M3 monorepo - Distributed TSDB, Aggregator and Query Engine, Prometheus Sidecar, Graphite Compatible, Metrics Platform
This report summarizes scanner evidence for m3db/m3, a Go project with 4,904 GitHub stars. SynthScan examined 787,545 lines of code across 3247 source files, recording 3112 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 4.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3083 finding(s).
Are imports declared and package/API names verified? 9 finding(s).
Are wrappers, guards, and repeated structures necessary? 22 finding(s).
Which changes need focused human review? 3112 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3112 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | examples/dbnode/metrics_client/main.go | 1 | // Copyright (c) 2020 Uber Technologies, Inc. | COMMENT |
| LOW | examples/dbnode/proto_client/main.go | 1 | // Copyright (c) 2020 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/comparator/compare.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/comparator/grafana/generate_dash.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | …ripts/comparator/utils/compare_utilities_regression.go | 1 | // Copyright (c) 2020 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/comparator/utils/compare_utilities.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/comparator/utils/compare_utilities_grafana.go | 1 | // Copyright (c) 2020 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/md5/md5.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/vagrant/provision/gimme.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/vagrant/provision/gimme.sh | 21 | #+ --force-known-update - when used with --known, ignores the cache and updates | COMMENT |
| LOW | scripts/vagrant/provision/gimme.sh | 481 | _env "${src_dir}" | tee "${src_env}" || return 1 | COMMENT |
| LOW | …ipts/docker-integration-tests/query_fanout/restrict.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | scripts/docker-integration-tests/prometheus/test.sh | 561 | ATTEMPTS=5 TIMEOUT=2 MAX_TIMEOUT=4 retry_with_backoff \ | COMMENT |
| LOW | .buildkite/pipeline.yml | 61 | # disabling steps until it is fixed. ISSUE: https://github.com/m3db/m3/issues/4274 | COMMENT |
| LOW | .buildkite/image-release-pipeline.yml | 1 | steps: | COMMENT |
| LOW | .buildkite/image-release-pipeline.yml | 21 | # password-env: QUAY_M3DB_TOKEN | COMMENT |
| LOW | site/config/_default/config.toml | 121 | # Disable search function. It will hide search bar | COMMENT |
| LOW | site/config/production/config.toml | 101 | [params] | COMMENT |
| LOW | site/content/operational_guide/resource_limits.md | 81 | # queries searching time series by dimensions. | COMMENT |
| LOW | site/content/operational_guide/resource_limits.md | 101 | # lookback period the global count is reset to zero and when the limit | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 1 | # Include this field if you want to enable an embedded M3 Coordinator instance | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 41 | # Metrics scope | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 61 | # Upper bound of the bucket | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 81 | listenAddress: <url> | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 181 | # Number of concurrent workers performing migration | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 361 | # Defaults = true | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 421 | rpc_metrics: <bool> | COMMENT |
| LOW | site/content/includes/m3dbnode/annotated_config.yaml | 541 | maxOutstandingRepairedBytes: <int> | COMMENT |
| LOW | site/content/includes/m3query/annotated_config.yaml | 1 | # The server listen address | COMMENT |
| LOW | site/content/includes/m3query/annotated_config.yaml | 201 | all: <bool> | COMMENT |
| LOW | site/content/includes/m3query/annotated_config.yaml | 261 | maxRetries: <int> | COMMENT |
| LOW | site/content/includes/m3query/annotated_config.yaml | 321 | # Array of Prometheus remote write compatible endpoints. | COMMENT |
| LOW | site/content/includes/m3query/annotated_config.yaml | 441 | watermark: | COMMENT |
| LOW | kube/sysctl-daemonset.yaml | 1 | # This manifest provides a daemonset that will ensure the host's sysctls are set | COMMENT |
| LOW | src/metrics/aggregation/id_compress_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/id.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/type_string.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/type.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/type_config_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/types_options_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/id_test.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/type_config.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/types_pool_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/id_compress.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/type_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/types_pool.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/aggregation/types_options.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/filter_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/tags_filter_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/filter_benchmark_test.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/filter.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/tags_filter.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/filters/mock_filter.go | 1 | // Copyright (c) 2017 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/pipeline/type.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/pipeline/optype_string.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/pipeline/type_test.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/pipeline/applied/type.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/pipeline/applied/type_test.go | 1 | // Copyright (c) 2018 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/carbon/parser_test.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| LOW | src/metrics/carbon/parser_benchmark_test.go | 1 | // Copyright (c) 2019 Uber Technologies, Inc. | COMMENT |
| 2987 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 442 | n.metrics.status.index.numDocs.Update(float64(n.statsLastTick.index.numDocs)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 443 | n.metrics.status.index.numBlocks.Update(float64(n.statsLastTick.index.numBlocks)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 444 | n.metrics.status.index.numSegments.Update(float64(n.statsLastTick.index.numSegments)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 691 | n.metrics.tick.index.numDocs.Update(float64(indexTickResults.NumTotalDocs)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 692 | n.metrics.tick.index.numBlocks.Update(float64(indexTickResults.NumBlocks)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 693 | n.metrics.tick.index.numSegments.Update(float64(indexTickResults.NumSegments)) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 694 | n.metrics.tick.index.numBlocksEvicted.Inc(indexTickResults.NumBlocksEvicted) | CODE |
| CRITICAL⚡ | src/dbnode/storage/namespace.go | 695 | n.metrics.tick.index.numBlocksSealed.Inc(indexTickResults.NumBlocksSealed) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | kube/terraform/examples/gcp/variables.tf | 1 | # --------------------------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | kube/terraform/examples/gcp/variables.tf | 4 | # --------------------------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 37 | // ╔══════════════════╗ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 39 | // ║ Uninitialized ║────────────Setup()────┐ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 41 | // ╚══════════════════╝ │ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 46 | // ├────────────────────────┐ │ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 48 | // ┌───────┘ │ │ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 50 | // ╔═════╩════════════╗◀────Start()─────╦═╩════════════════╗ | COMMENT |
| MEDIUM⚡ | src/m3em/cluster/types.go | 54 | // │ ╚══════════════════╝──────Stop()────▶╚══════════════════╝ │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 40 | // ┌──────────────────┐ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 42 | // ┌Teardown()─────│ Error │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 44 | // │ └──────────────────┘ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 48 | // ┌──────────────────┐ ┌───────────────-──┐ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 50 | // │ Uninitialized ├────────────────────────▶│ Setup │◀─┐ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 51 | // │ │◀───────────┐ │ │ │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 52 | // └──────────────────┘ Teardown()└────────────└──────────────────┘ │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 58 | // │ ┌─────────────┘ │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 63 | // │ ┌──────────────────┐ │ | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 65 | // └────────────────────│ Running │────────────Stop() | COMMENT |
| MEDIUM⚡ | src/m3em/node/types.go | 67 | // └──────────────────┘ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ripts/development/m3_aggregator_local/debug_example.sh | 9 | # Check if delve is installed | COMMENT |
| MEDIUM | src/dbnode/storage/namespace.go | 1407 | // NB(r): Essentially if all are success, we don't need to flush, if any | COMMENT |
| MEDIUM | src/dbnode/storage/limits/permits/types.go | 57 | // Permits are the set of permits that individual codepaths will utilize. | COMMENT |
| MEDIUM | src/msg/producer/writer/message_writer.go | 889 | // writers and wait for the first one to return. This way, we can utilize the connections | COMMENT |
| MEDIUM | src/aggregator/aggregator/options.go | 327 | // This is a temporary option to help with the seamless rollout of changing Add transforms to Reset transforms for | COMMENT |
| MEDIUM | src/aggregator/aggregator/entry.go | 766 | // resendEnabled is set on the rollup rule. Continuing to use untimed allows for a seamless transition since | COMMENT |
| MEDIUM | src/query/models/matcher.go | 110 | // TODO: make this more robust, handle types other than MatchEqual | COMMENT |
| MEDIUM | src/query/models/matcher.go | 138 | // TODO: make this more robust, handle types other than MatchEqual | COMMENT |
| MEDIUM | src/query/storage/m3/cluster_resolver.go | 229 | // Absolutely no complete aggregated namespaces, need to fanout to all | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config/README.md | 1 | ## WARNING: This documentation is not complete. | COMMENT |
| LOW | kube/sysctl-daemonset.yaml | 4 | # WARNING: This will run a PRIVILEGED ROOT container on your HOST that will | COMMENT |
| LOW | src/metrics/README.md | 1 | ## WARNING: This is Alpha software and not intended for use until a stable release. | COMMENT |
| LOW | src/cluster/README.md | 1 | ## WARNING: This is Alpha software and not intended for use until a stable release. | COMMENT |
| LOW | src/cluster/placement/algo/subclustered_helper.go | 334 | // Step 1: Identify over-weighted isolation groups | COMMENT |
| LOW | src/cluster/placement/algo/subclustered_helper.go | 346 | // Step 2: Calculate target load for each instance | COMMENT |
| LOW | …c/dbnode/network/server/tchannelthrift/node/service.go | 1334 | // Step 2: Read the results of the asynchronuous block readers. | COMMENT |
| LOW | src/query/README.md | 1 | ## WARNING: This is Alpha software and not intended for use until a stable release. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/metrics/matcher/cache/cache.go | 282 | // Therefore we need to check if the cache result is valid up to the end | COMMENT |
| LOW | src/cluster/placement/algo/subclustered_helper.go | 334 | // Step 1: Identify over-weighted isolation groups | COMMENT |
| LOW | src/cluster/placement/algo/subclustered_helper.go | 346 | // Step 2: Calculate target load for each instance | COMMENT |
| LOW | src/dbnode/integration/disk_snapshot_test.go | 173 | // NB(bodu): We need to check if a specific snapshot ID was deleted since snapshotting logic now changed | COMMENT |
| LOW | …c/dbnode/network/server/tchannelthrift/node/service.go | 1334 | // Step 2: Read the results of the asynchronuous block readers. | COMMENT |
| LOW | src/dbnode/persist/fs/files.go | 1033 | // If this is the initial volume, then we need to check if files were written with the legacy file naming (i.e. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ripts/development/m3_aggregator_local/debug_example.sh | 9 | # Check if delve is installed | COMMENT |
| LOW | site/config/_default/config.toml | 124 | # Set this to true to disable this behavior (some proxies don't handle well this optimization) | COMMENT |
| LOW | site/config/_default/config.toml | 126 | # Set this to true to disable copy-to-clipboard button for inline code. | COMMENT |
| LOW | site/config/production/config.toml | 109 | # Set this to true to disable this behavior (some proxies don't handle well this optimization) | COMMENT |
| LOW | site/config/production/config.toml | 111 | # Set this to true to disable copy-to-clipboard button for inline code. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/dbnode/storage/index/compaction/plan.go | 163 | // now that we have the plan, we priortise the tasks as requested in the opts. (c) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/dbnode/x/metrics/test_reporter.go | 132 | // TODO: implement | COMMENT |
| LOW | src/dbnode/x/metrics/test_reporter.go | 143 | // TODO: implement | COMMENT |
| LOW | src/query/graphite/native/builtin_functions.go | 363 | // TODO: implement resetEnd | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/ctl/ui/src/utils/index.js | 21 | export function formatTimestampMilliseconds(timestamp: number): string { | CODE |
| LOW | src/ctl/ui/src/hocs/promiseState.js | 25 | export function withPromiseStateChangeCallback(keys, fn) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/dbnode/persist/fs/retriever.go | 697 | // Don't forget to update the resetForReuse method when adding a new field | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/dbnode/client/circuitbreaker/doc.go | 41 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/ctl/public/r2/v1/swagger/swagger-ui.js | 1 | !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("react"),require("prop-types") | CODE |