a signature share a scaffold. | COMMENT |
| MEDIUM | xtask/src/eval.rs | 302 | /// The pristine `loco new` scaffold for a task's flags, created on first use | COMMENT |
| MEDIUM | xtask/src/eval.rs | 331 | // Every run starts from the pristine scaffold, so one task cannot inherit | COMMENT |
| MEDIUM | loco-gen/tests/templates/controller.rs | 70 | /// the scaffold's `--no-auth`, and it has to reach both the handlers and the | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 9 | /// Loco 1.0 ships a single scaffold flavor: DTO + controller + React-SPA | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 15 | // A flat inventory of every artifact one scaffold emits. Splitting it into | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 150 | // no `tests/requests/<plural>.rs` is generated for the API scaffold: a | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 156 | /// Adaptive scaffold, headless path: with `frontend: false` (a non-clientside | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 216 | /// One scaffold could never catch this. Two can. | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 285 | /// `{target}_id` regardless produced a scaffold that referenced a column the | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 343 | /// The scaffold is authenticated by default: every handler takes an | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 484 | /// Every resource the scaffold generates has to be reachable from somewhere | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 533 | /// first: `loco g scaffold task done:bool! title:string!` produced | COMMENT |
| MEDIUM | loco-gen/tests/templates/scaffold.rs | 589 | /// A scaffold in an app with no frontend must not emit `#[ts(export)]`. | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/utils.rs | 49 | /// `// scaffold:imports` / `// scaffold:routes` anchor comments the Api | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/utils.rs | 50 | /// scaffold's `frontend_list.t` injects into. The once-per-app base | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/utils.rs | 57 | // scaffold:imports | COMMENT |
| MEDIUM | loco-gen/tests/templates/utils.rs | 69 | // scaffold:routes | COMMENT |
| MEDIUM | loco-gen/tests/templates/utils.rs | 95 | /// `scaffold:nav` anchor the Api scaffold's `frontend_list.t` injects into. | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/anchors.rs | 4 | //! `inject-above` in the migrator, `// scaffold:imports` and | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/anchors.rs | 5 | //! `// scaffold:routes` in the SPA route table. An anchor that goes missing | COMMENT |
| MEDIUM⚡ | loco-gen/tests/templates/anchors.rs | 13 | //! lost both scaffold anchors, so `loco g scaffold` inside the repository's own | COMMENT |
| MEDIUM | loco-gen/tests/templates/anchors.rs | 44 | /// The scaffold also injects a nav entry, so a generated resource is reachable | COMMENT |
| MEDIUM | loco-gen/tests/templates/anchors.rs | 46 | /// the anchor and `loco g scaffold` fails outright. | COMMENT |
| MEDIUM | loco-gen/tests/templates/anchors.rs | 68 | for anchor in ["// scaffold:imports", "// scaffold:routes"] { | CODE |
| MEDIUM | loco-gen/src/controller.rs | 12 | /// the body — so this is opt-in (`--auth`), the mirror of the scaffold's | COMMENT |
| MEDIUM | loco-gen/src/lib.rs | 106 | /// Whether to include timestamps (`created_at``updated_at`at columns) in the scaffold | COMMENT |
| MEDIUM | loco-gen/src/lib.rs | 130 | /// Unlike the scaffold, a bare controller is public by default — it has | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 11 | //! migration/model/scaffold generators. | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 76 | /// (HTML/HTMX) scaffold. | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 303 | // JSON column. SQLite would accept all three, but the scaffold keeps one | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 345 | /// `SQLite` fails to compile. 64-bit keeps the scaffold portable across | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 407 | /// scaffold input: these are automatically generated by Loco (`created_at` / | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 414 | /// Parse raw `(field_name, spec)` scaffold fields into `Column`s, skipping | COMMENT |
| MEDIUM | loco-gen/src/column.rs | 1038 | // portable scaffold must not emit a 32-bit `int`. | COMMENT |
| MEDIUM | loco-gen/src/scaffold.rs | 13 | /// Loco 1.0 ships a single scaffold flavor built straight from | COMMENT |
| MEDIUM | loco-gen/src/scaffold.rs | 37 | // - scaffold is never a link table | COMMENT |
| MEDIUM | loco-gen/src/scaffold.rs | 164 | /// `frontend_*.t` templates (`loco-gen/src/templates/scaffold/api/`). | COMMENT |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | evals/tasks/user-search/wiring/config/test.yaml | 11 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/demo/config/test.yaml | 11 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/demo/config/production.yaml | 16 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/demo/config/development.yaml | 11 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/reference_spa/config/test.yaml | 11 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/reference_spa/config/production.yaml | 16 | # Define the logging format. options: compact, pretty or json | COMMENT |
| MEDIUM | examples/reference_spa/config/development.yaml | 11 | # Define the logging format. options: compact, pretty or json | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/cli.rs | 803 | .unwrap_or_else(|| boot_result.app_context.config.server.binding.clone()), | CODE |
| CRITICAL | src/cli.rs | 979 | .unwrap_or_else(|| boot_result.app_context.config.server.binding.clone()), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | loco-new/base_template/src/controllers/auth.rs | 180 | /// This flow enhances security by avoiding traditional passwords and providing a seamless login experience. | COMMENT |
| MEDIUM | examples/demo/src/controllers/auth.rs | 180 | /// This flow enhances security by avoiding traditional passwords and providing a seamless login experience. | COMMENT |
| MEDIUM | examples/reference_spa/src/controllers/auth.rs | 180 | /// This flow enhances security by avoiding traditional passwords and providing a seamless login experience. | COMMENT |
| MEDIUM | .github/workflows/evals.yml | 34 | # The harness drives the installed `loco` binary, which generates from | COMMENT |
| MEDIUM | .github/workflows/loco-rs-ci-sanity.yml | 6 | # we run comprehensive tests to validate every generator command | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | evals/grade.py | 43 | except json.JSONDecodeError: | CODE |
| HIGH | evals/grade.py | 112 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/errors.rs | 53 | // ─────────────────────────── Client-facing / API errors ─────────────────────────── | COMMENT |
| MEDIUM | src/errors.rs | 88 | // ─────────────────────────── Internal / infrastructure errors ───────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | website/src/content/docs/docs/how-to/write-task.md | 102 | cargo loco task user:create email:user@example.com name:"John Doe" password:secret | CODE |
| LOW | src/bgworker/redis.rs | 1435 | let args = serde_json::json!({"email": "user@example.com"}); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | evals/grade.py | 62 | CODE |