1.2

Adjusted Signal

1.2

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

14.9K

Stars

Language

89.5K

Lines of Code

813

Files

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 61 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.9/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 5.3/100 · LOW

Which changes need focused human review? 69 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 0MEDIUM 1LOW 65

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 69 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block38 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	…r/plugin/plg_authenticate_htpasswd/deps/crypt/crypt.go	21	type Crypter interface {	COMMENT
LOW	…icate_htpasswd/deps/crypt/sha256_crypt/sha256_crypt.go	1	// Copyright 2012, Jeramey Crawford <jeramey@antihe.ro>	COMMENT
LOW	…henticate_htpasswd/deps/crypt/apr1_crypt/apr1_crypt.go	1	// Copyright 2012, Jeramey Crawford <jeramey@antihe.ro>	COMMENT
LOW	…/plg_authenticate_htpasswd/deps/crypt/common/base64.go	1	// Copyright 2012, Jeramey Crawford <jeramey@antihe.ro>	COMMENT
LOW	…in/plg_authenticate_htpasswd/deps/crypt/common/salt.go	61	// length provided, and the rounds parameter set as specified.	COMMENT
LOW	…gin/plg_authenticate_htpasswd/deps/crypt/common/doc.go	1	// Copyright 2012, Jeramey Crawford <jeramey@antihe.ro>	COMMENT
LOW	…icate_htpasswd/deps/crypt/sha512_crypt/sha512_crypt.go	1	// Copyright 2012, Jeramey Crawford <jeramey@antihe.ro>	COMMENT
LOW	server/plugin/plg_image_c/utils.h	1	#define HAS_DEBUG 0	COMMENT
LOW	server/plugin/plg_image_c/image_raw.h	1	#include <stdio.h>	COMMENT
LOW	…ver/plugin/plg_image_light/deps/create_libtranscode.sh	61		COMMENT
LOW	server/plugin/plg_image_light/deps/create_libresize.sh	1	#!/bin/sh	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2321	OP_ILLEGAL Nfs_opnum4 = 10044	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2341	// void	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2361	// Opopen_confirm() *OPEN_CONFIRM4args	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2381	// Oprenew() *RENEW4args	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2401	// Opcreatesession() *CREATE_SESSION4args	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2421	// Opsequence() *SEQUENCE4args	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2441	// Opaccess() *ACCESS4res	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2461	// Oplockt() *LOCKT4res	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2481	// Opputpubfh() *PUTPUBFH4res	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2501	// Opsecinfo() *SECINFO4res	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2521	// Opgetdirdelegation() *GET_DIR_DELEGATION4res	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	2621	type Nfs_cb_argop4 struct {	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13721	// Types passed to the XDR Marshal method implementing the XdrType	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13741	// test the length of a slice.	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13761	// not, e.g., for primitive types that can't have methods	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13781	// sizes are passed as *XdrSize, which enforces the bound.	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13801	// implemented by a defined pointer type (since plain pointers	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13821	func XdrPanic(s string, args ...interface{}) {	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13861	//	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13941	XdrUnionTagName() string	COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	13961		COMMENT
LOW	server/plugin/plg_backend_nfs4/repo/internal/nfs4.go	14481	// returns a new instance of an appropriate XdrProc.	COMMENT
LOW	server/plugin/plg_widget_console/assets/commands.js	181	// description: "Print effective user name",	COMMENT
LOW	server/plugin/plg_widget_console/assets/commands.js	201	// });	COMMENT
LOW	server/plugin/plg_video_transcoder/libav/transcode.c	1	#include "transcode.h"	COMMENT
LOW	public/index.frontoffice.html	41	//	COMMENT
LOW	public/assets/index.js	1	// Want to create an integration via our SDK in your application? You are in the right place!	COMMENT

Hallucination Indicators3 hits · 30 pts

Severity	File	Line	Snippet	Context
CRITICAL	public/assets/pages/filespage/ctrl_upload.js	213	$task.firstElementChild.nextElementSibling.nextElementSibling.classList.add("hidden");	CODE
CRITICAL	public/assets/pages/filespage/ctrl_upload.js	225	$task.firstElementChild.nextElementSibling.nextElementSibling.classList.add("hidden");	CODE
CRITICAL	public/assets/pages/filespage/ctrl_upload.js	239	$task.firstElementChild.nextElementSibling.nextElementSibling.firstElementChild.remove();	CODE

Verbosity Indicators10 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	server/plugin/plg_backend_backblaze/index.go	284	// Step 1: find every files in a folder: b2_list_file_names	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	311	// Step 2: delete files 1 by 1: b2_delete_file_version	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	347	// Step 1: get the URL we will proceed to the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	370	// Step 2: perform the upload of the empty file	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	404	// Step 1: get the URL we will proceed to the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	427	// Step 2: get details backblaze requires to perform the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	459	// Step 3: perform the upload	COMMENT
LOW⚡	server/pkg/admin/handler.go	52	// Step 1: Deliberatly make the request slower to make hacking attempt harder for the attacker	COMMENT
LOW⚡	server/pkg/admin/handler.go	55	// Step 2: Make sure current user has appropriate access	COMMENT
LOW	server/pkg/admin/handler.go	69	// Step 3: Send response to the client	COMMENT

Structural Annotation Overuse10 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	server/plugin/plg_backend_backblaze/index.go	284	// Step 1: find every files in a folder: b2_list_file_names	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	311	// Step 2: delete files 1 by 1: b2_delete_file_version	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	347	// Step 1: get the URL we will proceed to the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	370	// Step 2: perform the upload of the empty file	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	404	// Step 1: get the URL we will proceed to the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	427	// Step 2: get details backblaze requires to perform the upload	COMMENT
LOW	server/plugin/plg_backend_backblaze/index.go	459	// Step 3: perform the upload	COMMENT
LOW⚡	server/pkg/admin/handler.go	52	// Step 1: Deliberatly make the request slower to make hacking attempt harder for the attacker	COMMENT
LOW⚡	server/pkg/admin/handler.go	55	// Step 2: Make sure current user has appropriate access	COMMENT
LOW	server/pkg/admin/handler.go	69	// Step 3: Send response to the client	COMMENT

Fake / Example Data5 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	…n/plg_widget_description/assets/sidebar_description.js	21	<textarea class="placeholder" name="text"></textarea>	CODE
LOW	server/plugin/plg_editor_onlyoffice/index.go	415	<div id="placeholder"></div>	CODE
LOW	server/plugin/plg_editor_onlyoffice/index.go	422	new DocsAPI.DocEditor("placeholder", {	CODE
LOW	public/assets/components/form.js	65	if (placeholder) attrs.push(($node) => $node.setAttribute("placeholder", placeholder));	CODE
LOW	public/assets/pages/filespage/thing.js	111	$placeholder.classList.add("placeholder");	CODE

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ges/adminpage/ctrl_storage_component_authentication.js	234	// to the new format which leverage the dom (= or the input name attribute to be precise) to store the e	COMMENT

Hyper-Verbose Identifiers2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	public/assets/pages/ctrl_sharepage.js	68	function ctrlEmailCodeVerification(render, { shareID, setState }) {	CODE
LOW	public/assets/pages/filespage/ctrl_submenu.js	436	function toggleDependingOnPermission(path, action) {	CODE

mickael-kerjean/filestash

Open-Source Code Quality, Security and Technical Debt Review