3.1

Adjusted Signal

3.1

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

7.9K

Stars

Rust

Language

64.8K

Lines of Code

164

Files

158

Pattern Hits

2026-10-31

Scan Date

0.03

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 139 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.1/100 · LOW

Are imports declared and package/API names verified? 7 finding(s).

Agent Over-Engineering Ratio 2.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 12 finding(s).

PR Review Velocity Impact 14.5/100 · LOW

Which changes need focused human review? 158 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 5MEDIUM 10LOW 143

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 158 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block139 hits · 139 pts

Severity	File	Line	Snippet	Context
LOW	tests/logging.rs	1	// Tests for logging functionality.	COMMENT
LOW	tests/system.rs	1	// System tests for compiling C code.	COMMENT
LOW	tests/sccache_rustc.rs	21	let _ = Command::from_std(std::process::Command::new(env!("CARGO_BIN_EXE_sccache")))	COMMENT
LOW	tests/integration/file-prefix-map/main.cpp	1	// Source for the -ffile-prefix-map test, see scripts/test-file-prefix-map.sh.	COMMENT
LOW	tests/integration/randomize_readdir/src/lib.rs	1	// Copyright 2024 Mozilla Foundation	COMMENT
LOW	tests/integration/randomize_readdir/src/lib.rs	21	//! entire directory into a vector, shuffle it, and store iteration	COMMENT
LOW	tests/integration/msvc-preprocessing/foo.cpp	1	// This tests sccache's ability to handle a known bug in cl.exe	COMMENT
LOW	tests/integration/cmake-hip/vectoradd_hip.cpp	21	*/	COMMENT
LOW	docs/Configuration.md	1	# Available Configuration Options	COMMENT
LOW	docs/Configuration.md	21	# Path matching is case-insensitive on Windows and case-sensitive on other OSes.	COMMENT
LOW	docs/Configuration.md	61	key_prefix = ""	COMMENT
LOW	docs/DistributedFreeBSD.md	41	# If unspecified the default is 10GB.	COMMENT
LOW	scripts/freebsd-ci-test.sh	1	#!/bin/sh	COMMENT
LOW	scripts/freebsd-ci-test.sh	21	#	COMMENT
LOW	.github/workflows/integration-tests.yml	221	# SCCACHE_GHA_ENABLED: "on"	COMMENT
LOW	benches/preprocessor_cache_bench.rs	1	// Copyright 2026 Mozilla	COMMENT
LOW	benches/sccache_bench.rs	1	// Copyright 2025 Mozilla	COMMENT
LOW	src/util.rs	1	// Copyright 2017 Mozilla Foundation	COMMENT
LOW	src/util.rs	201	overlap_buffer: [u8; MAX_HAYSTACK_LEN * 2],	COMMENT
LOW	src/util.rs	221	/// pattern we're looking for is `__TIMESTAMP__` to avoid copying the entire	COMMENT
LOW	src/util.rs	241	/// ```	COMMENT
LOW	src/util.rs	1261	// Find all potential matches for each basedir using fast substring search	COMMENT
LOW	src/util.rs	1341		COMMENT
LOW	src/util.rs	1361	/// * the whole argument, as in a source file or the path of a separated	COMMENT
LOW	src/util.rs	1561	result	COMMENT
LOW	src/cmdline.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/net.rs	1	// Licensed under the Apache License, Version 2.0 (the "License");	COMMENT
LOW	src/protocol.rs	61	/// Response for `Request::StorageGetRaw`: zip bytes on hit, `None` on miss.	COMMENT
LOW	src/client.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/config.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/config.rs	241	pub key_prefix: String,	COMMENT
LOW	src/config.rs	261	/// See other flags below for more control over this behavior.	COMMENT
LOW	src/config.rs	401	#[serde(default)]	COMMENT
LOW	src/lib.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/mock_command.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/mock_command.rs	21	//! Instead of using `Command::new()`, make your code generic using	COMMENT
LOW	src/mock_command.rs	101	I: IntoIterator<Item = (K, V)>,	COMMENT
LOW	src/server.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/server.rs	821	/// Access mode selected when this service was constructed.	COMMENT
LOW	src/server.rs	841	/// can mock this out.	COMMENT
LOW	src/server.rs	2381	{	COMMENT
LOW	src/commands.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/errors.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/main.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/jobserver.rs	21	// cargo or make process can't terminate until the sccache server terminates	COMMENT
LOW	src/cache/cache.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/cache/cache.rs	61	}	COMMENT
LOW	src/cache/cache.rs	121	/// - `Ok(CacheMode::ReadWrite)` means cache can do both `get` and `put`.	COMMENT
LOW	src/cache/cache.rs	261		COMMENT
LOW	src/cache/multilevel.rs	1	// Copyright 2026 Mozilla Foundation	COMMENT
LOW	src/cache/cos.rs	1	// Licensed under the Apache License, Version 2.0 (the "License");	COMMENT
LOW	src/cache/ipc_storage.rs	1	// Licensed under the Apache License, Version 2.0 (the "License");	COMMENT
LOW	src/cache/azure.rs	1	// Copyright 2018 Benjamin Bader	COMMENT
LOW	src/cache/azure.rs	21		COMMENT
LOW	src/cache/azure.rs	41	/// `Authorization: Bearer <token>` header. Supported credential sources,	COMMENT
LOW	src/cache/azure.rs	101	///	COMMENT
LOW	src/cache/readonly.rs	1	// Licensed under the Apache License, Version 2.0 (the "License");	COMMENT
LOW	src/cache/gcs.rs	1	// Copyright 2017 Mozilla Foundation	COMMENT
LOW	src/cache/memcached.rs	1	// Copyright 2016 Mozilla Foundation	COMMENT
LOW	src/cache/webdav.rs	1	// Licensed under the Apache License, Version 2.0 (the "License");	COMMENT
79 more matches not shown…

Decorative Section Separators10 hits · 30 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	101	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	103	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	121	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	123	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	159	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	161	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	203	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	205	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	250	# ============================================================================	COMMENT
MEDIUM	tests/integration/scripts/test-multilevel-chain.sh	252	# ============================================================================	COMMENT

Magic Placeholder Names5 hits · 25 pts

Severity	File	Line	Snippet	Context
HIGH	docs/Distributed.md	116	scheduler_auth = { type = "jwt_token", token = "YOUR_TOKEN_HERE" }	CODE
HIGH	docs/Distributed.md	133	server_auth = { type = "token", token = "YOUR_TOKEN_HERE" }	CODE
HIGH	docs/Distributed.md	139	scheduler_auth = { type = "token", token = "YOUR_TOKEN_HERE" }	CODE
HIGH	docs/Distributed.md	238	client_auth = { type = "token", token = "YOUR_TOKEN_HERE" }	CODE
HIGH	docs/Distributed.md	244	auth = { type = "token", token = "YOUR_TOKEN_HERE" }	CODE

Excessive Try-Catch Wrapping2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tests/integration/scripts/test-multilevel.sh	28	except Exception as e:	CODE
LOW	tests/integration/scripts/test-multilevel-chain.sh	36	except Exception as e:	CODE

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	src/bin/sccache-dist/main.rs	131	let dummy_key = jwt::DecodingKey::from_secret(b"secret");	CODE
LOW	src/bin/sccache-dist/main.rs	132	jwt::decode::<ServerJwt>(server_token, &dummy_key, &validation)	CODE

mozilla/sccache

Open-Source Code Quality, Security and Technical Debt Review