3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

26.6K

Stars

C++

Language

354.0K

Lines of Code

2.2K

Files

948

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 923 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 1.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 23 finding(s).

PR Review Velocity Impact 13.9/100 · LOW

Which changes need focused human review? 948 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 6MEDIUM 27LOW 912

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 948 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block903 hits · 903 pts

Severity	File	Line	Snippet	Context
LOW	…tallAndCheckCorrelation/InstallAndCheckCorrelation.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	tools/SampleWinGetUWPCaller/AppInstallerCaller/pch.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	tools/SampleWinGetUWPCaller/AppInstallerCaller/App.cpp	101	/// <summary>	COMMENT
LOW	tools/IndexComparisonTool/pch.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	tools/IndexComparisonTool/pch.h	21	#include <string>	COMMENT
LOW	tools/IndexComparisonTool/pch.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	samples/ConnectionValidationSample/Program.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	samples/WinGetUWPCaller/WinGetUWPCaller/pch.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	samples/WinGetUWPCaller/WinGetUWPCaller/pch.h	21	#include <mutex>	COMMENT
LOW	samples/WinGetUWPCaller/WinGetUWPCaller/MainPage.cpp	841	else if (uninstallResult)	COMMENT
LOW	samples/WinGetUWPCaller/WinGetUWPCaller/App.cpp	101	/// <summary>	COMMENT
LOW	.github/workflows/duplicate-surfacing.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"369c0dc7840b1b7153bc9e30f8e49b4853e89dee604895a38891567c547	COMMENT
LOW	.github/workflows/duplicate-surfacing.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/duplicate-surfacing.lock.yml	41	# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0	COMMENT
LOW	.github/workflows/spelling3.yml	1	# spelling.yml is blocked per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p	COMMENT
LOW	.github/workflows/spelling3.yml	21	#	COMMENT
LOW	.github/workflows/spelling3.yml	41	# Access to SARIF reports is generally restricted (by GitHub) to members of the repository.	COMMENT
LOW	.github/workflows/issue-closure-recommendation.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e6ba9bc689f737c53dda78254f68ee89b8b2cff3569a7337302a55c06a0	COMMENT
LOW	.github/workflows/issue-closure-recommendation.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/issue-closure-recommendation.lock.yml	41	# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)	COMMENT
LOW	.github/workflows/issue-closure-recommendation.lock.yml	761	id: pre_agent_audit	COMMENT
LOW	.github/actions/spelling/patterns.txt	81		COMMENT
LOW	doc/specs/#888 - Com Api.md	441	/// SAMPLE VALUES: For OpenWindowsCatalog "Microsoft.Winget.Source_8wekyb3d8bbwe"	COMMENT
LOW	doc/specs/#888 - Com Api.md	661	FindPackagesOptions();	COMMENT
LOW	src/binver/binver/version.h	1	#define STRINGIZE2(s) #s	COMMENT
LOW	src/binver/binver/version.h	21	#define VER_COPYRIGHT_STR "Copyright (c) Microsoft Corporation"	COMMENT
LOW	src/binver/binver/resource.h	1	//{{NO_DEPENDENCIES}}	COMMENT
LOW	…nitTests/ManifestUnitTest/ManifestEqualityUnitTests.cs	121	/// Manifest with all properties that provide equality.	COMMENT
LOW	…terop.UnitTests/ManifestUnitTest/V1ManifestReadTest.cs	541	#pragma warning disable SA1310 // FieldNamesMustNotContainUnderscore	COMMENT
LOW	…terop.UnitTests/ManifestUnitTest/V1ManifestReadTest.cs	561		COMMENT
LOW	src/AppInstallerTestExeInstaller/main.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/ComInprocTestbed/pch.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/ComInprocTestbed/pch.h	21	#include <string_view>	COMMENT
LOW	src/ComInprocTestbed/Tests.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/ComInprocTestbed/pch.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/Dependencies.cpp	1	#include "pch.h"	COMMENT
LOW	src/AppInstallerCLITests/PinFlow.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/pch.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/pch.h	21	#include <catch2/reporters/catch_reporter_registrars.hpp>	COMMENT
LOW	src/AppInstallerCLITests/pch.h	41	#include <fstream>	COMMENT
LOW	src/AppInstallerCLITests/WorkFlow.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/WorkflowCommon.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/TestCommon.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/CustomHeader.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/PortableInstaller.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/WorkflowGroupPolicy.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/SQLiteIndexDelta.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/PreIndexedPackageSource.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/PreIndexedPackageSource.cpp	1081	}	COMMENT
LOW	src/AppInstallerCLITests/PreIndexedPackageSource.cpp	1241	auto baselineWriteTime = test.StampBaselineWriteTime();	COMMENT
LOW	src/AppInstallerCLITests/ExperimentalFeature.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/UserSettings.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/YamlManifest.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/RestClient.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/TestHooks.h	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/CompositeSource.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/PromptFlow.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/InstallDependenciesFlow.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/ARPChanges.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	src/AppInstallerCLITests/RestInterface_1_7.cpp	1	// Copyright (c) Microsoft Corporation.	COMMENT
843 more matches not shown…

Decorative Section Separators22 hits · 70 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/WinGetLogViewer/media/viewer.js	10	// ── State ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	46	// ── DOM refs ─────────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	66	// ── Helpers ──────────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	153	// ── Filter logic ─────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	213	// ── Sidebar builder ──────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	353	// ── Virtual scroll renderer ───────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	452	// ── Scroll handler (virtual scroll repaint) ───────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	474	// ── Error navigation ─────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	497	// ── Option toggles ────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	513	// ── Search ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	523	// ── Level / Channel / Subchannel "All / None" buttons ────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	567	// ── Export ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/media/viewer.js	577	// ── Message handler (from extension host) ─────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/src/logViewerProvider.ts	21	// ── CustomReadonlyEditorProvider ────────────────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/src/logViewerProvider.ts	97	// ── Public: open any log file in a new panel ─────────────────────	COMMENT
MEDIUM	tools/WinGetLogViewer/src/logViewerProvider.ts	166	// ── HTML builder ─────────────────────────────────────────────────	COMMENT
MEDIUM	src/AppInstallerCLICore/Commands/DebugCommand.cpp	403	// ── LogViewerTestCommand ─────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AppInstallerCLICore/Commands/DebugCommand.cpp	434	// ── All five levels on CLI ────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AppInstallerCLICore/Commands/DebugCommand.cpp	441	// ── One Info entry on every channel ──────────────────────────────────	COMMENT
MEDIUM⚡	src/AppInstallerCLICore/Commands/DebugCommand.cpp	451	// ── Subchannel simulation (sub-component logs routed through CLI) ─────	COMMENT
MEDIUM	src/AppInstallerCLICore/Commands/DebugCommand.cpp	475	// ── Follow mode: stream log lines every 3 seconds ────────────────────	COMMENT
MEDIUM	src/AppInstallerCLICore/Commands/DebugCommand.cpp	716	// ── ValidateStorePinningCommand ──────────────────────────────────────────────	COMMENT

Synthetic Comment Markers6 hits · 45 pts

Severity	File	Line	Snippet	Context
HIGH	…ryCore/Microsoft/Schema/1_0/SearchResultsTable_1_0.cpp	78	// Create an insert statement to select values into the table as requested.	COMMENT
HIGH	…ryCore/Microsoft/Schema/2_0/SearchResultsTable_2_0.cpp	80	// Create an insert statement to select values into the table as requested.	COMMENT
HIGH	src/AppInstallerRepositoryCore/Rest/RestClient.cpp	170	// Cache the information value as requested	COMMENT
HIGH	…et.SharedLib/Resources/GroupPolicyResource.Designer.cs	3	// This code was generated by a tool.	COMMENT
HIGH	…t.Configuration.Engine/Resources/Resources.Designer.cs	3	// This code was generated by a tool.	COMMENT
HIGH	….WinGet.Client.Engine/Properties/Resources.Designer.cs	3	// This code was generated by a tool.	COMMENT

Hallucination Indicators3 hits · 30 pts

Severity	File	Line	Snippet	Context
CRITICAL	…c/AppInstallerCLIE2ETests/PowerShell/PowerShellHost.cs	65	var newModulePath = this.PowerShell.Runspace.SessionStateProxy.PSVariable.GetValue("env:PSModulePath") + $";	CODE
CRITICAL	…c/AppInstallerCLIE2ETests/PowerShell/PowerShellHost.cs	66	this.PowerShell.Runspace.SessionStateProxy.PSVariable.Set("env:PSModulePath", newModulePath);	CODE
CRITICAL	…nitTests/Tests/ConfigurationProcessorTelemetryTests.cs	190	Assert.Equal(testObjects.GetResult.ResultInformation.ResultCode.HResult.ToString(), runEvent.Properties[Tele	CODE

Slop Phrases4 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	src/AppInstallerCLITests/RestClient.cpp	65	// Update this test to next version so that we don't forget to add to supported versions before rest e2e tests are a	COMMENT
LOW	src/AppInstallerCLITests/TestHooks.h	30	// Don't forget to clear the overrides after use!	COMMENT
MEDIUM	src/AppInstallerCLICore/Argument.cpp	338	// Used for demonstration purposes	COMMENT
MEDIUM	src/AppInstallerCLICore/ExecutionArgs.h	197	// Used for demonstration purposes	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	…oryCore/Microsoft/PredefinedInstalledSourceFactory.cpp	320	// TODO: To support servicing, the initial implementation of update will simply leverage	COMMENT
MEDIUM	…sitoryCore/Microsoft/ConfigurableTestSourceFactory.cpp	30	// TODO: If this becomes more dynamic, refactor the UserSettings code to make it easier to leverage	COMMENT
MEDIUM	…nstallerCLICore/ConfigurationDynamicRuntimeFactory.cpp	44	// have this implementation leverage that one with an event handler for the packaged specifics.	COMMENT

Structural Annotation Overuse5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	doc/windows/package-manager/package/repository.md	31	### Step 1: Validate your manifest	COMMENT
LOW	doc/windows/package-manager/package/repository.md	41	### Step 2: Clone the repository	COMMENT
LOW	doc/windows/package-manager/package/repository.md	58	### Step 3: Add your manifest to the local repository	COMMENT
LOW	doc/windows/package-manager/package/repository.md	72	### Step 4: Submit your manifest to the remote repository	COMMENT
LOW	doc/windows/package-manager/package/repository.md	86	### Step 5: Create a pull request	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…stallerRepositoryCore/Public/winget/RepositorySearch.h	387	// Example usage:	COMMENT

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	src/AppInstallerCLITests/TestRestRequestHandler.h	6	class TestRestRequestHandler : public web::http::http_pipeline_stage	CODE

microsoft/winget-cli

Open-Source Code Quality, Security and Technical Debt Review