Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box.
This report presents the forensic synthetic code analysis of mail-in-a-box/mailinabox, a Python project with 15,362 GitHub stars. SynthScan v2.0 examined 21,120 lines of code across 85 source files, recording 205 pattern matches distributed across 11 syntactic categories. The overall adjusted score of 14.6 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 205 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | setup/munin.sh | 64 | # Create a systemd service for munin. | COMMENT |
| MEDIUM | setup/management.sh | 24 | # Create a virtualenv for the installation of Python 3 packages | COMMENT |
| MEDIUM | setup/management.sh | 54 | # Create a backup directory and a random key for encrypting backups. | COMMENT |
| MEDIUM | setup/management.sh | 85 | # Create an init script to start the management daemon and keep it | COMMENT |
| MEDIUM | setup/ssl.sh | 6 | # Create an RSA private key, a self-signed SSL certificate, and some | COMMENT |
| MEDIUM | setup/ssl.sh | 39 | # Create a directory to store TLS-related things like "SSL" certificates. | COMMENT |
| MEDIUM | setup/dkim.sh | 45 | # Create a new DKIM key. This creates mail.private and mail.txt | COMMENT |
| MEDIUM | setup/firstuser.sh | 50 | # Create the user's mail account. This will ask for a password if none was given above. | COMMENT |
| MEDIUM | setup/firstuser.sh | 56 | # Create an alias to which we'll direct all automatically-created administrative aliases. | COMMENT |
| MEDIUM | setup/web.sh | 102 | # Create the iOS/OS X Mobile Configuration file which is exposed via the | COMMENT |
| MEDIUM | setup/web.sh | 115 | # Create the Mozilla Auto-configuration file which is exposed via the | COMMENT |
| MEDIUM | setup/web.sh | 125 | # Create a generic mta-sts.txt file which is exposed via the | COMMENT |
| MEDIUM | setup/dns.sh | 49 | # Create a directory for additional configuration directives, including | COMMENT |
| MEDIUM | setup/dns.sh | 96 | # Create the Key-Signing Key (KSK) (with `-k`) which is the so-called | COMMENT |
| MEDIUM | setup/mail-users.sh | 20 | # Create an empty database if it doesn't yet exist. | COMMENT |
| MEDIUM | setup/webmail.sh | 105 | # Create a configuration file. | COMMENT |
| MEDIUM | setup/start.sh | 69 | # Create the STORAGE_USER and STORAGE_ROOT directory if they don't already exist. | COMMENT |
| MEDIUM | setup/nextcloud.sh | 127 | # Create a symlink to the config.php in STORAGE_ROOT (for upgrades we're restoring the symlink we previously | COMMENT |
| MEDIUM | setup/nextcloud.sh | 182 | # Create a backup directory to store the current installation and database to | COMMENT |
| MEDIUM | setup/nextcloud.sh | 255 | # Create an initial configuration file. | COMMENT |
| MEDIUM | setup/nextcloud.sh | 281 | # Create an auto-configuration file to fill in database settings | COMMENT |
| MEDIUM | management/auth.py | 130 | # Create a token that changes if the user's password or MFA options change | COMMENT |
| MEDIUM | management/auth.py | 143 | # Create a new session. | COMMENT |
| MEDIUM | management/ssl_certificates.py | 304 | # Create a CSR file for our master private key so that certbot | COMMENT |
| MEDIUM | management/backup.py | 271 | # Create an global exclusive lock so that the backup script | COMMENT |
| MEDIUM | management/dns_update.py | 135 | # Create a dictionary of domains to a set of attributes for each | COMMENT |
| MEDIUM | management/dns_update.py | 660 | # Create a stable (by sorting the items) hash of all of the private keys | STRING |
| MEDIUM | management/dns_update.py | 724 | # Create a DS record based on the patched-up key files. The DS record is specific to the | STRING |
| MEDIUM | management/daemon.py | 138 | # Create a session key by checking the username/password in the Authorization header. | COMMENT |
| MEDIUM | management/daemon.py | 590 | # Create a temporary pool of processes for the status checks | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/parse-nginx-log-bootstrap-accesses.py | 1 | #!/usr/bin/python3 | COMMENT |
| LOW | tools/editconf.py | 1 | #!/usr/bin/python3 | COMMENT |
| LOW | setup/zpush.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/management.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/spamassassin.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/spamassassin.sh | 41 | # check with: pyzor --homedir /etc/mail/spamassassin/pyzor ping | COMMENT |
| LOW | setup/spamassassin.sh | 61 | # content or execute scripts, and it is probably confusing to most users. | COMMENT |
| LOW | setup/spamassassin.sh | 121 | # ----------------- | COMMENT |
| LOW | setup/ssl.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/ssl.sh | 41 | mkdir -p "$STORAGE_ROOT/ssl" | COMMENT |
| LOW | setup/mail-postfix.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/mail-postfix.sh | 21 | # connections from users who can authenticate and then sends | COMMENT |
| LOW | setup/mail-postfix.sh | 41 | # always will. | COMMENT |
| LOW | setup/mail-postfix.sh | 81 | tools/editconf.py /etc/postfix/main.cf \ | COMMENT |
| LOW | setup/mail-postfix.sh | 121 | # Modify the `outgoing_mail_header_filters` file to use the local machine name and ip | COMMENT |
| LOW | setup/mail-postfix.sh | 161 | # relayed elsewhere. We don't want to be an "open relay". On outbound | COMMENT |
| LOW | setup/mail-postfix.sh | 181 | # for opportunistic encryption but "Intermediate" recommendations when DANE | COMMENT |
| LOW | setup/mail-postfix.sh | 221 | # Who can send mail to us? Some basic filters. | COMMENT |
| LOW | setup/mail-postfix.sh | 241 | smtpd_recipient_restrictions="permit_sasl_authenticated,permit_mynetworks,reject_rbl_client zen.spamhaus.org=127.0.0.[2 | COMMENT |
| LOW | setup/mail-dovecot.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/mail-dovecot.sh | 21 | COMMENT | |
| LOW | setup/mail-dovecot.sh | 41 | # can be allocated. It should be set *reasonably high* to avoid allocation | COMMENT |
| LOW | setup/mail-dovecot.sh | 121 | # are made available (IMAPS on port 993; POP3S on port 995). | COMMENT |
| LOW | setup/mail-dovecot.sh | 141 | COMMENT | |
| LOW | setup/mail-dovecot.sh | 181 | "postmaster_address=postmaster@$PRIMARY_HOSTNAME" | COMMENT |
| LOW | setup/dkim.sh | 41 | RequireSafeKeys false | COMMENT |
| LOW | setup/dkim.sh | 101 | # intercepts outgoing mail to perform the signing (by adding a mail header) | COMMENT |
| LOW | setup/web.sh | 21 | COMMENT | |
| LOW | setup/system.sh | 21 | # permissions (group writeable) set on the following directories. | COMMENT |
| LOW | setup/system.sh | 121 | # PPAs so we can install those packages later. | COMMENT |
| LOW | setup/system.sh | 161 | fi | COMMENT |
| LOW | setup/system.sh | 201 | # * DNSSEC signing keys (see `dns.sh`) | COMMENT |
| LOW | setup/system.sh | 221 | # entropy saved across boots to a local file" as well as the order of | COMMENT |
| LOW | setup/system.sh | 301 | # (This is unrelated to the box's public, non-recursive DNS server that | COMMENT |
| LOW | setup/system.sh | 321 | # | COMMENT |
| LOW | setup/system.sh | 381 | # On first installation, the log files that the jails look at don't all exist. | COMMENT |
| LOW | setup/functions.sh | 41 | # | COMMENT |
| LOW | setup/functions.sh | 81 | } | COMMENT |
| LOW | setup/functions.sh | 101 | # assigned to an interface. `ip route get` reports the | COMMENT |
| LOW | setup/bootstrap.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/dns.sh | 81 | # TLDs, registrars, and validating nameservers don't all support the same algorithms, | COMMENT |
| LOW | setup/dns.sh | 101 | # we're capturing into the `KSK` variable. | COMMENT |
| LOW | setup/dns.sh | 121 | # * `K_domain_.+007+08882.ds`: DS record normally provided to domain name registrar (but it's actually invalid with `_d | COMMENT |
| LOW | setup/mail-users.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/mail-users.sh | 81 | COMMENT | |
| LOW | setup/mail-users.sh | 121 | # SQL statement to check if we handle incoming mail for a user. | COMMENT |
| LOW | setup/mail-users.sh | 141 | # before postfix gets to the third query for catch-alls/domain alises. | COMMENT |
| LOW | setup/webmail.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/webmail.sh | 21 | # These dependencies are from `apt-cache showpkg roundcube-core`. | COMMENT |
| LOW | setup/start.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/start.sh | 61 | # Skip on existing installs since we don't want this to block the ability to | COMMENT |
| LOW | setup/questions.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/nextcloud.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/nextcloud.sh | 21 | # we automatically install intermediate versions as needed. | COMMENT |
| LOW | setup/nextcloud.sh | 41 | COMMENT | |
| LOW | setup/nextcloud.sh | 301 | chown -R www-data:www-data "$STORAGE_ROOT/owncloud" /usr/local/lib/owncloud | COMMENT |
| LOW | setup/nextcloud.sh | 441 | EOF | COMMENT |
| LOW | tests/tls.py | 1 | #!/usr/bin/python3 | COMMENT |
| LOW | management/auth.py | 81 | # The user is trying to log in with a username and a password | COMMENT |
| LOW | management/ssl_certificates.py | 101 | COMMENT | |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | setup/zpush.sh | 4 | # ---------------------------------------------- | COMMENT |
| MEDIUM | setup/spamassassin.sh | 3 | # ------------------------------------------- | COMMENT |
| MEDIUM | setup/spamassassin.sh | 16 | # ---------------------------------------- | COMMENT |
| MEDIUM | setup/spamassassin.sh | 72 | # --------------------------------------- | COMMENT |
| MEDIUM | setup/spamassassin.sh | 121 | # ----------------- | COMMENT |
| MEDIUM | setup/ssl.sh | 4 | # ------------------------------------------- | COMMENT |
| MEDIUM | setup/mail-postfix.sh | 4 | # -------------- | COMMENT |
| MEDIUM | setup/mail-dovecot.sh | 4 | # ---------------------- | COMMENT |
| MEDIUM | setup/system.sh | 6 | # ------------------------- | COMMENT |
| MEDIUM | setup/dns.sh | 3 | # ----------------------------------------------- | COMMENT |
| MEDIUM | setup/mail-users.sh | 4 | # ---------------------------------------------- | COMMENT |
| MEDIUM | setup/webmail.sh | 3 | # ---------------------- | COMMENT |
| MEDIUM | setup/nextcloud.sh | 16 | # -------------- | COMMENT |
| MEDIUM | setup/nextcloud.sh | 28 | # -------------- | COMMENT |
| MEDIUM | setup/nextcloud.sh | 51 | # ---------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/readable_bash.py | 299 | CODE | |
| LOW | tools/readable_bash.py | 402 | CODE | |
| LOW | setup/migrate.py | 69 | CODE | |
| LOW | setup/migrate.py | 150 | CODE | |
| LOW | tests/tls.py | 70 | CODE | |
| LOW | management/ssl_certificates.py | 12 | CODE | |
| LOW | management/ssl_certificates.py | 172 | CODE | |
| LOW | management/ssl_certificates.py | 240 | CODE | |
| LOW | management/ssl_certificates.py | 24 | CODE | |
| LOW | management/backup.py | 157 | CODE | |
| LOW | management/backup.py | 441 | CODE | |
| LOW | management/status_checks.py | 92 | CODE | |
| LOW | management/status_checks.py | 333 | CODE | |
| LOW | management/status_checks.py | 399 | CODE | |
| LOW | management/status_checks.py | 538 | CODE | |
| LOW | management/status_checks.py | 740 | CODE | |
| LOW | management/status_checks.py | 1012 | CODE | |
| LOW | management/dns_update.py | 175 | CODE | |
| LOW | management/dns_update.py | 474 | CODE | |
| LOW | management/dns_update.py | 671 | CODE | |
| LOW | management/dns_update.py | 750 | CODE | |
| LOW | management/dns_update.py | 803 | CODE | |
| LOW | management/dns_update.py | 855 | CODE | |
| LOW | management/dns_update.py | 890 | CODE | |
| LOW | management/dns_update.py | 982 | CODE | |
| LOW | management/dns_update.py | 1027 | CODE | |
| LOW | management/mail_log.py | 63 | CODE | |
| LOW | management/mail_log.py | 93 | CODE | |
| LOW | management/mail_log.py | 326 | CODE | |
| LOW | management/mail_log.py | 390 | CODE | |
| LOW | management/mail_log.py | 421 | CODE | |
| LOW | management/mail_log.py | 641 | CODE | |
| LOW | management/web_update.py | 59 | CODE | |
| LOW | management/web_update.py | 131 | CODE | |
| LOW | management/mailconfig.py | 117 | CODE | |
| LOW | management/mailconfig.py | 510 | CODE | |
| LOW | management/daemon.py | 363 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | management/auth.py | 36 | def parse_http_authorization_basic(header): | CODE |
| LOW | management/auth.py | 129 | def create_user_password_state_token(self, email, env): | CODE |
| LOW | management/ssl_certificates.py | 172 | def get_certificates_to_provision(env, limit_domains=None, show_valid_certs=True): | CODE |
| LOW | management/ssl_certificates.py | 374 | def provision_certificates_cmdline(): | CODE |
| LOW | management/backup.py | 219 | def get_duplicity_additional_args(env): | CODE |
| LOW | management/backup.py | 396 | def run_duplicity_verification(): | CODE |
| LOW | management/status_checks.py | 204 | def is_reboot_needed_due_to_package_installation(): | CODE |
| LOW | management/status_checks.py | 399 | def run_domain_checks_on_domain(domain, rounded_time, env, dns_domains, dns_zonefiles, mail_domains, web_domains, domain | CODE |
| LOW | management/status_checks.py | 456 | def check_primary_hostname_dns(domain, env, output, dns_domains, dns_zonefiles): | CODE |
| LOW | management/status_checks.py | 622 | def check_dns_zone_suggestions(domain, env, output, dns_zonefiles, domains_with_a_records): | CODE |
| LOW | management/dns_update.py | 378 | def is_domain_cert_signed_and_valid(domain, env): | CODE |
| LOW | management/mail_log.py | 541 | def scan_postfix_submission_line(date, log, collector): | CODE |
| LOW | management/web_update.py | 51 | def get_domains_with_a_records(env): | CODE |
| LOW | management/web_update.py | 59 | def get_web_domains_with_root_overrides(env): | CODE |
| LOW | management/mailconfig.py | 57 | def sanitize_idn_email_address(email): | CODE |
| LOW | management/mailconfig.py | 77 | def prettify_idn_email_address(email): | CODE |
| LOW | management/mailconfig.py | 483 | def add_remove_mail_user_privilege(email, priv, action, env): | CODE |
| LOW | management/daemon.py | 48 | def authorized_personnel_only(viewfunc): | CODE |
| LOW⚡ | management/daemon.py | 299 | def dns_get_secondary_nameserver(): | CODE |
| LOW⚡ | management/daemon.py | 305 | def dns_set_secondary_nameserver(): | CODE |
| LOW⚡ | management/daemon.py | 565 | def system_latest_upstream_version(): | CODE |
| LOW | management/daemon.py | 686 | def check_request_cookie_for_admin_access(): | CODE |
| LOW | management/daemon.py | 693 | def authorized_personnel_only_via_cookie(f): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup/migrate.py | 91 | except Exception as e: | CODE |
| MEDIUM | setup/migrate.py | 92 | print("Error updating IDNA alias", email, e) | CODE |
| LOW | setup/migrate.py | 248 | except Exception as e: | CODE |
| MEDIUM | setup/migrate.py | 250 | print("Error running the migration script:") | CODE |
| LOW | management/ssl_certificates.py | 364 | except Exception as e: | CODE |
| LOW | management/backup.py | 290 | except Exception as e: | CODE |
| LOW⚡ | management/daemon.py | 294 | except Exception as e: | CODE |
| LOW⚡ | management/daemon.py | 560 | except Exception as e: | CODE |
| LOW⚡ | management/daemon.py | 569 | except Exception as e: | CODE |
| LOW | management/daemon.py | 638 | except Exception as e: | CODE |
| MEDIUM | management/daemon.py | 171 | def logout(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | management/templates/aliases.html | 204 | $('#addaliasAddress').attr('placeholder', 'you@yourdomain.com (incoming email address)'); | CODE |
| LOW⚡ | management/templates/aliases.html | 205 | $('#addaliasForwardsTo').attr('placeholder', 'one address per line or separated by commas'); | CODE |
| LOW⚡ | management/templates/aliases.html | 210 | $('#addaliasAddress').attr('placeholder', '@yourdomain.com (incoming catch-all domain)'); | CODE |
| LOW⚡ | management/templates/aliases.html | 211 | $('#addaliasForwardsTo').attr('placeholder', 'one address per line or separated by commas'); | CODE |
| LOW⚡ | management/templates/aliases.html | 216 | $('#addaliasAddress').attr('placeholder', '@yourdomain.com (incoming catch-all domain)'); | CODE |
| LOW⚡ | management/templates/aliases.html | 217 | $('#addaliasForwardsTo').attr('placeholder', '@otherdomain.com (forward to other domain)'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/editconf.py | 93 | # Check if this line contain this setting from the command-line arguments. | COMMENT |
| LOW | setup/system.sh | 71 | # Check if swap is mounted then activate on boot | COMMENT |
| LOW | management/backup.py | 162 | # Check if day of week is a weekend day | COMMENT |
| LOW | management/dns_update.py | 622 | # Check if the file is changing. If it isn't changing, | STRING |
| LOW | management/mail_log.py | 354 | # Check if the found date is within the time span we are scanning | COMMENT |
| LOW | management/mail_log.py | 424 | # Check if the incoming mail was rejected | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | management/mailconfig.py | 250 | # permitted_senders: ["user1@domain.com", "sender-only1@domain.com", ...] OR null, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | management/ssl_certificates.py | 516 | if not isinstance(cert, Certificate): raise ValueError("This is not a certificate file.") | CODE |
| LOW | management/backup.py | 592 | if not isinstance(custom_config, dict): raise ValueError # caught below | CODE |
| LOW | management/dns_update.py | 807 | if not isinstance(custom_dns, dict): raise ValueError # caught below | STRING |
| LOW | management/utils.py | 40 | if not isinstance(config, dict): raise ValueError # caught below | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/readable_bash.py | 8 | CODE |