Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust.
This report summarizes scanner evidence for microsoft/msquic, a C project with 4,793 GitHub stars. SynthScan examined 256,174 lines of code across 535 source files, recording 583 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 2.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 582 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 583 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 583 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmake/openssl-prefix-rename.sh | 1 | #!/bin/bash | COMMENT |
| LOW | cmake/openssl-prefix-rename.sh | 21 | # | COMMENT |
| LOW | cmake/openssl-prefix-rename.sh | 61 | gen-syms) | COMMENT |
| LOW | .github/workflows/build-reuse-unix.yml | 21 | # - Debug | COMMENT |
| LOW | .github/workflows/wan-perf.yml | 1 | name: WAN Perf | COMMENT |
| LOW | src/inc/quic_var_int.h | 21 | // 00 1 byte | COMMENT |
| LOW | src/inc/msquic_winkernel.h | 41 | COMMENT | |
| LOW | src/inc/msquic_winkernel.h | 61 | #endif | COMMENT |
| LOW | src/inc/msquic_winkernel.h | 81 | #endif | COMMENT |
| LOW | src/inc/msquic_winkernel.h | 101 | #define QUIC_STATUS_INVALID_STATE STATUS_INVALID_DEVICE_STATE // 0xc0000184 | COMMENT |
| LOW | src/inc/msquic_winkernel.h | 121 | COMMENT | |
| LOW | src/inc/quic_platform_winkernel.h | 21 | #endif | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 41 | #include <ntverp.h> | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 81 | #else | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 141 | COMMENT | |
| LOW | src/inc/quic_platform_winkernel.h | 181 | COMMENT | |
| LOW | src/inc/quic_platform_winkernel.h | 201 | #define CXPLAT_DBG_ASSERTMSG(_exp, _msg) CXPLAT_ASSERT_CRASH(_exp, CXPLAT_WIDE_STRING(_msg)) | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 221 | CXPLAT_ASSERT_NOOP(_exp, CXPLAT_WIDE_STRING(_msg)) | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 241 | COMMENT | |
| LOW | src/inc/quic_platform_winkernel.h | 361 | #define CxPlatDispatchLockAcquire(Lock) (Lock)->PrevIrql = KeAcquireSpinLockRaiseToDpc(&(Lock)->SpinLock) | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 381 | #define CxPlatDispatchRwLockAcquireExclusive(Lock, PrevIrql) KIRQL PrevIrql = ExAcquireSpinLockExclusive(Lock) | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 961 | #define CxPlatRundownInitialize(Rundown) ExInitializeRundownProtection(Rundown) | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 981 | ); | COMMENT |
| LOW | src/inc/quic_platform_winkernel.h | 1001 | #define QuicSiloGetHostSilo() PsGetHostSilo() | COMMENT |
| LOW | src/inc/quic_platform.h | 21 | COMMENT | |
| LOW | src/inc/quic_platform.h | 41 | #define US_TO_MS(x) ((x) / 1000) | COMMENT |
| LOW | src/inc/quic_platform.h | 81 | COMMENT | |
| LOW | src/inc/quic_platform.h | 101 | #define QUIC_POOL_SENDBUF '21cQ' // Qc12 - QUIC Send Buffer | COMMENT |
| LOW | src/inc/quic_platform.h | 121 | #define QUIC_POOL_TLS_EXTRAS '62cQ' // Qc26 - QUIC Platform TLS Extra Data | COMMENT |
| LOW | src/inc/quic_platform.h | 141 | #define QUIC_POOL_SEND_REQUEST 'A3cQ' // Qc3A - QUIC Send Request | COMMENT |
| LOW | src/inc/quic_platform.h | 181 | #define CX_PLATFORM_TYPE 2 | COMMENT |
| LOW | src/inc/msquic.h | 21 | #ifndef _MSQUIC_ | COMMENT |
| LOW | src/inc/msquic.h | 41 | #if defined(__cplusplus) | COMMENT |
| LOW | src/inc/msquic.h | 61 | COMMENT | |
| LOW | src/inc/msquic.h | 981 | #define QUIC_PARAM_PREFIX_TLS_SCHANNEL 0x07000000 | COMMENT |
| LOW | src/inc/msquic.h | 1001 | #define QUIC_PARAM_GLOBAL_LIBRARY_GIT_HASH 0x01000008 // char[64] | COMMENT |
| LOW | src/inc/msquic.h | 1021 | #define QUIC_PARAM_CONFIGURATION_TICKET_KEYS 0x03000001 // QUIC_TICKET_KEY_CONFIG[] | COMMENT |
| LOW | src/inc/msquic.h | 1041 | #endif | COMMENT |
| LOW | src/inc/msquic.h | 1061 | #define QUIC_PARAM_CONN_DATAGRAM_SEND_ENABLED 0x0500000E // uint8_t (BOOLEAN) | COMMENT |
| LOW | src/inc/msquic.h | 1101 | #endif | COMMENT |
| LOW | src/inc/quic_trace_manifested_etw.h | 21 | // Defining MCGEN_PRIVATE_ENABLE_CALLBACK_V2, makes McGenControlCallbackV2 | COMMENT |
| LOW | src/inc/msquic.hpp | 21 | Linux User mode | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 21 | #endif | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 41 | #include <ws2ipdef.h> | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 61 | #define DEBUG 1 | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 101 | #define QUIC_NO_SANITIZE(X) | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 161 | // CXPLAT_FRE_ASSERT - Asserts that must always crash the system. | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 201 | #endif | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 541 | // | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 561 | #define CxPlatRwLockInitialize(Lock) InitializeSRWLock(Lock) | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 581 | #if defined(_X86_) || defined(_AMD64_) | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 601 | #endif | COMMENT |
| LOW | src/inc/quic_platform_winuser.h | 1221 | #define CxPlatThreadWait(Thread) WaitForSingleObject(*(Thread), INFINITE) | COMMENT |
| LOW | src/inc/quic_storage.h | 81 | COMMENT | |
| LOW | src/inc/quic_toeplitz.h | 21 | // | COMMENT |
| LOW | src/inc/quic_toeplitz.h | 41 | #define CXPLAT_TOEPLITZ_OUPUT_SIZE sizeof(uint32_t) | COMMENT |
| LOW | src/inc/quic_versions.h | 21 | #define QUIC_VERSION_DRAFT_29 0x1d0000ffU // IETF draft 29 | COMMENT |
| LOW | src/inc/quic_datapath.h | 21 | #pragma warning(disable:4200) // nonstandard extension used: zero-sized array in struct/union | COMMENT |
| LOW | src/inc/quic_datapath.h | 81 | #define CXPLAT_ECN_FROM_TOS(ToS) (CXPLAT_ECN_TYPE)((ToS) & 0x3) | COMMENT |
| LOW | src/inc/quic_datapath.h | 241 | // The data buffer containing the received bytes. | COMMENT |
| 512 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/core/stream_send.c | 175 | // Essentially, Reset trumps Reliable Reset, so if we have to call shutdown again, we reset. | COMMENT |
| MEDIUM | src/core/stream.h | 39 | #define QUIC_STREAM_SHUTDOWN_SILENT 0x8000 // Used in conjunction with the abort flags. | COMMENT |
| MEDIUM | src/core/unittest/CubicTest.cpp | 548 | // when the application doesn't fully utilize the window (BytesInFlightMax stays | COMMENT |
| MEDIUM | src/test/lib/ApiTest.cpp | 1331 | // Don't create it on the stack so we can leverage the "AutoDelete" clean up behavior on shutdown complete. | COMMENT |
| MEDIUM | src/platform/datapath_linux.c | 94 | // everything **actually** works, so that we can be sure we can leverage | COMMENT |
| MEDIUM | src/platform/datapath_iouring.c | 1222 | // this should be made more robust. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/platform/tls_openssl.c | 1337 | // a TLS session ticket. In this implementation, it performs no action and | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/cargo.yml | 107 | # Create the crate package (source tarball) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/docker-script.sh | 27 | # Check if this is dnf5 (Fedora 42+) which has different syntax | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/platform/selfsign_openssl.c | 552 | #define TEST_PASS "placeholder" | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/rs/lib.rs | 70 | // TODO: implement Addr content debug string | COMMENT |