0.6

Adjusted Signal

0.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

14.8K

Stars

TypeScript

Language

709.4K

Lines of Code

7.6K

Files

323

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 140 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.6/100 · LOW

Are imports declared and package/API names verified? 183 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 69 finding(s).

PR Review Velocity Impact 2.6/100 · LOW

Which changes need focused human review? 323 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 0MEDIUM 10LOW 309

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 323 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data179 hits · 193 pts

Severity	File	Line	Snippet	Context
LOW	packages/experience/CHANGELOG.md	356	"email": "user@example.com",	CODE
LOW	packages/experience/CHANGELOG.md	616	loginHint: 'user@example.com',	CODE
LOW	…shared/components/InputFields/SmartInputField/utils.ts	14	'type' \| 'pattern' \| 'inputMode' \| 'placeholder' \| 'autoComplete' \| 'label'	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	45	expect(inputs[0]?.getAttribute('placeholder')).toBe('MM');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	46	expect(inputs[1]?.getAttribute('placeholder')).toBe('DD');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	47	expect(inputs[2]?.getAttribute('placeholder')).toBe('YYYY');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	249	expect(inputs[0]?.getAttribute('placeholder')).toBe('DD');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	250	expect(inputs[1]?.getAttribute('placeholder')).toBe('MM');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	251	expect(inputs[2]?.getAttribute('placeholder')).toBe('YYYY');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	276	expect(inputs[0]?.getAttribute('placeholder')).toBe('YYYY');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	277	expect(inputs[1]?.getAttribute('placeholder')).toBe('MM');	CODE
LOW⚡	…ce/src/components/InputFields/DateField/index.test.tsx	278	expect(inputs[2]?.getAttribute('placeholder')).toBe('DD');	CODE
LOW	…experience/src/hooks/use-check-single-sign-on.test.tsx	24	const email = 'user@example.com';	CODE
LOW	packages/experience/src/pages/Consent/index.test.tsx	46	primaryEmail: 'user@example.com',	CODE
LOW	…ce/src/pages/Continue/ExtraProfileForm/test-helpers.ts	39	['YYYY', 'MM', 'DD'].includes(input.getAttribute('placeholder') ?? '')	CODE
LOW	…ce/src/pages/Continue/ExtraProfileForm/test-helpers.ts	42	const found = inputs.find((input) => input.getAttribute('placeholder') === placeholder);	CODE
LOW	…rc/pages/Continue/ExtraProfileForm/happy-path.test.tsx	214	fireEvent.change(streetAddress, { target: { value: '123 Main St' } });	CODE
LOW	…rc/pages/Continue/ExtraProfileForm/happy-path.test.tsx	233	const placeholder = element.getAttribute('placeholder') ?? '';	CODE
LOW	…rc/pages/Continue/ExtraProfileForm/happy-path.test.tsx	237	const found = dateInputs.find((i) => i.getAttribute('placeholder') === ph);	CODE
LOW	…rc/pages/Continue/ExtraProfileForm/happy-path.test.tsx	295	expect(submitted.address.streetAddress).toBe('123 Main St');	CODE
LOW	packages/connectors/connector-slack/src/index.test.ts	98	name: 'John Doe',	CODE
LOW	packages/connectors/connector-slack/src/index.test.ts	103	name: 'John Doe',	CODE
LOW	packages/connectors/connector-patreon/src/index.test.ts	92	full_name: 'Jane Doe',	CODE
LOW	packages/connectors/connector-patreon/src/index.test.ts	109	name: 'Jane Doe',	CODE
LOW	packages/connectors/connector-patreon/src/index.test.ts	119	full_name: 'Jane Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	87	name: 'John Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	102	name: 'John Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	107	name: 'John Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	127	name: 'John Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	142	name: 'John Doe',	CODE
LOW	packages/connectors/connector-gitlab/src/index.test.ts	146	name: 'John Doe',	CODE
LOW	packages/connectors/connector-oidc/src/types.test.ts	121	name: 'John Doe',	CODE
LOW	packages/connectors/connector-oidc/src/types.test.ts	131	name: 'John Doe',	CODE
LOW	packages/connectors/connector-smsaero/src/mock.ts	3	const mockedEmail = 'test@test.com';	CODE
LOW	…ctors/connector-aliyun-dm/src/single-send-mail.test.ts	24	ToAddress: 'user@example.com',	CODE
LOW	…ctors/connector-aliyun-dm/src/single-send-mail.test.ts	48	ToAddress: 'user@example.com',	CODE
LOW	…s/connectors/connector-smtp2go-email/src/index.test.ts	187	user: { primaryEmail: 'user@example.com' },	CODE
LOW⚡	packages/connectors/connector-apple/src/index.test.ts	84	payload: { sub: userId, email: 'foo@bar.com', email_verified: true },	CODE
LOW⚡	packages/connectors/connector-apple/src/index.test.ts	90	email: 'foo@bar.com',	CODE
LOW⚡	packages/connectors/connector-apple/src/index.test.ts	97	payload: { sub: 'userId', email: 'foo@bar.com' },	CODE
LOW	packages/connectors/connector-apple/src/index.test.ts	108	payload: { sub: userId, email: 'foo@bar.com', email_verified: true },	CODE
LOW	packages/core/CHANGELOG.md	1471	"email": "user@example.com",	CODE
LOW	packages/core/CHANGELOG.md	2159	loginHint: 'user@example.com',	CODE
LOW	packages/core/src/middleware/koa-error-handler.test.ts	169	json: { personalizations: [{ to: [{ email: 'foo@bar.com' }] }] },	CODE
LOW	packages/core/src/middleware/koa-error-handler.test.ts	187	expect(logged).not.toContain('foo@bar.com');	CODE
LOW	packages/core/src/middleware/koa-error-handler.test.ts	208	form: { to: 'foo@bar.com' },	CODE
LOW	packages/core/src/middleware/koa-error-handler.test.ts	227	expect(body).not.toContain('foo@bar.com');	CODE
LOW	packages/core/src/middleware/koa-error-handler.test.ts	234	expect(tracked).not.toContain('foo@bar.com');	CODE
LOW	…ore/src/middleware/koa-connector-error-handler.test.ts	284	json: { personalizations: [{ to: [{ email: 'foo@bar.com' }] }] },	CODE
LOW	…ore/src/middleware/koa-connector-error-handler.test.ts	302	expect(serialized).not.toContain('foo@bar.com');	CODE
LOW	packages/core/src/database/insert-into.test.ts	31	primaryEmail: 'foo@bar.com',	CODE
LOW	packages/core/src/database/insert-into.test.ts	66	primaryEmail: 'foo@bar.com',	CODE
LOW⚡	packages/core/src/database/insert-into.test.ts	82	insertInto({ id: 'foo', username: '123', primaryEmail: 'foo@bar.com', applicationId: 'bar' })	CODE
LOW⚡	packages/core/src/database/insert-into.test.ts	90	primaryEmail: 'foo@bar.com',	CODE
LOW⚡	packages/core/src/database/insert-into.test.ts	100	primaryEmail: 'foo@bar.com',	CODE
LOW	packages/core/src/database/update-where.test.ts	30	primaryEmail: 'foo@bar.com',	CODE
LOW	packages/core/src/database/update-where.test.ts	46	set: { username: '123', primaryEmail: 'foo@bar.com', applicationId: 'bar' },	CODE
LOW	packages/core/src/queries/one-time-tokens.test.ts	41	const email = 'foo@bar.com';	CODE
LOW	packages/core/src/oidc/interaction-policy.test.ts	409	buildContext({ params: { max_age: '600', login_hint: 'user@example.com' } })	CODE
LOW	packages/core/src/oidc/interaction-policy.test.ts	411	).resolves.toEqual({ max_age: '600', login_hint: 'user@example.com' });	CODE
119 more matches not shown…

Hyper-Verbose Identifiers69 hits · 69 pts

Severity	File	Line	Snippet	Context
LOW	packages/connectors/connector-feishu-web/src/index.ts	60	export async function authorizationCallbackHandler(data: unknown) {	CODE
LOW	…/src/middleware/koa-serve-domain-verification-files.ts	8	export default function koaServeDomainVerificationFiles(	CODE
LOW	packages/core/src/utils/firebase-scrypt.ts	60	export async function executeFirebaseScryptHash(	CODE
LOW	packages/core/src/utils/password.ts	28	function isFirebaseScryptAlgorithm(algorithm: string): boolean {	CODE
LOW	…/src/routes/organization/application/role-relations.ts	13	export default function applicationRoleRelationRoutes(	CODE
LOW	…/interaction/verifications/mfa-payload-verification.ts	165	export async function bindMfaPayloadVerification(	CODE
LOW	…/interaction/verifications/mfa-payload-verification.ts	217	export async function verifyMfaPayloadVerification(	CODE
LOW	…ion/verifications/mandatory-user-profile-validation.ts	214	export default async function validateMandatoryUserProfile(	CODE
LOW	…ction/verifications/identifier-payload-verification.ts	163	async function identifierPayloadVerification(	CODE
LOW	packages/integration-tests/src/helpers/mfa-test.ts	65	export async function addBackupCodesVerification(api: KyInstance, password: string) {	CODE
LOW	packages/integration-tests/src/helpers/mfa-test.ts	80	export async function setupUserWithTotpAndBackupCodes(api: KyInstance, password: string) {	CODE
LOW	packages/schemas/src/seeds/management-api.ts	85	export function getManagementApiResourceIndicator(tenantId: string, path = 'api') {	CODE
LOW	…ole/src/contexts/SsoConnectorContextProvider/index.tsx	21	function SsoConnectorContextProvider({ children, ssoConnector, consoleSsoConnector }: Props) {	CODE
LOW	…rc/mdx-components/CustomDomainEndpointNotice/index.tsx	9	function CustomDomainEndpointNotice({ variant = 'access' }: Props) {	CODE
LOW	…s/console/src/mdx-components/OidcCallbackUri/index.tsx	44	function ConsoleSsoOidcCallbackUri({	CODE
LOW	…e/src/components/DeleteConnectorConfirmModal/index.tsx	12	function DeleteConnectorConfirmModal({ isOpen, isLoading, onCancel, onConfirm }: Props) {	CODE
LOW	…s/OrganizationRolePermissionsAssignmentModal/index.tsx	35	function OrganizationRolePermissionsAssignmentModal({	CODE
LOW	…sAssignmentModal/use-organization-scopes-assignment.ts	5	function useOrganizationScopesAssignment(assignedScopes: OrganizationScope[] = []) {	CODE
LOW	…sionsAssignmentModal/use-resource-scopes-assignment.ts	7	function useResourceScopesAssignment(assignedScopes?: Scope[]) {	CODE
LOW	…tModal/use-organization-role-permissions-assignment.ts	11	function useOrganizationRolePermissionsAssignment(organizationRoleId: string) {	CODE
LOW	…reation/CreateForm/AuthorizationFlowSelector/index.tsx	10	function AuthorizationFlowSelector() {	CODE
LOW	…s/console/src/components/CreateConnectorForm/index.tsx	47	function EmailConnectorUpsellBanner() {	CODE
LOW	…le/src/components/ReadOnlyAccessNotification/index.tsx	9	function ReadOnlyAccessNotification() {	CODE
LOW	…components/ManageOrganizationPermissionModal/index.tsx	29	function ManageOrganizationPermissionModal({ data, onClose }: Props) {	CODE
LOW	…/TenantSelector/TenantInvitationDropdownItem/index.tsx	24	function TenantInvitationDropdownItem({ data }: Props) {	CODE
LOW	packages/console/src/components/FeatureTag/index.tsx	126	export function CombinedAddOnAndFeatureTag(props: CombinedAddOnAndFeatureTagProps) {	CODE
LOW	…le/src/components/SubmitFormChangesActionBar/index.tsx	19	function SubmitFormChangesActionBar({	CODE
LOW	…iners/AppContent/TenantNotificationContainer/index.tsx	11	function TenantNotificationContainer() {	CODE
LOW	…cationContainer/CreateProductionTenantBanner/index.tsx	13	function CreateProductionTenantBanner() {	CODE
LOW	…pages/Connectors/SignInExperienceSetupNotice/index.tsx	11	function SignInExperienceSetupNotice() {	CODE
LOW	…omainSettings/MultipleCustomDomainsFormField/index.tsx	24	function MultipleCustomDomainsFormField() {	CODE
LOW	…gs/Subscription/DowngradeConfirmModalContent/index.tsx	33	function DowngradeConfirmModalContent({ currentSku, targetSku }: Props) {	CODE
LOW	…on/CurrentPlan/AddOnUsageChangesNotification/index.tsx	15	function AddOnUsageChangesNotification({ className }: Props) {	CODE
LOW	…ion/CurrentPlan/MauLimitExceededNotification/index.tsx	22	function MauLimitExceededNotification({ periodicUsage: rawPeriodicUsage, className }: Props) {	CODE
LOW	…n/CurrentPlan/TokenLimitExceededNotification/index.tsx	22	function TokenLimitExceededNotification({ periodicUsage, className }: Props) {	CODE
LOW	…ption/CurrentPlan/PaymentOverdueNotification/index.tsx	12	function PaymentOverdueNotification({ className }: Props) {	CODE
LOW	…components/NotEligibleSwitchPlanModalContent/index.tsx	37	export function NotEligibleSwitchSkuModalContent({	CODE
LOW	…sole/src/pages/EnterpriseSso/SsoCreationModal/utils.ts	5	export function categorizeSsoConnectorProviders(providers: SsoConnectorProvidersResponse = []): {	CODE
LOW	…late/OrganizationRoles/CreateOrganizationRoleModal.tsx	35	function CreateOrganizationRoleModal({ isOpen, onClose }: Props) {	CODE
LOW	…oleDetails/Permissions/use-organization-role-scopes.ts	9	function useOrganizationRoleScopes(organizationRoleId: string) {	CODE
LOW	…s/ConnectorContent/EmailServiceConnectorForm/index.tsx	33	function EmailServiceConnectorForm({ extraInfo }: Props) {	CODE
LOW	…pages/UserSessionDetails/RevokeSessionConfirmModal.tsx	16	function RevokeSessionConfirmModal({	CODE
LOW	…onsole/src/pages/ExternalGoogleOneTapLanding/index.tsx	14	function ExternalGoogleOneTapLanding() {	CODE
LOW	…nce/contexts/SignInExperienceContextProvider/index.tsx	22	function SignInExperienceContextProvider({ children }: Props) {	CODE
LOW	…ignIn/SignInForm/ForgotPasswordMethodEditBox/index.tsx	21	function ForgotPasswordMethodEditBox() {	CODE
LOW	…ng/CustomUiForm/CrossOriginOpenerPolicyField/index.tsx	17	function CrossOriginOpenerPolicyField({ isDisabled }: Props) {	CODE
LOW	…nce/PageContent/SignUpAndSignInChangePreview/index.tsx	17	function SignUpAndSignInChangePreview({	CODE
LOW	…ndSignInChangePreview/PasswordDisabledNotification.tsx	15	function PasswordDisabledNotification({ after, className }: Props) {	CODE
LOW	…gnInChangePreview/SignUpAndSignInDiffSection/index.tsx	14	function SignUpAndSignInDiffSection({ before, after, isAfter = false }: Props) {	CODE
LOW	…SignInDiffSection/ForgotPasswordMethodsDiffSection.tsx	13	function ForgotPasswordMethodsDiffSection({ before, after, isAfter = false }: Props) {	CODE
LOW	…ontent/components/CustomDataProfileNameField/index.tsx	5	function CustomDataProfileNameField(props: Props) {	CODE
LOW	…ontent/components/SignInExperienceTabWrapper/index.tsx	7	function SignInExperienceTabWrapper({ children, ...reset }: Props) {	CODE
LOW	…eContent/AccountCenter/WebauthnRelatedOriginsField.tsx	22	function WebauthnRelatedOriginsField({ isAccountApiEnabled }: Props) {	CODE
LOW	…Content/AccountCenter/RecentAuthenticationFormCard.tsx	30	function RecentAuthenticationFormCard({ isAccountApiEnabled }: Props) {	CODE
LOW	…sers/components/DevTenantDataRetentionNotice/index.tsx	14	function DevTenantDataRetentionNoticeContent() {	CODE
LOW	…sers/components/DevTenantDataRetentionNotice/index.tsx	51	function DevTenantDataRetentionNotice() {	CODE
LOW	…nContent/SettingsSection/EnvironmentVariablesField.tsx	15	function EnvironmentVariablesField({ className }: Props) {	CODE
LOW	…ganizationDetails/EditOrganizationRolesModal/index.tsx	35	function EditOrganizationRolesModal({ organizationId, data, isOpen, onClose, type }: Props) {	CODE
LOW	…cations/components/ThirdPartyAppGuideLibrary/index.tsx	19	function ThirdPartyAppGuideLibrary({ onSelectGuide }: Props) {	CODE
LOW	…ts/ThirdPartyApplicationEmptyDataPlaceHolder/index.tsx	19	function ThirdPartyApplicationEmptyDataPlaceHolder({ onCreateThirdParty }: Props) {	CODE
9 more matches not shown…

Structural Annotation Overuse38 hits · 62 pts

Severity	File	Line	Snippet	Context
LOW	packages/connectors/connector-google/README.md	28	## Step 1: Create a project on Google Auth Platform	COMMENT
LOW	packages/connectors/connector-google/README.md	45	## Step 2: Create OAuth 2.0 credentials	COMMENT
LOW	packages/connectors/connector-google/README.md	57	## Step 3: Configure Logto connector with credentials	COMMENT
LOW	packages/connectors/connector-google/README.md	67	## Step 4: Configure scopes	COMMENT
LOW	packages/connectors/connector-google/README.md	107	## Step 5: Customize authentication prompts	COMMENT
LOW	packages/connectors/connector-google/README.md	115	## Step 6: General settings	COMMENT
LOW	packages/connectors/connector-google/README.md	138	## Step 7: Enable Google One Tap (Optional)	COMMENT
LOW	packages/connectors/connector-google/README.md	162	## Step 8: Test and publish your app	COMMENT
LOW	packages/connectors/connector-facebook/README.md	27	## Step 1: Set up an app on Facebook App Dashboard	COMMENT
LOW	packages/connectors/connector-facebook/README.md	39	## Step 2: Set up Logto connector with client credentials	COMMENT
LOW	packages/connectors/connector-facebook/README.md	49	## Step 3: Configure scopes	COMMENT
LOW	packages/connectors/connector-facebook/README.md	83	## Step 4: General settings	COMMENT
LOW	packages/connectors/connector-facebook/README.md	103	## Step 5: Test sign-in with Facebook's test users (Optional)	COMMENT
LOW	packages/connectors/connector-facebook/README.md	111	## Step 6: Publish Facebook sign-in settings	COMMENT
LOW	packages/connectors/connector-github/README.md	27	## Step 1: Create an OAuth app on GitHub	COMMENT
LOW	packages/connectors/connector-github/README.md	46	## Step 2: Configure your Logto connector	COMMENT
LOW	packages/connectors/connector-github/README.md	56	## Step 3: Configure scopes (Optional)	COMMENT
LOW	packages/connectors/connector-github/README.md	88	## Step 4: General settings	COMMENT
LOW	packages/connectors/connector-github/README.md	112	## Step 5: Test your integration (Optional)	COMMENT
LOW	packages/core/src/utils/sha-crypt.ts	218	// Step 21: the rounds. A plain loop: `rounds` may be large, so no array of that length is built.	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	207	// Step 1: Setup for user registration (without passkeySignIn enabled)	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	230	// Step 2: Enable passkeySignIn for sign-in testing	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	306	// Step 1: Setup for user registration (without passkeySignIn enabled)	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	328	// Step 2: Enable passkeySignIn and clear MFA for sign-in testing	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	292	// Step 2: Add TOTP MFA to the user via admin API, so the user has mandatory TOTP MFA	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	295	// Step 3: Enable mandatory TOTP MFA and passkey sign-in	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	388	// Step 2: Set username and password for the SSO user via admin API	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	392	// Step 3: Enable mandatory WebAuthn MFA so the user can bind a passkey	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	395	// Step 4: Sign in with username/password to bind a passkey during MFA step	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	411	// Step 5: Disable MFA requirement and enable passkey sign-in	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	421	// Step 6: Attempt passkey sign-in — should be blocked for SSO users	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	281	// Step 1: Register a user with passkey (WebAuthn MFA binding during registration)	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	308	// Step 4: Sign in using the passkey sign-in button	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	319	// Step 5: Verify the user is signed in successfully without MFA verification prompt	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	377	// Step 1: Register a user via SSO (creates SSO identity)	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	104	// Step 1: Call WebAuthn browser API synchronously after click (required for iOS Safari)	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	142	// Step 2: Verify registration with server	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	157	// Step 3: Show naming step instead of directly adding the MFA	COMMENT

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	packages/core/src/libraries/organization-invitation.ts	72	if (await this.queries.organizations.relations.users.isMember(organizationId, invitee)) {	CODE
CRITICAL	packages/core/src/libraries/jwt-customizer.ts	138	await this.queries.organizations.relations.users.getOrganizationsByUserId(userId);	CODE
CRITICAL	packages/core/src/routes/experience/classes/mfa.ts	771	(await this.queries.organizations.relations.users.getOrganizationsByUserId(user.id));	CODE
CRITICAL	packages/core/src/routes/experience/classes/mfa.ts	796	? this.queries.organizations.relations.users.getOrganizationsByUserId(user.id)	CODE

Verbosity Indicators20 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	packages/core/src/utils/sha-crypt.ts	218	// Step 21: the rounds. A plain loop: `rounds` may be large, so no array of that length is built.	COMMENT
LOW	packages/core/src/routes/authn.ts	209	// IdP initiated SSO does not provide the RelayState, we need to check if the IdP initiated SSO flow is enabled.	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	207	// Step 1: Setup for user registration (without passkeySignIn enabled)	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	230	// Step 2: Enable passkeySignIn for sign-in testing	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	306	// Step 1: Setup for user registration (without passkeySignIn enabled)	COMMENT
LOW	…rience/identifier-first-verification-switching.test.ts	328	// Step 2: Enable passkeySignIn and clear MFA for sign-in testing	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	292	// Step 2: Add TOTP MFA to the user via admin API, so the user has mandatory TOTP MFA	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	295	// Step 3: Enable mandatory TOTP MFA and passkey sign-in	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	388	// Step 2: Set username and password for the SSO user via admin API	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	392	// Step 3: Enable mandatory WebAuthn MFA so the user can bind a passkey	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	395	// Step 4: Sign in with username/password to bind a passkey during MFA step	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	411	// Step 5: Disable MFA requirement and enable passkey sign-in	COMMENT
LOW⚡	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	421	// Step 6: Attempt passkey sign-in — should be blocked for SSO users	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	281	// Step 1: Register a user with passkey (WebAuthn MFA binding during registration)	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	308	// Step 4: Sign in using the passkey sign-in button	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	319	// Step 5: Verify the user is signed in successfully without MFA verification prompt	COMMENT
LOW	…-tests/src/tests/experience/mfa/webauthn/index.test.ts	377	// Step 1: Register a user via SSO (creates SSO identity)	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	104	// Step 1: Call WebAuthn browser API synchronously after click (required for iOS Safari)	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	142	// Step 2: Verify registration with server	COMMENT
LOW	packages/account/src/pages/PasskeyBinding/index.tsx	157	// Step 3: Show naming step instead of directly adding the MFA	COMMENT

AI Slop Vocabulary7 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker-compose.yml	27	# Or, you can leverage it for local testing.	COMMENT
MEDIUM	packages/core/src/middleware/koa-experience-ssr.test.ts	224	// escaped form (rather than counting `</script>` occurrences) is robust to the served template adding	COMMENT
MEDIUM	packages/core/src/queries/logto-config.ts	208	// Can not narrow down the type of value if we utilize `buildInsertIntoWithPool` method.	COMMENT
MEDIUM	packages/core/src/libraries/logto-config.ts	101	// Can not narrow down the type of value if we utilize `buildInsertIntoWithPool` method.	COMMENT
MEDIUM	packages/core/src/caches/base-cache.ts	101	// We don't leverage `finally` here since we want to ensure cache invalidation	COMMENT
MEDIUM	packages/shared/src/esm/mock-esm.ts	72	// Remove this when we upgrade Node.js to v19+ since we can leverage `import.meta.resolve()` to manually resolve a m	COMMENT
MEDIUM	packages/toolkit/connector-kit/src/types/social.ts	90	// Accept arbitrary unspecified keys so developers who can not publish @logto/connector-kit can more flexibly utilize	COMMENT

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/core/src/middleware/koa-audit-log.ts	116	* #### Create a log entry	COMMENT
MEDIUM	…/pages/Security/Captcha/CreateCaptchaForm/constants.ts	87	## Create a site key	COMMENT

Over-Commented Block3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	packages/core/src/include.d/koa-router.d.ts	1	/* eslint-disable max-lines */	COMMENT
LOW	.github/workflows/codeql-analysis.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/codeql-analysis.yml	61		COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	…src/locales/en/translation/admin-console/connectors.ts	14	'The demo connector is designed exclusively for demonstration purposes and is not recommended for deployment in a pr	CODE

logto-io/logto

Open-Source Code Quality, Security and Technical Debt Review