3.2

Adjusted Signal

3.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

2.7K

Stars

Rust

Language

283.2K

Lines of Code

1.6K

Files

1.1K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1042 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.2/100 · LOW

Are imports declared and package/API names verified? 15 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 18.3/100 · LOW

Which changes need focused human review? 1057 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 1MEDIUM 15LOW 1035

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1057 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1005 hits · 762 pts

Severity	File	Line	Snippet	Context
LOW	Cargo.toml	781		COMMENT
LOW	Cargo.toml	801	opt-level = 0	COMMENT
LOW	Cargo.toml	821	# '-Ztime-passes',	COMMENT
LOW	Cargo.toml	841	# '-Ztime-passes',	COMMENT
LOW	Cargo.toml	861	# '-Ztime-passes',	COMMENT
LOW	Cargo.toml	881	debug = 0	COMMENT
LOW	tuwunel-example.toml	1	### Tuwunel Configuration	COMMENT
LOW	tuwunel-example.toml	21	# The server_name is the pretty name of this server. It is used as a	COMMENT
LOW	tuwunel-example.toml	41	# media. Note: this was previously "/var/lib/matrix-conduit".	COMMENT
LOW	tuwunel-example.toml	61	# "::1"]	COMMENT
LOW	tuwunel-example.toml	81	# The UNIX socket tuwunel will listen on.	COMMENT
LOW	tuwunel-example.toml	101	#	COMMENT
LOW	tuwunel-example.toml	121	#	COMMENT
LOW	tuwunel-example.toml	141	# May be useful if you have significant memory to spare to increase	COMMENT
LOW	tuwunel-example.toml	161	# This defaults to 48.0 + (4.0 * CPU core count).	COMMENT
LOW	tuwunel-example.toml	181	# `authchainkey_authchain` column family: a room event's full auth	COMMENT
LOW	tuwunel-example.toml	201	# `shorteventid_cache_capacity`.	COMMENT
LOW	tuwunel-example.toml	221	# through a large missing-ancestry gap reads this column heavily.	COMMENT
LOW	tuwunel-example.toml	241		COMMENT
LOW	tuwunel-example.toml	261		COMMENT
LOW	tuwunel-example.toml	281	# room state (a list of short state-info entries per state hash), used	COMMENT
LOW	tuwunel-example.toml	301	#	COMMENT
LOW	tuwunel-example.toml	321	# will be clamped down to this value if larger.	COMMENT
LOW	tuwunel-example.toml	341	# configured to do so.	COMMENT
LOW	tuwunel-example.toml	361	#dns_min_ttl_nxdomain = 259200	COMMENT
LOW	tuwunel-example.toml	381	# useless DNS queries if the first nameserver responds with NXDOMAIN or	COMMENT
LOW	tuwunel-example.toml	401	#	COMMENT
LOW	tuwunel-example.toml	421	# these specific properties. This path does not support federation or	COMMENT
LOW	tuwunel-example.toml	441	#	COMMENT
LOW	tuwunel-example.toml	461	#max_response_size = "256 MiB"	COMMENT
LOW	tuwunel-example.toml	481	#	COMMENT
LOW	tuwunel-example.toml	501	# reloadable: yes	COMMENT
LOW	tuwunel-example.toml	521	# reloadable: yes	COMMENT
LOW	tuwunel-example.toml	541	# reloadable: yes	COMMENT
LOW	tuwunel-example.toml	561		COMMENT
LOW	tuwunel-example.toml	581	#request_gzip = true	COMMENT
LOW	tuwunel-example.toml	601	# `zstd_compression` feature.	COMMENT
LOW	tuwunel-example.toml	621	# below `federation_timeout` so an interactive request to an unresponsive	COMMENT
LOW	tuwunel-example.toml	641	#	COMMENT
LOW	tuwunel-example.toml	661	#	COMMENT
LOW	tuwunel-example.toml	681		COMMENT
LOW	tuwunel-example.toml	701	#	COMMENT
LOW	tuwunel-example.toml	721	# - "rightmost_x_forwarded_for" - nginx, Caddy	COMMENT
LOW	tuwunel-example.toml	741	# `ip_source` is unset. Each entry is CIDR notation, including	COMMENT
LOW	tuwunel-example.toml	761	# WARNING: Any peer in these subnets can forge the client IP via	COMMENT
LOW	tuwunel-example.toml	781	# `registration_token` or `registration_token_file`.	COMMENT
LOW	tuwunel-example.toml	801	# example: "o&^uCtes4HPf0Vu@F20jQeeWE7"	COMMENT
LOW	tuwunel-example.toml	821	# Use a high-entropy value (at least 32 bytes) and treat it as a	COMMENT
LOW	tuwunel-example.toml	841	# provisioning calls with. When set, the `/_synapse/mas/*` endpoints	COMMENT
LOW	tuwunel-example.toml	861	# Lowering this weakens the hash against parallel cracking hardware unless	COMMENT
LOW	tuwunel-example.toml	881	# Number of lanes an Argon2id working buffer is divided into.	COMMENT
LOW	tuwunel-example.toml	901	# - "invite": Any room created with `private_chat` or	COMMENT
LOW	tuwunel-example.toml	921	# the server does not hold locally, the server fetches it from a room	COMMENT
LOW	tuwunel-example.toml	941	# never raises one. 0 leaves the profiles unchanged.	COMMENT
LOW	tuwunel-example.toml	961	#	COMMENT
LOW	tuwunel-example.toml	981	#	COMMENT
LOW	tuwunel-example.toml	1001	# pacing entirely, pruning straight to the cap in one step.	COMMENT
LOW	tuwunel-example.toml	1021	# Rooms are fixed to the setting at the time of their creation and can	COMMENT
LOW	tuwunel-example.toml	1041		COMMENT
LOW	tuwunel-example.toml	1061		COMMENT
945 more matches not shown…

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	src/admin/server/regenerate_config.rs	24	paths: self.services.server.config_sources.paths.clone(),	CODE
CRITICAL	src/api/federation/well_known.rs	15	server: match services.server.config.well_known.server.as_ref() {	CODE
CRITICAL	src/service/oauth/server.rs	102	let has_cwk = args.server.config.well_known.client.is_some();	CODE
CRITICAL	src/service/oauth/providers.rs	229	&& let Some(server_url) = self.services.config.well_known.client.as_ref()	CODE
CRITICAL	src/service/admin/execute.rs	48	let smoketest = self.services.server.config.test.contains("smoke");	CODE
CRITICAL	src/service/admin/mod.rs	341	let Some(report_room) = self.services.server.config.report_room.as_ref() else {	CODE

AI Slop Vocabulary8 hits · 24 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/playwright.sh	31	# the harness does not provision (no-ops in docker/lib/playwright.tuwunel.ts):	COMMENT
MEDIUM	docker/playwright.sh	138	# nonzero status means the harness broke; in the single-pass shape it is	COMMENT
MEDIUM	docker/lib/complement-runner.sh	44	# resources (the patched harness reads COMPLEMENT_RUN_ID).	COMMENT
MEDIUM	src/main/tests/admin_revoke.rs	28	#[expect(dead_code)] // Only the user admin API is requested through the client harness.	COMMENT
MEDIUM	src/main/tests/appservice_request_error.rs	15	#[expect(dead_code)] // Only the readiness probe is used from the client harness.	COMMENT
MEDIUM	src/main/tests/email_registration_claim.rs	23	#[path = "email_registration_claim/harness.rs"]	COMMENT
MEDIUM	src/main/tests/smoke.rs	14	#[expect(dead_code)] // Only the readiness probe is used from the client harness.	COMMENT
MEDIUM	src/main/tests/appservice_unix_socket.rs	32	#[expect(dead_code)] // Only the readiness probe is used from the client harness.	COMMENT

Redundant / Tautological Comments15 hits · 22 pts

Severity	File	Line	Snippet	Context
LOW	tuwunel-example.toml	124	# Set this to any float value to multiply tuwunel's in-memory LRU caches	COMMENT
LOW	tuwunel-example.toml	137	# Set this to any float value in megabytes for tuwunel to tell the	COMMENT
LOW	tuwunel-example.toml	151	# Set this to any float value in megabytes for tuwunel to tell the	COMMENT
LOW	tuwunel-example.toml	1042	# Set this to true to require authentication on the normally	COMMENT
LOW	tuwunel-example.toml	1122	# Set this to true to allow your server's public room directory to be	COMMENT
LOW	tuwunel-example.toml	1131	# Set this to true to allow your server's public room directory to be	COMMENT
LOW	tuwunel-example.toml	1145	# Set this to false to limit results of rooms when searching by ID to	COMMENT
LOW	tuwunel-example.toml	1189	# Set this to true to lock down your server's public room directory and	COMMENT
LOW	tuwunel-example.toml	1196	# Set this to true to allow federating device display names / allow	COMMENT
LOW	tuwunel-example.toml	2203	# Set this to false if you run the server on btrfs or ZFS, and do not	COMMENT
LOW	tuwunel-example.toml	2370	# Set this to true for tuwunel to compress HTTP response bodies using	COMMENT
LOW	tuwunel-example.toml	2379	# Set this to true for tuwunel to compress HTTP response bodies using	COMMENT
LOW	tuwunel-example.toml	2391	# Set this to true for tuwunel to compress HTTP response bodies using	COMMENT
LOW	tuwunel-example.toml	3541	# Set this to true for excluding unencrypted rooms from the common-rooms	COMMENT
LOW	docs/deploying/docker-compose.with-traefik.yml	105	TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: # Set this to the email you want to receive certificate expi	CODE

Slop Phrases5 hits · 11 pts

Severity	File	Line	Snippet	Context
MEDIUM	tuwunel-example.toml	1891	# This is more secure, but if needed you can use traditional static	COMMENT
MEDIUM	tuwunel-example.toml	2068	# anything, you can try mode 3 (SkipAnyCorruptedRecord) but this will	COMMENT
MEDIUM	docs/deploying/docker-compose.with-traefik.yml	22	TUWUNEL_REGISTRATION_TOKEN: "" # This is a token you can use to register on the server	CODE
LOW	docs/deploying/docker-compose.for-traefik.yml	65	# name, don't forget to change it here and in the docker-compose.override.yml	COMMENT
LOW	docs/deploying/docker-compose.for-traefik.yml	65	# name, don't forget to change it here and in the docker-compose.override.yml	COMMENT

Fake / Example Data9 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	tuwunel-example.toml	3706	# example: "admin@example.com"	COMMENT
LOW	src/core/config/mod.rs	4461	/// example: "admin@example.com"	COMMENT
LOW	src/service/sending/sender/select/device_changes.rs	224	device_id: device_id!("placeholder").to_owned(),	CODE
LOW	src/service/threepid/pending.rs	549	address: "user@example.com".into(),	CODE
LOW	src/service/threepid/pending.rs	572	address: "user@example.com".into(),	CODE
LOW	src/main/tests/email_password_reset/scenarios.rs	44	const A_EMAIL: &str = "strass-reset@example.org";	CODE
LOW	src/main/tests/email_password_reset/scenarios.rs	58	const B_EMAIL: &str = "reset-b@example.org";	CODE
LOW	src/main/tests/email_password_reset/scenarios.rs	60	const C_EMAIL: &str = "reset-non-password@example.org";	CODE
LOW	src/main/tests/email_password_reset/scenarios.rs	133	"missing-reset@example.org",	CODE

Modern AI Meta-Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	tuwunel-example.toml	537	# wait is event-driven and wakes the instant the events arrive, so this is	COMMENT
MEDIUM	.github/workflows/summarise/grid.sh	3	# and Playwright): the rendering primitives plus the driver that orchestrates	COMMENT
MEDIUM	.github/workflows/summarise/grid.sh	119	# The orchestration shared by every grid summariser. A sourcing adapter sets the	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	src/matrix/room/state/resolution/events/member.rs	17	/// This is a type that deserializes each field lazily, as requested.	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	tuwunel-example.toml	1827	# Creating a session beyond this limit evicts the oldest session instead	COMMENT

Deep Nesting3 hits · 3 pts

Severity	File	Line	Context
LOW	.github/workflows/summarise/ci_timings.py	83	CODE
LOW	.github/workflows/summarise/complement_metrics.py	64	CODE
LOW	.github/workflows/summarise/complement_metrics.py	210	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	docker/seccomp-io-uring.sh	17	# Usage:	COMMENT

matrix-construct/tuwunel

Open-Source Code Quality, Security and Technical Debt Review