get things from one computer to another, safely
This report summarizes scanner evidence for magic-wormhole/magic-wormhole, a Python project with 22,980 GitHub stars. SynthScan examined 29,626 lines of code across 115 source files, recording 259 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 12.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 209 finding(s).
Are imports declared and package/API names verified? 13 finding(s).
Are wrappers, guards, and repeated structures necessary? 180 finding(s).
Which changes need focused human review? 259 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 259 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | versioneer.py | 691 | def git_versions_from_keywords( | CODE |
| LOW | versioneer.py | 1222 | def git_versions_from_keywords( | STRING |
| LOW⚡ | misc/demo-journal.py | 217 | def wormhole_dispatch_got_code(self, code, iid): | CODE |
| LOW⚡ | misc/demo-journal.py | 225 | def wormhole_dispatch_got_verifier(self, verifier, iid): | CODE |
| LOW⚡ | misc/demo-journal.py | 228 | def wormhole_dispatch_verified(self, _, iid): | CODE |
| LOW⚡ | misc/demo-journal.py | 231 | def wormhole_dispatch_got_data(self, data, iid): | CODE |
| LOW | src/wormhole/_rlcompleter.py | 67 | def _commit_and_build_completions(self, text): | CODE |
| LOW | src/wormhole/_rlcompleter.py | 153 | def _input_code_with_completion(prompt, input_helper, reactor): | CODE |
| LOW | src/wormhole/transit.py | 83 | def build_sided_relay_handshake(key, side): | CODE |
| LOW | src/wormhole/_version.py | 184 | def git_versions_from_keywords( | CODE |
| LOW | src/wormhole/_nameplate.py | 164 | def send_status_code_allocated(self): | CODE |
| LOW | src/wormhole/_nameplate.py | 170 | def send_status_code_consumed(self): | CODE |
| LOW | src/wormhole/_interfaces.py | 389 | def get_nameplate_completions(prefix): | CODE |
| LOW | src/wormhole/_interfaces.py | 424 | def when_wordlist_is_available(): | CODE |
| LOW | src/wormhole/_rendezvous.py | 178 | def _initial_connection_failed(self, f): | CODE |
| LOW | src/wormhole/_rendezvous.py | 287 | def _response_handle_allocated(self, msg): | CODE |
| LOW | src/wormhole/_rendezvous.py | 292 | def _response_handle_nameplates(self, msg): | CODE |
| LOW | src/wormhole/_rendezvous.py | 332 | def _response_handle_released(self, msg): | CODE |
| LOW | src/wormhole/_key.py | 120 | def deliver_code_and_stashed_pake(self, code): | CODE |
| LOW | src/wormhole/_boss.py | 415 | def send_status_confirmed_key(self, plaintext): | CODE |
| LOW | src/wormhole/_input.py | 46 | def when_wordlist_is_available(self): | CODE |
| LOW | src/wormhole/_input.py | 94 | def get_nameplate_completions(self, prefix): | CODE |
| LOW | src/wormhole/_input.py | 129 | def _get_nameplate_completions(self, prefix): | CODE |
| LOW | src/wormhole/_input.py | 316 | def get_nameplate_completions(self, prefix): | CODE |
| LOW | src/wormhole/_input.py | 326 | def when_wordlist_is_available(self): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 822 | def test_close_while_idle_nameplate(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 828 | def test_close_while_idle_connected(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 836 | def test_close_while_unclaimed(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 842 | def test_close_while_claiming(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 1201 | def test_close_while_idle_but_connected(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 1207 | def test_close_while_mailbox_disconnected(): | CODE |
| LOW⚡ | src/wormhole/test/test_machines.py | 1213 | def test_close_while_reconnecting(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 504 | def test_connect_first_lister(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 531 | def test_connect_first_ask_twice(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 627 | def test_connect_first_allocator(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 700 | def test_connect_first_nameplate(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 726 | def test_reconnect_while_claiming(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 740 | def test_reconnect_while_claimed(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 763 | def test_reconnect_while_releasing(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 790 | def test_reconnect_while_done(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 857 | def test_close_while_claiming_but_disconnected(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 901 | def test_close_while_claimed_but_disconnected(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 928 | def test_close_while_releasing(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 954 | def test_close_while_releasing_but_disconnecteda(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 1017 | def test_close_while_done_but_disconnected(): | CODE |
| LOW | src/wormhole/test/test_machines.py | 1070 | def test_connect_first_mailbox(): # connect before got_mailbox | CODE |
| LOW | src/wormhole/test/test_transit.py | 39 | async def test_there_might_also_be_none(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 74 | async def test_cancel_after_one_failure(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 124 | async def test_not_forever_cancel_early(forever): | CODE |
| LOW | src/wormhole/test/test_transit.py | 152 | def test_allocate_port_no_reuseaddr(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 204 | async def test_ignore_localhost_hint_orig(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 219 | async def test_ignore_localhost_hint(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 234 | async def test_keep_only_localhost_hint(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 270 | async def test_transit_key_already_set(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 464 | async def test_one_fail_one_success(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 669 | async def test_handshake_other_error(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 812 | async def test_receiver_rejected_politely(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 844 | async def test_receiver_rejected_rudely(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 875 | async def test_cancel_during_negotiation(): | CODE |
| LOW | src/wormhole/test/test_transit.py | 1434 | async def test_success_direct_tor_relay(): | CODE |
| 78 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | versioneer.py | 388 | except NameError: | CODE |
| HIGH | versioneer.py | 1216 | except OSError: | CODE |
| HIGH | versioneer.py | 1456 | except OSError: | CODE |
| HIGH | versioneer.py | 1837 | except NotThisMethod: | CODE |
| HIGH | versioneer.py | 1857 | except NotThisMethod: | CODE |
| HIGH | versioneer.py | 1829 | except NotThisMethod: | CODE |
| HIGH | versioneer.py | 1848 | except NotThisMethod: | CODE |
| HIGH | src/wormhole/_version.py | 178 | except OSError: | CODE |
| HIGH | src/wormhole/_version.py | 651 | except NotThisMethod: | CODE |
| HIGH | src/wormhole/_version.py | 670 | except NotThisMethod: | CODE |
| HIGH | src/wormhole/_version.py | 676 | except NotThisMethod: | CODE |
| HIGH | src/wormhole/test/test_util.py | 56 | except AttributeError: # raised by mock.get_original() | CODE |
| HIGH | src/wormhole/test/test_cli.py | 1461 | except CancelledError: | CODE |
| HIGH | src/wormhole/test/test_cli.py | 1479 | except CancelledError: | CODE |
| HIGH | src/wormhole/test/dilate/test_api.py | 116 | except LonelyError: | CODE |
| HIGH | src/wormhole/cli/cmd_receive.py | 121 | except Exception: | CODE |
| HIGH | src/wormhole/cli/cmd_send.py | 96 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .appveyor.yml | 41 | after_test: | COMMENT |
| LOW | versioneer.py | 1881 | # this fixes the "python setup.py develop" case (also 'install' and | COMMENT |
| LOW | versioneer.py | 1921 | # | COMMENT |
| LOW | misc/demo-journal.py | 201 | return b"ok" | COMMENT |
| LOW | misc/web/timeline.js | 101 | // [id], details={} } | COMMENT |
| LOW | docs/conf.py | 1 | COMMENT | |
| LOW | docs/conf.py | 141 | # The paper size ('letterpaper' or 'a4paper'). | COMMENT |
| LOW | src/wormhole/_rlcompleter.py | 101 | if not self._committed_nameplate: | COMMENT |
| LOW | src/wormhole/_rlcompleter.py | 181 | # user into satisfying the blocking read so we can exit. | COMMENT |
| LOW | src/wormhole/transit.py | 41 | COMMENT | |
| LOW | src/wormhole/transit.py | 281 | COMMENT | |
| LOW | src/wormhole/transit.py | 921 | # how should the Listener be managed? we want to shut it down when the | COMMENT |
| LOW | src/wormhole/_rendezvous.py | 241 | # CLOSE_STATUS_CODE_ABNORMAL_CLOSE, and delivers onClose() without | COMMENT |
| LOW | src/wormhole/_boss.py | 201 | # from the Wormhole | COMMENT |
| LOW | src/wormhole/wormhole.py | 21 | COMMENT | |
| LOW | src/wormhole/wormhole.py | 301 | return w | COMMENT |
| LOW | src/wormhole/test/test_cli.py | 241 | f.write(b"fail") | COMMENT |
| LOW | src/wormhole/test/test_cli.py | 321 | return pytest.skip( | COMMENT |
| LOW | src/wormhole/test/dilate/test_record.py | 141 | assert n.mock_calls == [mock.call.start_handshake(), | COMMENT |
| LOW | src/wormhole/test/dilate/test_record.py | 161 | # | 3 | | write_message | handshake | | | COMMENT |
| LOW | src/wormhole/cli/cmd_send.py | 181 | # sit quietly until the receiver has typed in the code and | COMMENT |
| LOW | src/wormhole/cli/cmd_send.py | 201 | self._cancel_on_slow_verification_timer() | COMMENT |
| LOW | src/wormhole/cli/cmd_send.py | 321 | # os.path.joined with the unicode args.what . | COMMENT |
| LOW | src/wormhole/cli/cmd_send.py | 341 | # * we're running on windows | COMMENT |
| LOW | src/wormhole/_dilation/inbound.py | 141 | COMMENT | |
| LOW | src/wormhole/_dilation/connection.py | 21 | # The next object up knows whether it's expecting a Handshake or a message. It | COMMENT |
| LOW | src/wormhole/_dilation/connection.py | 61 | # * send "sided relay handshake": "please relay TOKEN for side SIDE\n" | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 21 | # to reestablish a new one), registered subchannels will be paused, but | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 41 | # unusual because we have multiple Subchannels that get merged into the | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 61 | # Producers will be paused, and others will be resumed | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 81 | # queues some data on the TCP connection (and then might call | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 101 | # | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 121 | # * keep a set of IPushProducers which are paused, a second set of | COMMENT |
| LOW | src/wormhole/_dilation/outbound.py | 141 | # | COMMENT |
| LOW | src/wormhole/_dilation/subchannel.py | 21 | # length prefix itself), so the padded message must be less than 2**32 bytes | COMMENT |
| LOW | src/wormhole/_dilation/connector.py | 341 | made_direct = True | COMMENT |
| LOW | src/wormhole/_dilation/manager.py | 141 | # in WANTING, then we process all previously-queued inbound DILATE-n | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/wormhole/_rlcompleter.py | 43 | except Exception as e: | CODE |
| MEDIUM | src/wormhole/_rlcompleter.py | 40 | def completer(self, text, state): | CODE |
| LOW | src/wormhole/transit.py | 138 | except Exception as e: | CODE |
| MEDIUM | src/wormhole/transit.py | 135 | def dataReceived(self, data): | CODE |
| LOW | src/wormhole/_rendezvous.py | 32 | except Exception: | CODE |
| LOW | src/wormhole/_rendezvous.py | 204 | except Exception as e: | CODE |
| LOW | src/wormhole/_rendezvous.py | 231 | except Exception as e: | CODE |
| LOW | src/wormhole/tor_manager.py | 107 | except Exception: | CODE |
| LOW | src/wormhole/eventual.py | 32 | except Exception: | CODE |
| LOW | src/wormhole/ipaddrs.py | 60 | except Exception: | CODE |
| LOW | src/wormhole/cli/cmd_receive.py | 121 | except Exception: | CODE |
| MEDIUM | src/wormhole/cli/cmd_receive.py | 118 | def _bad(f): | CODE |
| LOW | src/wormhole/cli/cmd_ssh.py | 52 | except Exception: | CODE |
| LOW | src/wormhole/cli/cmd_send.py | 96 | except Exception: | CODE |
| MEDIUM | src/wormhole/cli/cmd_send.py | 93 | def _bad(f): | CODE |
| LOW | src/wormhole/cli/cli.py | 179 | except Exception as e: | CODE |
| LOW | src/wormhole/_dilation/outbound.py | 353 | except Exception: | CODE |
| LOW | src/wormhole/_dilation/outbound.py | 360 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | versioneer.py | 1194 | CODE | |
| LOW | versioneer.py | 1427 | CODE | |
| LOW | versioneer.py | 1752 | CODE | |
| LOW | versioneer.py | 2172 | CODE | |
| LOW | src/wormhole/transit.py | 681 | CODE | |
| LOW | src/wormhole/_version.py | 156 | CODE | |
| LOW | src/wormhole/_version.py | 602 | CODE | |
| LOW | src/wormhole/tor_manager.py | 32 | CODE | |
| LOW | src/wormhole/test/test_ssh.py | 44 | CODE | |
| LOW | src/wormhole/test/test_cli.py | 416 | CODE | |
| LOW | src/wormhole/test/test_cli.py | 803 | CODE | |
| LOW | src/wormhole/cli/cmd_receive.py | 434 | CODE | |
| LOW | src/wormhole/cli/cmd_ssh.py | 15 | CODE | |
| LOW | src/wormhole/cli/cmd_send.py | 293 | CODE | |
| LOW | src/wormhole/_dilation/connection.py | 213 | CODE | |
| LOW | src/wormhole/_dilation/connection.py | 635 | CODE | |
| LOW | src/wormhole/_dilation/manager.py | 460 | CODE | |
| LOW | src/wormhole/_dilation/manager.py | 583 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | versioneer.py | 533 | # each be defined on a line of their own. _version.py will just call | COMMENT |
| LOW | src/wormhole/transit.py | 483 | # close-on-exec because we close it right away. So just add SO_REUSEADDR. | COMMENT |
| MEDIUM | src/wormhole/_status.py | 108 | # note that the tests (e.g. test_api.py) leverage the order of these | COMMENT |
| LOW | src/wormhole/_version.py | 26 | # each be defined on a line of their own. _version.py will just call | COMMENT |
| MEDIUM | src/wormhole/test/dilate/test_record.py | 302 | # structures can be set up and paired properly. Essentially | COMMENT |
| MEDIUM | src/wormhole/_dilation/manager.py | 29 | # note that these are strings, not numbers, to facilitate | COMMENT |
| LOW | src/wormhole/_dilation/manager.py | 975 | # invoked; upstream calls are basically just call-through -- so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | versioneer.py | 318 | CODE | |
| LOW | versioneer.py | 318 | CODE | |
| LOW | versioneer.py | 318 | CODE | |
| LOW | misc/dump-timing.py | 5 | CODE | |
| LOW | misc/dump-timing.py | 5 | CODE | |
| LOW | src/wormhole/__init__.py | 1 | CODE | |
| LOW | src/wormhole/__init__.py | 2 | CODE | |
| LOW | src/wormhole/__init__.py | 3 | CODE | |
| LOW | src/wormhole/__init__.py | 3 | CODE | |
| LOW | src/wormhole/__init__.py | 4 | CODE | |
| LOW | src/wormhole/_dilation/_noise.py | 5 | CODE | |
| LOW | src/wormhole/_dilation/_noise.py | 11 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/wormhole/test/test_wormhole.py | 699 | w1._boss._RC._ws.transport.loseConnection() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | versioneer.py | 514 | # This file is released into the public domain. | COMMENT |
| MEDIUM | docs/conf.py | 5 | # This file is execfile()d with the current directory set to its | COMMENT |
| MEDIUM | src/wormhole/_version.py | 7 | # This file is released into the public domain. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | misc/demo-journal.py | 114 | CODE | |
| LOW | src/wormhole/_key.py | 46 | CODE | |
| LOW | src/wormhole/wormhole.py | 259 | CODE | |
| LOW | src/wormhole/test/test_ipaddrs.py | 111 | CODE | |
| LOW | src/wormhole/test/test_cli.py | 416 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/wormhole/_dilation/connection.py | 560 | # when we move to the sans-io event-driven scheme, this queue | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/wormhole/__init__.py | 9 | __all__ = [ | CODE |
| LOW | src/wormhole/_key.py | 17 | __all__ = ["derive_key", "derive_phase_key", "CryptoError", "Key"] | CODE |