Home / mail-in-a-box / mailinabox
AI Slop Code RIsk Monitor

mail-in-a-box/mailinabox

Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box.

18.5 Elevated pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for mail-in-a-box/mailinabox, a Python project with 15,438 GitHub stars. SynthScan examined 21,130 lines of code across 85 source files, recording 221 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 18.5 (Elevated pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

18.5
Adjusted Signal
18.5
Raw Pattern Score
100%
Time Factor
2026-09-26
Last Push
15.4K
Stars
Python
Language
21.1K
Lines of Code
85
Files
221
Pattern Hits
2026-10-12
Scan Date
0.21
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 41.2/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 166 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.1/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 33.6/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 70 finding(s).

PR Review Velocity Impact 61.8/100 · HIGH

Which changes need focused human review? 221 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 18MEDIUM 48LOW 155

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 221 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Self-Referential Comments30 hits · 86 pts
SeverityFileLineSnippetContext
MEDIUMsetup/munin.sh64# Create a systemd service for munin.COMMENT
MEDIUMsetup/management.sh24# Create a virtualenv for the installation of Python 3 packagesCOMMENT
MEDIUMsetup/management.sh54# Create a backup directory and a random key for encrypting backups.COMMENT
MEDIUMsetup/management.sh85# Create an init script to start the management daemon and keep itCOMMENT
MEDIUMsetup/ssl.sh6# Create an RSA private key, a self-signed SSL certificate, and someCOMMENT
MEDIUMsetup/ssl.sh39# Create a directory to store TLS-related things like "SSL" certificates.COMMENT
MEDIUMsetup/dkim.sh45# Create a new DKIM key. This creates mail.private and mail.txtCOMMENT
MEDIUMsetup/firstuser.sh50 # Create the user's mail account. This will ask for a password if none was given above.COMMENT
MEDIUMsetup/firstuser.sh56 # Create an alias to which we'll direct all automatically-created administrative aliases.COMMENT
MEDIUMsetup/web.sh102# Create the iOS/OS X Mobile Configuration file which is exposed via theCOMMENT
MEDIUMsetup/web.sh115# Create the Mozilla Auto-configuration file which is exposed via theCOMMENT
MEDIUMsetup/web.sh125# Create a generic mta-sts.txt file which is exposed via theCOMMENT
MEDIUMsetup/dns.sh49# Create a directory for additional configuration directives, includingCOMMENT
MEDIUMsetup/dns.sh96 # Create the Key-Signing Key (KSK) (with `-k`) which is the so-calledCOMMENT
MEDIUMsetup/mail-users.sh20# Create an empty database if it doesn't yet exist.COMMENT
MEDIUMsetup/webmail.sh105# Create a configuration file.COMMENT
MEDIUMsetup/start.sh69# Create the STORAGE_USER and STORAGE_ROOT directory if they don't already exist.COMMENT
MEDIUMsetup/nextcloud.sh127 # Create a symlink to the config.php in STORAGE_ROOT (for upgrades we're restoring the symlink we previouslyCOMMENT
MEDIUMsetup/nextcloud.sh182 # Create a backup directory to store the current installation and database toCOMMENT
MEDIUMsetup/nextcloud.sh259 # Create an initial configuration file.COMMENT
MEDIUMsetup/nextcloud.sh285 # Create an auto-configuration file to fill in database settingsCOMMENT
MEDIUMmanagement/auth.py130 # Create a token that changes if the user's password or MFA options changeCOMMENT
MEDIUMmanagement/auth.py143 # Create a new session.COMMENT
MEDIUMmanagement/ssl_certificates.py304 # Create a CSR file for our master private key so that certbotCOMMENT
MEDIUMmanagement/backup.py271 # Create an global exclusive lock so that the backup scriptCOMMENT
MEDIUMmanagement/dns_update.py135 # Create a dictionary of domains to a set of attributes for eachCOMMENT
MEDIUMmanagement/dns_update.py660 # Create a stable (by sorting the items) hash of all of the private keysSTRING
MEDIUMmanagement/dns_update.py724 # Create a DS record based on the patched-up key files. The DS record is specific to theSTRING
MEDIUMmanagement/daemon.py138# Create a session key by checking the username/password in the Authorization header.COMMENT
MEDIUMmanagement/daemon.py590 # Create a temporary pool of processes for the status checksCOMMENT
Empty Error Handlers17 hits · 85 pts
SeverityFileLineSnippetContext
HIGHsetup/migrate.py146except:CODE
HIGHtests/fail2ban.py43except smtplib.SMTPAuthenticationError:CODE
HIGHtests/fail2ban.py49except:CODE
HIGHtests/fail2ban.py66except imaplib.IMAP4.error:CODE
HIGHtests/fail2ban.py110except imaplib.IMAP4.error:CODE
HIGHmanagement/ssl_certificates.py659except IndexError:CODE
HIGHmanagement/ssl_certificates.py675except ExtensionNotFound:CODE
HIGHmanagement/backup.py594except:CODE
HIGHmanagement/dns_update.py467except:CODE
HIGHmanagement/dns_update.py1014except dns.exception.DNSException:CODE
HIGHmanagement/dns_update.py1019except dns.exception.DNSException:CODE
HIGHmanagement/mail_log.py120except ImportError:CODE
HIGHmanagement/mail_log.py774except KeyError:CODE
HIGHmanagement/mail_log.py700except KeyError:CODE
HIGHmanagement/mail_log.py724except KeyError:CODE
HIGHmanagement/mailconfig.py296except (ValueError, UnicodeError, idna.IDNAError):CODE
HIGHmanagement/daemon.py175except ValueError:CODE
Over-Commented Block70 hits · 70 pts
SeverityFileLineSnippetContext
LOWtools/parse-nginx-log-bootstrap-accesses.py1#!/usr/bin/python3COMMENT
LOWtools/editconf.py1#!/usr/bin/python3COMMENT
LOWsetup/zpush.sh1#!/bin/bashCOMMENT
LOWsetup/management.sh1#!/bin/bashCOMMENT
LOWsetup/spamassassin.sh1#!/bin/bashCOMMENT
LOWsetup/spamassassin.sh41# check with: pyzor --homedir /etc/mail/spamassassin/pyzor pingCOMMENT
LOWsetup/spamassassin.sh61# content or execute scripts, and it is probably confusing to most users.COMMENT
LOWsetup/spamassassin.sh121# -----------------COMMENT
LOWsetup/ssl.sh1#!/bin/bashCOMMENT
LOWsetup/ssl.sh41mkdir -p "$STORAGE_ROOT/ssl"COMMENT
LOWsetup/mail-postfix.sh1#!/bin/bashCOMMENT
LOWsetup/mail-postfix.sh21# connections from users who can authenticate and then sendsCOMMENT
LOWsetup/mail-postfix.sh41# always will.COMMENT
LOWsetup/mail-postfix.sh81tools/editconf.py /etc/postfix/main.cf \COMMENT
LOWsetup/mail-postfix.sh121# Modify the `outgoing_mail_header_filters` file to use the local machine name and ipCOMMENT
LOWsetup/mail-postfix.sh161# relayed elsewhere. We don't want to be an "open relay". On outboundCOMMENT
LOWsetup/mail-postfix.sh181# for opportunistic encryption but "Intermediate" recommendations when DANECOMMENT
LOWsetup/mail-postfix.sh221# Who can send mail to us? Some basic filters.COMMENT
LOWsetup/mail-postfix.sh241 smtpd_recipient_restrictions="permit_sasl_authenticated,permit_mynetworks,reject_rbl_client zen.spamhaus.org=127.0.0.[2COMMENT
LOWsetup/mail-dovecot.sh1#!/bin/bashCOMMENT
LOWsetup/mail-dovecot.sh21COMMENT
LOWsetup/mail-dovecot.sh41# can be allocated. It should be set *reasonably high* to avoid allocationCOMMENT
LOWsetup/mail-dovecot.sh121# are made available (IMAPS on port 993; POP3S on port 995).COMMENT
LOWsetup/mail-dovecot.sh141COMMENT
LOWsetup/mail-dovecot.sh181 "postmaster_address=postmaster@$PRIMARY_HOSTNAME"COMMENT
LOWsetup/dkim.sh41RequireSafeKeys falseCOMMENT
LOWsetup/dkim.sh101# intercepts outgoing mail to perform the signing (by adding a mail header)COMMENT
LOWsetup/web.sh21COMMENT
LOWsetup/system.sh21# permissions (group writeable) set on the following directories.COMMENT
LOWsetup/system.sh121# PPAs so we can install those packages later.COMMENT
LOWsetup/system.sh161fiCOMMENT
LOWsetup/system.sh201# * DNSSEC signing keys (see `dns.sh`)COMMENT
LOWsetup/system.sh221# entropy saved across boots to a local file" as well as the order ofCOMMENT
LOWsetup/system.sh301# (This is unrelated to the box's public, non-recursive DNS server thatCOMMENT
LOWsetup/system.sh321#COMMENT
LOWsetup/system.sh381# On first installation, the log files that the jails look at don't all exist.COMMENT
LOWsetup/functions.sh41 #COMMENT
LOWsetup/functions.sh81}COMMENT
LOWsetup/functions.sh101 # assigned to an interface. `ip route get` reports theCOMMENT
LOWsetup/bootstrap.sh1#!/bin/bashCOMMENT
LOWsetup/dns.sh81# TLDs, registrars, and validating nameservers don't all support the same algorithms,COMMENT
LOWsetup/dns.sh101 # we're capturing into the `KSK` variable.COMMENT
LOWsetup/dns.sh121 # * `K_domain_.+007+08882.ds`: DS record normally provided to domain name registrar (but it's actually invalid with `_dCOMMENT
LOWsetup/mail-users.sh1#!/bin/bashCOMMENT
LOWsetup/mail-users.sh81COMMENT
LOWsetup/mail-users.sh121# SQL statement to check if we handle incoming mail for a user.COMMENT
LOWsetup/mail-users.sh141# before postfix gets to the third query for catch-alls/domain alises.COMMENT
LOWsetup/webmail.sh1#!/bin/bashCOMMENT
LOWsetup/webmail.sh21# These dependencies are from `apt-cache showpkg roundcube-core`.COMMENT
LOWsetup/start.sh1#!/bin/bashCOMMENT
LOWsetup/start.sh61# Skip on existing installs since we don't want this to block the ability toCOMMENT
LOWsetup/questions.sh1#!/bin/bashCOMMENT
LOWsetup/nextcloud.sh1#!/bin/bashCOMMENT
LOWsetup/nextcloud.sh21# we automatically install intermediate versions as needed.COMMENT
LOWsetup/nextcloud.sh41COMMENT
LOWsetup/nextcloud.sh301?>COMMENT
LOWtests/tls.py1#!/usr/bin/python3COMMENT
LOWmanagement/auth.py81 # The user is trying to log in with a username and a passwordCOMMENT
LOWmanagement/ssl_certificates.py101COMMENT
LOWmanagement/ssl_certificates.py301 "log": [],COMMENT
10 more matches not shown…
Decorative Section Separators15 hits · 45 pts
SeverityFileLineSnippetContext
MEDIUMsetup/zpush.sh4# ----------------------------------------------COMMENT
MEDIUMsetup/spamassassin.sh3# -------------------------------------------COMMENT
MEDIUMsetup/spamassassin.sh16# ----------------------------------------COMMENT
MEDIUMsetup/spamassassin.sh72# ---------------------------------------COMMENT
MEDIUMsetup/spamassassin.sh121# -----------------COMMENT
MEDIUMsetup/ssl.sh4# -------------------------------------------COMMENT
MEDIUMsetup/mail-postfix.sh4# --------------COMMENT
MEDIUMsetup/mail-dovecot.sh4# ----------------------COMMENT
MEDIUMsetup/system.sh6# -------------------------COMMENT
MEDIUMsetup/dns.sh3# -----------------------------------------------COMMENT
MEDIUMsetup/mail-users.sh4# ----------------------------------------------COMMENT
MEDIUMsetup/webmail.sh3# ----------------------COMMENT
MEDIUMsetup/nextcloud.sh16# --------------COMMENT
MEDIUMsetup/nextcloud.sh28# --------------COMMENT
MEDIUMsetup/nextcloud.sh51# ----------------------------COMMENT
Deep Nesting37 hits · 36 pts
SeverityFileLineSnippetContext
LOWtools/readable_bash.py299CODE
LOWtools/readable_bash.py402CODE
LOWsetup/migrate.py69CODE
LOWsetup/migrate.py150CODE
LOWtests/tls.py70CODE
LOWmanagement/ssl_certificates.py12CODE
LOWmanagement/ssl_certificates.py172CODE
LOWmanagement/ssl_certificates.py240CODE
LOWmanagement/ssl_certificates.py24CODE
LOWmanagement/backup.py157CODE
LOWmanagement/backup.py441CODE
LOWmanagement/status_checks.py92CODE
LOWmanagement/status_checks.py333CODE
LOWmanagement/status_checks.py399CODE
LOWmanagement/status_checks.py538CODE
LOWmanagement/status_checks.py740CODE
LOWmanagement/status_checks.py1012CODE
LOWmanagement/dns_update.py175CODE
LOWmanagement/dns_update.py474CODE
LOWmanagement/dns_update.py671CODE
LOWmanagement/dns_update.py750CODE
LOWmanagement/dns_update.py803CODE
LOWmanagement/dns_update.py855CODE
LOWmanagement/dns_update.py890CODE
LOWmanagement/dns_update.py982CODE
LOWmanagement/dns_update.py1027CODE
LOWmanagement/mail_log.py63CODE
LOWmanagement/mail_log.py93CODE
LOWmanagement/mail_log.py326CODE
LOWmanagement/mail_log.py390CODE
LOWmanagement/mail_log.py421CODE
LOWmanagement/mail_log.py641CODE
LOWmanagement/web_update.py59CODE
LOWmanagement/web_update.py131CODE
LOWmanagement/mailconfig.py117CODE
LOWmanagement/mailconfig.py510CODE
LOWmanagement/daemon.py363CODE
Hyper-Verbose Identifiers23 hits · 24 pts
SeverityFileLineSnippetContext
LOWmanagement/auth.py36 def parse_http_authorization_basic(header):CODE
LOWmanagement/auth.py129 def create_user_password_state_token(self, email, env):CODE
LOWmanagement/ssl_certificates.py172def get_certificates_to_provision(env, limit_domains=None, show_valid_certs=True):CODE
LOWmanagement/ssl_certificates.py374def provision_certificates_cmdline():CODE
LOWmanagement/backup.py219def get_duplicity_additional_args(env):CODE
LOWmanagement/backup.py396def run_duplicity_verification():CODE
LOWmanagement/status_checks.py204def is_reboot_needed_due_to_package_installation():CODE
LOWmanagement/status_checks.py399def run_domain_checks_on_domain(domain, rounded_time, env, dns_domains, dns_zonefiles, mail_domains, web_domains, domainCODE
LOWmanagement/status_checks.py456def check_primary_hostname_dns(domain, env, output, dns_domains, dns_zonefiles):CODE
LOWmanagement/status_checks.py622def check_dns_zone_suggestions(domain, env, output, dns_zonefiles, domains_with_a_records):CODE
LOWmanagement/dns_update.py378def is_domain_cert_signed_and_valid(domain, env):CODE
LOWmanagement/mail_log.py541def scan_postfix_submission_line(date, log, collector):CODE
LOWmanagement/web_update.py51def get_domains_with_a_records(env):CODE
LOWmanagement/web_update.py59def get_web_domains_with_root_overrides(env):CODE
LOWmanagement/mailconfig.py57def sanitize_idn_email_address(email):CODE
LOWmanagement/mailconfig.py77def prettify_idn_email_address(email):CODE
LOWmanagement/mailconfig.py483def add_remove_mail_user_privilege(email, priv, action, env):CODE
LOWmanagement/daemon.py48def authorized_personnel_only(viewfunc):CODE
LOW⚡management/daemon.py299def dns_get_secondary_nameserver():CODE
LOW⚡management/daemon.py305def dns_set_secondary_nameserver():CODE
LOW⚡management/daemon.py565def system_latest_upstream_version():CODE
LOWmanagement/daemon.py686def check_request_cookie_for_admin_access():CODE
LOWmanagement/daemon.py693def authorized_personnel_only_via_cookie(f):CODE
Excessive Try-Catch Wrapping11 hits · 16 pts
SeverityFileLineSnippetContext
LOWsetup/migrate.py91 except Exception as e:CODE
MEDIUMsetup/migrate.py92 print("Error updating IDNA alias", email, e)CODE
LOWsetup/migrate.py248 except Exception as e:CODE
MEDIUMsetup/migrate.py250 print("Error running the migration script:")CODE
LOWmanagement/ssl_certificates.py364 except Exception as e:CODE
LOWmanagement/backup.py290 except Exception as e:CODE
LOW⚡management/daemon.py294 except Exception as e:CODE
LOW⚡management/daemon.py560 except Exception as e:CODE
LOW⚡management/daemon.py569 except Exception as e:CODE
LOWmanagement/daemon.py638 except Exception as e:CODE
MEDIUMmanagement/daemon.py171def logout():CODE
Fake / Example Data6 hits · 9 pts
SeverityFileLineSnippetContext
LOW⚡management/templates/aliases.html204 $('#addaliasAddress').attr('placeholder', 'you@yourdomain.com (incoming email address)');CODE
LOW⚡management/templates/aliases.html205 $('#addaliasForwardsTo').attr('placeholder', 'one address per line or separated by commas');CODE
LOW⚡management/templates/aliases.html210 $('#addaliasAddress').attr('placeholder', '@yourdomain.com (incoming catch-all domain)');CODE
LOW⚡management/templates/aliases.html211 $('#addaliasForwardsTo').attr('placeholder', 'one address per line or separated by commas');CODE
LOW⚡management/templates/aliases.html216 $('#addaliasAddress').attr('placeholder', '@yourdomain.com (incoming catch-all domain)');CODE
LOW⚡management/templates/aliases.html217 $('#addaliasForwardsTo').attr('placeholder', '@otherdomain.com (forward to other domain)');CODE
Redundant / Tautological Comments6 hits · 8 pts
SeverityFileLineSnippetContext
LOWtools/editconf.py93 # Check if this line contain this setting from the command-line arguments.COMMENT
LOWsetup/system.sh71 # Check if swap is mounted then activate on bootCOMMENT
LOWmanagement/backup.py162 # Check if day of week is a weekend dayCOMMENT
LOWmanagement/dns_update.py622 # Check if the file is changing. If it isn't changing,STRING
LOWmanagement/mail_log.py354 # Check if the found date is within the time span we are scanningCOMMENT
LOWmanagement/mail_log.py424 # Check if the incoming mail was rejectedCOMMENT
Cross-Language Confusion1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHmanagement/mailconfig.py250 # permitted_senders: ["user1@domain.com", "sender-only1@domain.com", ...] OR null,COMMENT
Modern Structural Boilerplate4 hits · 3 pts
SeverityFileLineSnippetContext
LOWmanagement/ssl_certificates.py516 if not isinstance(cert, Certificate): raise ValueError("This is not a certificate file.")CODE
LOWmanagement/backup.py592 if not isinstance(custom_config, dict): raise ValueError # caught belowCODE
LOWmanagement/dns_update.py807 if not isinstance(custom_dns, dict): raise ValueError # caught belowSTRING
LOWmanagement/utils.py40 if not isinstance(config, dict): raise ValueError # caught belowCODE
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOWtools/readable_bash.py8CODE