Experimental, scalable, high performance HTTP server
This report summarizes scanner evidence for lpereira/lwan, a C project with 6,037 GitHub stars. SynthScan examined 52,219 lines of code across 249 source files, recording 181 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 4.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 168 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 32 finding(s).
Which changes need focused human review? 181 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 181 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | fuzz/mayhem/build.sh | 1 | #!/bin/bash -euv | COMMENT |
| LOW | src/bin/tools/mimegen.c | 21 | #include <assert.h> | COMMENT |
| LOW | src/bin/tools/weighttp.c | 21 | #pragma GCC diagnostic ignored "-Wvla" | COMMENT |
| LOW | src/bin/tools/weighttp.c | 41 | #include <strings.h> /* strcasecmp() strncasecmp() */ | COMMENT |
| LOW | src/bin/tools/weighttp.c | 61 | COMMENT | |
| LOW | src/bin/tools/weighttp.c | 81 | #ifndef __attribute_pure__ | COMMENT |
| LOW | src/bin/lwan/main.c | 161 | #if defined(LWAN_HAVE_LANDLOCK) | COMMENT |
| LOW | src/samples/smolsite/main.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/samples/smolsite/junzip.h | 1 | /** | COMMENT |
| LOW | src/samples/smolsite/junzip.h | 21 | #define Z_ERRNO -1 | COMMENT |
| LOW | src/samples/smolsite/qrcodegen.c | 21 | * Software. | COMMENT |
| LOW | src/samples/smolsite/qrcodegen.c | 41 | // - They only read input scalar/array arguments, write to output pointer/array | COMMENT |
| LOW | src/samples/techempower/json.c | 1 | /* | COMMENT |
| LOW | src/samples/techempower/techempower.c | 21 | #include <errno.h> | COMMENT |
| LOW | src/samples/forthsalon/forth.c | 21 | /* | COMMENT |
| LOW | src/samples/forthsalon/gif.h | 1 | // | COMMENT |
| LOW | src/samples/forthsalon/gif.h | 21 | // unchanged. | COMMENT |
| LOW | src/samples/forthsalon/gif.h | 41 | // Define these macros to hook into a custom memory allocator. | COMMENT |
| LOW | src/samples/clock/numbers.c | 21 | #include "font/fiveE.xbm" | COMMENT |
| LOW | src/scripts/gentables.py | 1 | #!/usr/bin/python | COMMENT |
| LOW | src/scripts/gentables.py | 21 | # - Some tables can be reduced and be converted to pure code. For | COMMENT |
| LOW | src/lib/lwan-readahead.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-straitjacket.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-coro.h | 21 | #pragma once | COMMENT |
| LOW | src/lib/missing.c | 21 | #include <errno.h> | COMMENT |
| LOW | src/lib/lwan-pubsub.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-request.c | 21 | #include <arpa/inet.h> | COMMENT |
| LOW | src/lib/lwan-request.c | 41 | #include "lwan-private.h" | COMMENT |
| LOW | src/lib/lwan.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-strbuf.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/timeout.c | 81 | * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ | COMMENT |
| LOW | src/lib/lwan-mod-fastcgi.c | 21 | * https://fastcgi-archives.github.io/FastCGI_Specification.html | COMMENT |
| LOW | src/lib/lwan-mod-fastcgi.c | 41 | COMMENT | |
| LOW | src/lib/lwan-mod-rewrite.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-job.c | 21 | #include <assert.h> | COMMENT |
| LOW | src/lib/lwan-mod-lua.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/realpathat.c | 21 | COMMENT | |
| LOW | src/lib/lwan-arena.c | 21 | #include "lwan-private.h" | COMMENT |
| LOW | src/lib/hash.c | 21 | #include <assert.h> | COMMENT |
| LOW | src/lib/lwan-template.c | 21 | * Ideas from Mustache logic-less templates: http://mustache.github.com/ | COMMENT |
| LOW | src/lib/lwan-config.c | 21 | COMMENT | |
| LOW | src/lib/lwan-h2-huffman.c | 21 | * You should have received a copy of the GNU General Public License | COMMENT |
| LOW | src/lib/lwan-coro.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-coro.c | 41 | #endif | COMMENT |
| LOW | src/lib/lwan-coro.c | 101 | COMMENT | |
| LOW | src/lib/sd-daemon.c | 21 | ***/ | COMMENT |
| LOW | src/lib/lwan-socket.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan.h | 21 | #pragma once | COMMENT |
| LOW | src/lib/lwan.h | 141 | COMMENT | |
| LOW | src/lib/lwan.h | 161 | #define LWAN_ARRAY_PARAM(length) [length] | COMMENT |
| LOW | src/lib/lwan-response.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-mod-serve-files.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-mod-serve-files.c | 41 | COMMENT | |
| LOW | src/lib/lwan-log.c | 21 | #include <errno.h> | COMMENT |
| LOW | src/lib/lwan-tables.c | 21 | #include <assert.h> | COMMENT |
| LOW | src/lib/lwan-mod-lua-lsp.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-websocket.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-thread.c | 21 | #define _GNU_SOURCE | COMMENT |
| LOW | src/lib/lwan-config.h | 21 | COMMENT | |
| LOW | src/lib/lwan-lua.c | 21 | #define _GNU_SOURCE | COMMENT |
| 83 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/scripts/testsuite.py | 77 | except FileExistsError: | CODE |
| HIGH | src/scripts/testsuite.py | 103 | except requests.exceptions.ConnectionError: | CODE |
| HIGH | src/scripts/testsuite.py | 219 | except requests.exceptions.ChunkedEncodingError: | CODE |
| HIGH | src/scripts/testsuite.py | 221 | except requests.exceptions.ConnectionError: | CODE |
| HIGH | src/scripts/testsuite.py | 226 | except requests.exceptions.ChunkedEncodingError: | CODE |
| HIGH | src/scripts/testsuite.py | 228 | except requests.exceptions.ConnectionError: | CODE |
| HIGH | src/scripts/testsuite.py | 623 | except requests.exceptions.ChunkedEncodingError: | CODE |
| HIGH | src/scripts/testsuite.py | 625 | except requests.exceptions.ConnectionError: | CODE |
| HIGH | src/scripts/testsuite.py | 119 | except FileNotFoundError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | src/scripts/gentables.py | 349 | if (n_decoded == 0 && expected_size == 0) | CODE |
| HIGH⚡ | src/scripts/gentables.py | 351 | if (n_decoded == 0 && expected_size != 0) | CODE |
| HIGH⚡ | src/scripts/gentables.py | 353 | while (n_decoded && expected_size) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/scripts/testsuite.py | 895 | def test_cache_munmaps_conn_close(self): | CODE |
| LOW⚡ | src/scripts/testsuite.py | 903 | def test_cache_munmaps_conn_keep_alive(self): | CODE |
| LOW⚡ | src/scripts/testsuite.py | 912 | def test_cache_does_not_mmap_large_files(self): | CODE |
| LOW⚡ | src/scripts/testsuite.py | 917 | def test_cache_mmaps_once_conn_keep_alive(self): | CODE |
| LOW⚡ | src/scripts/testsuite.py | 924 | def test_cache_mmaps_once_conn_close(self): | CODE |
| LOW⚡ | src/scripts/testsuite.py | 930 | def test_cache_mmaps_once_even_after_timeout(self): | CODE |
| LOW | src/scripts/testsuite.py | 233 | def test_mime_type_is_correct(self): | CODE |
| LOW | src/scripts/testsuite.py | 327 | def test_head_request_small_file(self): | CODE |
| LOW | src/scripts/testsuite.py | 339 | def test_head_request_larger_file(self): | CODE |
| LOW | src/scripts/testsuite.py | 351 | def test_uncompressed_small_file(self): | CODE |
| LOW | src/scripts/testsuite.py | 371 | def test_compressed_small_file(self): | CODE |
| LOW | src/scripts/testsuite.py | 434 | def test_has_lwan_server_header(self): | CODE |
| LOW | src/scripts/testsuite.py | 440 | def test_directory_without_trailing_slash_redirects(self): | CODE |
| LOW | src/scripts/testsuite.py | 463 | def test_conditional_rewrite_with_cookie(self): | CODE |
| LOW | src/scripts/testsuite.py | 475 | def test_conditional_rewrite_without_cookie(self): | CODE |
| LOW | src/scripts/testsuite.py | 481 | def test_conditional_rewrite_backref(self): | CODE |
| LOW | src/scripts/testsuite.py | 583 | def test_cat_sleeping_on_keyboard(self): | CODE |
| LOW | src/scripts/testsuite.py | 590 | def test_no_http_version_fails(self): | CODE |
| LOW | src/scripts/testsuite.py | 767 | def test_global_headers_are_present(self): | CODE |
| LOW | src/scripts/testsuite.py | 826 | def test_with_param_and_fragment(self): | CODE |
| LOW | src/scripts/testsuite.py | 1027 | def test_custom_header_exists(self): | CODE |
| LOW | src/scripts/testsuite.py | 1033 | def test_custom_header_does_not_exist(self): | CODE |
| LOW | src/scripts/testsuite.py | 1060 | def only_request_fuzzer_regression(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/samples/smolsite/junzip.c | 255 | return Z_ERRNO; // TODO: more robust read loop | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/scripts/testsuite.py | 12 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/scripts/testsuite.py | 61 | CODE |