1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

19.4K

Stars

TypeScript

Language

202.7K

Lines of Code

1.4K

Files

211

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 195 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 16 finding(s).

Agent Over-Engineering Ratio 2.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 118 finding(s).

PR Review Velocity Impact 5.1/100 · LOW

Which changes need focused human review? 211 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 1LOW 210

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 211 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers118 hits · 121 pts

Severity	File	Line	Snippet	Context
LOW	crates/yaak-sse/summary.ts	12	export function candidateJsonPayloadsFromSseText(text: string): string[] {	CODE
LOW	crates/yaak-models/guest-js/store.ts	209	export async function changeModelStoreWorkspace(workspaceId: string \| null) {	CODE
LOW	crates/yaak-ws/index.ts	4	export function deleteWebsocketConnections(requestId: string) {	CODE
LOW	crates/yaak-plugins/index.ts	28	export async function installPluginFromDirectory(directory: string) {	CODE
LOW	crates/yaak-git/index.ts	48	function gitWorktreeStatusQueryKey(dir?: string, refreshKey?: string) {	CODE
LOW	crates/yaak-git/index.ts	54	export function invalidateGitWorktreeStatus(dir?: string) {	CODE
LOW	plugins/importer-postman-environment/src/index.ts	30	export function convertPostmanEnvironment(contents: string): ImportPluginResponse \| undefined {	CODE
LOW	plugins/importer-openapi/src/index.ts	498	function successResponseContentType(	CODE
LOW	plugins/importer-openapi/src/index.ts	599	function importOperationDescription({	CODE
LOW	plugins/importer-openapi/src/index.ts	767	function shouldInlinePathParameter(	CODE
LOW	plugins/importer-openapi/src/index.ts	1062	function serializeContentParameter(parameter: UnknownRecord, importState: ImportState): string {	CODE
LOW	plugins/importer-openapi/src/index.ts	1543	function schemaPropertiesToExample(	CODE
LOW	plugins/importer-openapi/src/index.ts	1684	function importSecurityRequirement({	CODE
LOW	plugins/importer-openapi/src/index.ts	1836	function registerAuthenticationVariable(	CODE
LOW	plugins/importer-openapi/src/index.ts	1993	function buildOAuthVariablesByScheme(	CODE
LOW	plugins/auth-bearer/src/index.ts	34	function generateAuthorizationHeader(values: CallHttpAuthenticationRequest["values"]) {	CODE
LOW	plugins/auth-oauth2/src/callbackServer.ts	183	export function buildHostedCallbackRedirectUri(localPort: number): string {	CODE
LOW	plugins/auth-oauth2/src/callbackServer.ts	209	export async function getRedirectUrlViaExternalBrowser(	CODE
LOW	plugins/auth-oauth2/src/callbackServer.ts	277	function getFragmentForwardingHtml(): string {	CODE
LOW	plugins/auth-oauth2/src/getOrRefreshAccessToken.ts	8	export async function getOrRefreshAccessToken(	CODE
LOW	plugins/auth-oauth2/src/grants/implicit.ts	100	async function getTokenViaEmbeddedBrowser(	CODE
LOW	plugins/auth-oauth2/src/grants/authorizationCode.ts	152	async function getCodeViaEmbeddedBrowser(	CODE
LOW	plugins/auth-digest/src/digest.ts	145	function unsupportedAlgorithmError(algorithm: string \| undefined): Error {	CODE
LOW	plugins/importer-curl/src/index.ts	228	function extractAuthenticationFromHeaders(headers: HttpUrlParameter[]): ExtractedAuthentication {	CODE
LOW	plugins/importer-curl/src/graphql.ts	70	function hasExtraGraphQLEnvelopeFields(body: Record<string, unknown>): boolean {	CODE
LOW	plugins/importer-curl/src/graphql.ts	75	function getGraphQLDetectionSignals(	CODE
LOW	packages/ui/src/components/editor/CodeEditor.tsx	600	function saveCachedEditorStateDebounced(stateKey: string \| null, state: EditorState) {	CODE
LOW	packages/ui/src/hooks/usePortal.ts	10	function getOrCreatePortal(name: string) {	CODE
LOW⚡	packages/theme/src/appearance.ts	31	export function subscribeToCSSAppearanceChange(cb: (appearance: Appearance) => void): () => void {	CODE
LOW⚡	packages/theme/src/appearance.ts	38	export function subscribeToWindowAppearanceChange(	CODE
LOW⚡	packages/theme/src/appearance.ts	44	export function subscribeToSystemAppearanceChange(	CODE
LOW	packages/theme/src/appearance.ts	58	export function subscribeToPreferredAppearance(cb: (appearance: Appearance) => void) {	CODE
LOW	packages/theme/src/appearance.ts	70	export function subscribeToPreferredAppearanceChange(cb: (appearance: Appearance) => void) {	CODE
LOW	packages/theme/src/window.ts	53	export function completeFullColorVariables(theme: Theme, cmp: Partial<CSSVariables>): CSSVariables {	CODE
LOW	packages/theme/src/window.ts	102	export function completePartialColorVariables(	CODE
LOW	packages/theme/src/window.ts	148	function templateTagColorVariables(theme: Theme, color: YaakColor): CSSVariables {	CODE
LOW	packages/theme/src/window.ts	183	function buttonSolidColorVariables(	CODE
LOW	packages/theme/src/window.ts	201	function buttonBorderColorVariables(	CODE
LOW	packages/common-lib/templateFunction.ts	7	export function validateTemplateFunctionArgs(	CODE
LOW	packages/plugin-runtime/src/migrations.ts	3	export function migrateTemplateFunctionSelectOptions(	CODE
LOW	.github/scripts/check-contribution-policy.js	767	function getManualPullRequestNumbers({ context, core }) {	CODE
LOW	apps/yaak-client/polyfills.ts	18	export function getOrInsert<K, V>(this: KeyedCollection<K, V>, key: K, value: V): V {	CODE
LOW	apps/yaak-client/polyfills.ts	25	export function getOrInsertComputed<K, V>(	CODE
LOW	apps/yaak-client/components/TemplateFunctionDialog.tsx	82	function InitializedTemplateFunctionDialog({	CODE
LOW	apps/yaak-client/components/CommercialUseBanner.tsx	90	async function shouldShowCommercialUsePrompt(): Promise<boolean> {	CODE
LOW	…ps/yaak-client/components/GrpcProtoSelectionDialog.tsx	23	function GrpcProtoSelectionDialogWithRequest({	CODE
LOW⚡	apps/yaak-client/components/ModelSettingsEditor.tsx	276	function modelSupportsHttpSettings(model: ModelWithSettings): model is ModelWithHttpSettings {	CODE
LOW⚡	apps/yaak-client/components/ModelSettingsEditor.tsx	280	function modelSupportsCookieSettings(model: ModelWithSettings): model is ModelWithCookieSettings {	CODE
LOW⚡	apps/yaak-client/components/ModelSettingsEditor.tsx	288	function modelSupportsMessageSizeSettings(	CODE
LOW	…ient/components/RecentWebsocketConnectionsDropdown.tsx	22	export function RecentWebsocketConnectionsDropdown({	CODE
LOW	apps/yaak-client/components/EnvironmentEditDialog.tsx	118	function EnvironmentEditDialogSidebar({	CODE
LOW	apps/yaak-client/components/Sidebar.tsx	855	function getSidebarSuggestionValue(ast: Ast \| null) {	CODE
LOW	…/yaak-client/components/EnvironmentActionsDropdown.tsx	18	export const EnvironmentActionsDropdown = memo(function EnvironmentActionsDropdown({	CODE
LOW	apps/yaak-client/components/CookieDialog.tsx	694	function defaultCookieExpiresInputValue() {	CODE
LOW	…yaak-client/components/ConfirmLargeResponseRequest.tsx	18	export function ConfirmLargeResponseRequest({ children, response }: Props) {	CODE
LOW	…s/yaak-client/components/RedirectToLatestWorkspace.tsx	12	export function RedirectToLatestWorkspace() {	CODE
LOW	…ps/yaak-client/components/HttpAuthenticationEditor.tsx	190	function AuthenticationTypeDropdown({ model }: Props) {	CODE
LOW	…ps/yaak-client/components/HttpAuthenticationEditor.tsx	217	function AuthenticationDisabledInput({	CODE
LOW	…ak-client/components/RecentGrpcConnectionsDropdown.tsx	22	export function RecentGrpcConnectionsDropdown({	CODE
LOW	…/yaak-client/components/EnvironmentSharableTooltip.tsx	3	export function EnvironmentSharableTooltip() {	CODE
58 more matches not shown…

Over-Commented Block66 hits · 66 pts

Severity	File	Line	Snippet	Context
LOW	crates-proxy/yaak-proxy-lib/src/lib.rs	661	// -- Request/response types --	COMMENT
LOW	crates-proxy/yaak-proxy-lib/src/lib.rs	781		COMMENT
LOW	crates-proxy/yaak-proxy-lib/src/models.rs	41	/// Bytes of the request body on the wire, captured or not.	COMMENT
LOW	crates-proxy/yaak-proxy-lib/src/flows.rs	21	/// Part of the host, any case: `stripe` matches `api.stripe.com`.	COMMENT
LOW	crates-proxy/yaak-proxy-lib/src/attribution.rs	1	//! Which app opened each client connection. The client's end of a connection to the engine is a	COMMENT
LOW	crates-server/yaak-web/index.ts	1	// The server's wire contract, generated by ts-rs from src/wire.rs	COMMENT
LOW	crates-server/yaak-web/src/config.rs	1	use clap::Parser;	COMMENT
LOW	crates-server/yaak-web/src/config.rs	21	#[arg(long, env = "PORT", default_value_t = 9227)]	COMMENT
LOW	crates-server/yaak-web/src/config.rs	61	#[arg(long, env = "YAAK_WEB_MAX_RESPONSE_BYTES", default_value_t = 64 * 1024 * 1024)]	COMMENT
LOW	crates-server/yaak-web/src/lib.rs	1	//! yaak-web: the network half of Yaak in a browser.	COMMENT
LOW	crates-server/yaak-web/src/lib.rs	101	// port in a browser guessed wrong about which of the two dev servers hosts the	COMMENT
LOW	crates-server/yaak-web/src/guard.rs	1	//! Where a send may go.	COMMENT
LOW	crates-server/yaak-web/src/wire.rs	1	//! What crosses the wire between a tab and this server.	COMMENT
LOW	crates-server/yaak-web/src/wire.rs	21	};	COMMENT
LOW	crates-server/yaak-web/src/wire.rs	61	version: Option<String>,	COMMENT
LOW	crates/yaak-models/src/query_manager.rs	1	use crate::client_db::{ClientDb, WriteDb};	COMMENT
LOW	crates/yaak-models/src/models.rs	2081		COMMENT
LOW	crates/yaak-models/src/models.rs	3301		COMMENT
LOW	crates/yaak-models/src/cookies.rs	1	//! Carrying a send's cookie changes back into a jar.	COMMENT
LOW	crates/yaak-models/src/queries/workspaces.rs	81	impl<'a> WriteDb<'a> {	COMMENT
LOW	crates/yaak/src/send.rs	341	}	COMMENT
LOW	crates/yaak/src/response_body.rs	1	//! Reading response bodies back out, by response id.	COMMENT
LOW	crates/yaak/src/response_body.rs	21	/// allocate on a plugin's say-so.	COMMENT
LOW	crates/yaak-templates/src/tag_scan.rs	1	use std::iter::Peekable;	COMMENT
LOW	crates/yaak-mcp/src/params.rs	81	#[serde(rename_all = "camelCase")]	COMMENT
LOW	crates/yaak-mcp/src/params.rs	101	#[schemars(description = "Request headers")]	COMMENT
LOW	crates/yaak-mcp/src/params.rs	121	#[serde(rename_all = "camelCase")]	COMMENT
LOW	crates/yaak-mcp/src/params.rs	141	#[serde(skip_serializing_if = "Option::is_none")]	COMMENT
LOW	crates/yaak-mcp/src/params.rs	181	pub struct CreateFolderParams {	COMMENT
LOW	crates/yaak-mcp/src/params.rs	201	pub authentication_type: Option<String>,	COMMENT
LOW	crates/yaak-mcp/src/params.rs	221	pub folder_id: Option<String>,	COMMENT
LOW	crates/yaak-tls/src/lib.rs	121	/// Whether the platform's native TLS stack should be handed PEM material as	COMMENT
LOW	crates/yaak-commands/tests/test_host.rs	161	/// A host that is deliberately not `Send` or `Sync`: it keeps its state in	COMMENT
LOW	crates/yaak-commands/src/host.rs	1	//! What a command needs from whatever is running it.	COMMENT
LOW	crates/yaak-commands/src/host.rs	81	///	COMMENT
LOW	crates/yaak-commands/src/lib.rs	1	//! Command handlers for the RPC surface, written against [`Host`] instead of	COMMENT
LOW	crates/common/yaak-database/src/pool.rs	1	//! Where connections come from.	COMMENT
LOW	crates/common/yaak-rpc-schema/index.ts	1	// The RPC wire schema, generated by ts-rs from the Rust declarations in	COMMENT
LOW	crates/common/yaak-rpc-schema/src/lib.rs	1	//! The wire schema for the app's RPC surface: every command name, its request	COMMENT
LOW	crates/common/yaak-rpc-schema/src/lib.rs	61	/// Returned by the two watch commands: the name of the event to emit to stop	COMMENT
LOW	crates/common/yaak-rpc-schema/src/lib.rs	181	#[ts(export, export_to = "gen_rpc.ts")]	COMMENT
LOW	crates/common/yaak-rpc-schema/src/lib.rs	941		COMMENT
LOW	crates/common/yaak-rpc/src/lib.rs	141	///	COMMENT
LOW	crates/common/yaak-rpc/src/lib.rs	221		COMMENT
LOW	crates/common/yaak-rpc/src/lib.rs	241	serde_json::to_value(res).map_err($crate::RpcError::from)	COMMENT
LOW	crates/yaak-plugins/src/events.rs	261	#[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]	COMMENT
LOW	crates/yaak-plugins/src/events.rs	441	#[serde(default, rename_all = "camelCase")]	COMMENT
LOW	crates/yaak-plugins/src/events.rs	1501	pub http_responses: Vec<HttpResponse>,	COMMENT
LOW	crates/yaak-plugins/src/events.rs	1521	#[ts(type = "number")]	COMMENT
LOW	crates/yaak-plugins/src/events.rs	1541	#[ts(export, export_to = "gen_events.ts")]	COMMENT
LOW	crates/yaak-plugins/src/manager.rs	1161	/// Bundled plugin directories that shipped in past versions and no longer exist. Updates	COMMENT
LOW	crates/yaak-wasm/index.ts	1	// The desktop's model layer, compiled to wasm for the browser. See src/lib.rs.	COMMENT
LOW	crates/yaak-wasm/src/lib.rs	1	//! The desktop's model layer, running in a browser.	COMMENT
LOW	crates/yaak-wasm/src/lib.rs	141	result: serde_json::Value,	COMMENT
LOW	crates/yaak-git/src/pull.rs	181	//	COMMENT
LOW	crates/yaak-git/src/pull.rs	201	// let fetch_commit = repo.reference_to_annotated_commit(&fetch_head)?;	COMMENT
LOW	flatpak/generate-sources.sh	1	#!/usr/bin/env bash	COMMENT
LOW	crates-tauri/yaak-proxy-helper/src/networksetup.rs	1	//! The macOS system proxy as `networksetup` sees it: the web and secure web proxies of each	COMMENT
LOW	crates-tauri/yaak-proxy-helper/src/networksetup.rs	61	self.http.points_at(port) \|\| self.https.points_at(port)	COMMENT
LOW	crates-tauri/yaak-app-client/index.ts	1	// ts-rs owns bindings/index.ts and rewrites it on export. What remains here	COMMENT
6 more matches not shown…

Fake / Example Data16 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	plugins/importer-openapi/src/index.ts	1583	email: "user@example.com",	CODE
LOW	plugins/action-copy-grpcurl/README.md	42	-d '{"name": "John Doe"}' \	CODE
LOW	plugins/action-copy-grpcurl/README.md	72	-d '{"email": "user@example.com"}' \	CODE
LOW	plugins/auth-digest/tests/index.test.ts	272	realm: "http-auth@example.org",	CODE
LOW	plugins/auth-digest/tests/index.test.ts	301	realm: "api@example.org",	CODE
LOW	plugins/auth-digest/tests/index.test.ts	332	realm: "legacy@example.org",	CODE
LOW⚡	plugins/auth-digest/tests/index.test.ts	355	realm: "second@example.org",	CODE
LOW⚡	plugins/auth-digest/tests/index.test.ts	358	decoyRealm: "first@example.org",	CODE
LOW⚡	plugins/auth-digest/tests/index.test.ts	364	values: { username: "user", password: "pass", realm: "second@example.org" },	CODE
LOW	plugins/auth-digest/tests/digest.test.ts	161	'Digest realm="http-auth@example.org", qop="auth, auth-int", algorithm=SHA-256, ' +	CODE
LOW	plugins/auth-digest/tests/digest.test.ts	164	'Digest realm="http-auth@example.org", qop="auth, auth-int", algorithm=MD5, ' +	CODE
LOW	plugins/auth-digest/tests/digest.test.ts	185	'Digest username="Mufasa", realm="http-auth@example.org", uri="/dir/index.html", ' +	CODE
LOW	plugins/auth-digest/tests/digest.test.ts	200	'Digest username="Mufasa", realm="http-auth@example.org", uri="/dir/index.html", ' +	CODE
LOW	plugins/action-copy-curl/README.md	49	"name": "John Doe",	CODE
LOW	plugins/template-function-prompt/src/index.ts	116	{ type: "text", name: "placeholder", label: "Input Placeholder", optional: true },	CODE
LOW	plugins-external/faker/README.md	67	\| `lorem` \| Lorem ipsum text \| `word`, `sentence`, `paragraph` \|	CODE

Verbosity Indicators4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	crates/yaak-git/src/pull.rs	51	// Step 1: fetch the specific branch	COMMENT
LOW	crates/yaak-git/src/pull.rs	83	// Step 2: merge the fetched branch	COMMENT
LOW	crates/yaak-git/src/pull.rs	117	// Step 1: fetch the remote	COMMENT
LOW	crates/yaak-git/src/pull.rs	131	// Step 2: reset --hard to remote/branch	COMMENT

Structural Annotation Overuse4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	crates/yaak-git/src/pull.rs	51	// Step 1: fetch the specific branch	COMMENT
LOW	crates/yaak-git/src/pull.rs	83	// Step 2: merge the fetched branch	COMMENT
LOW	crates/yaak-git/src/pull.rs	117	// Step 1: fetch the remote	COMMENT
LOW	crates/yaak-git/src/pull.rs	131	// Step 2: reset --hard to remote/branch	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates-server/yaak-web/Cargo.toml	10	# render + storage orchestration), yaak-plugins, or the RPC router: this crate	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	flatpak/update-manifest.sh	5	# Usage:	COMMENT
LOW	flatpak/generate-sources.sh	9	# Usage:	COMMENT

mountain-loop/yaak

Open-Source Code Quality, Security and Technical Debt Review