Optimized and Maintenance-free Kubernetes on Hetzner Cloud in one command!
This report presents the forensic synthetic code analysis of mysticaltech/terraform-hcloud-kube-hetzner, a HCL project with 3,875 GitHub stars. SynthScan v2.0 examined 35,585 lines of code across 117 source files, recording 124 pattern matches distributed across 8 syntactic categories. The overall adjusted score of 5.1 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 124 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 49 | ## Step 1: Identify the Server | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 55 | ## Step 2: Enable Rescue Mode & Reboot | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 65 | ## Step 3: SSH into Rescue | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 71 | ## Step 4: Mount the Filesystem | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 98 | ## Step 5: Diagnostic Checklist | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 211 | ## Step 6: Apply a Fix | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 232 | ## Step 7: Reboot to Normal | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 52 | ## Step 1: Format Check | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 61 | ## Step 2: Forbid null_resource Usage | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 75 | ## Step 3: Initialize Local Providers | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 84 | ## Step 4: Validate Module | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 93 | ## Step 5: Validate OpenTofu Compatibility | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 111 | ## Step 6: Validate `kube.tf.example` Parseability | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 169 | ## Step 7: Initialize Test Environment | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 178 | ## Step 8: Plan Against Test Cluster | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 218 | ## Step 9: Review Plan Output | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 41 | ## Step 1: Fetch Issue Details | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 51 | ## Step 2: Classify Issue Type | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 76 | ## Step 3: Check for Duplicates | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 89 | ## Step 4: Security Analysis | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 121 | ## Step 5: Draft Response | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 216 | ## Step 6: Recommend Action | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 60 | ## Step 1: Extract Variables from Source | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 72 | ## Step 2: Find Undocumented Variables | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 80 | ## Step 3: Generate Documentation | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 107 | ## Step 4: Update docs/llms.md | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 131 | ## Step 5: Update kube.tf.example | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 144 | ## Step 6: Update README if Needed | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 223 | ## Step 7: Verify Consistency | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 57 | ## Step 1: Fetch PR Details | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 73 | ## Step 2: Assess Author Risk | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 93 | ## Step 3: Analyze Changed Files | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 132 | ## Step 4: Security Review | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 167 | ## Step 5: Backward Compatibility | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 211 | ## Step 6: Code Quality | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 225 | ## Step 7: Release Classification | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 245 | ## Step 8: MANDATORY - Verify with Gemini and Codex | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 343 | ## Step 9: Final Recommendation | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 101 | ## Step 1: Analyze Changes | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 127 | ## Step 2: Classify Release Type | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 148 | ## Step 3: Update CHANGELOG.md | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 193 | ## Step 4: Update Version Badges | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 206 | ## Step 5: Update Knowledge File (if applicable) | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 220 | ## Step 6: Verify Release Notes Content | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 337 | ## Step 7: Commit Preparation | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 45 | ## Step 1: Fetch Issue Details | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 55 | ## Step 2: Classify Issue Type | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 82 | ## Step 3: Verify Before Fixing | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 100 | ## Step 4: Deep Investigation | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 139 | ## Step 5: Enter Plan Mode | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 151 | ## Step 6: Implement Fix | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 168 | ## Step 7: Test Changes | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 206 | ## Step 8: Commit & Push | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 106 | ## Step 1: Sync Branch and Run Gates | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 124 | ## Step 2: Kill Stale Runs and Clean State | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 170 | ## Step 3: Verify Snapshot Prerequisites | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 197 | ## Step 4: Run Matrix (Simple to Complex) | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 213 | ## Step 5: Proactive Debugging During Runs | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 267 | ## Step 6: Fix + Targeted Rerun Loop | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 292 | ## Step 7: Full Regression Rerun | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | locals.tf | 3406 | # Create the kube_hetzner_selinux.te file, that allows in SELinux to not interfere with various needed services | COMMENT |
| MEDIUM⚡ | locals.tf | 3416 | # Create the distribution-specific registries file before Kubernetes starts. | COMMENT |
| MEDIUM⚡ | locals.tf | 3423 | # Create the distribution-specific kubelet config file if needed. | COMMENT |
| MEDIUM | init.tf | 794 | # This method is a stub which could be replaced by a more practical helm implementation | COMMENT |
| MEDIUM | scripts/create.sh | 42 | # Create the folder if folder_name is provided | COMMENT |
| MEDIUM | modules/host/main.tf | 452 | # Creating the swap filesystem | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 21 | # - '--args=--only=terraform_documented_outputs' | COMMENT |
| LOW | docs/llms.md | 321 | **Section 2.1: `control_plane_nodepools` - The Brains of the Operation** | COMMENT |
| LOW | docs/llms.md | 361 | COMMENT | |
| LOW | docs/llms.md | 601 | --- | COMMENT |
| LOW | docs/llms.md | 741 | --- | COMMENT |
| LOW | docs/llms.md | 761 | # labels = { # Note: This is a map, not a list of strings like other labels | COMMENT |
| LOW | docs/llms.md | 841 | # The default is the official image from the Kubernetes project: registry.k8s.io/autoscaling/cluster-autoscaler | COMMENT |
| LOW | docs/llms.md | 901 | # | COMMENT |
| LOW | docs/llms.md | 1681 | * Performing other OS-level customizations needed before k3s starts. | COMMENT |
| LOW | docs/llms.md | 1701 | # groups: | COMMENT |
| LOW | docs/llms.md | 1881 | ```terraform | COMMENT |
| LOW | docs/llms.md | 2241 | # Useful when an external access/overlay network (ZeroTier, WireGuard, | COMMENT |
| LOW | docs/llms.md | 2261 | * **Tailscale Boundary:** Use `node_transport_mode = "tailscale"` when Tailscale should be the official Kubernetes nod | COMMENT |
| LOW | docs/llms.md | 2301 | # | COMMENT |
| LOW | docs/llms.md | 2421 | COMMENT | |
| LOW | docs/llms.md | 2441 | # | COMMENT |
| LOW | docs/llms.md | 3181 | # cert_manager_values = <<-EOT | COMMENT |
| LOW | docs/llms.md | 3201 | # replicas: 2 | COMMENT |
| LOW | docs/llms.md | 3241 | # nginx_values = <<-EOT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 179 | def _extract_configuration_keys(example: str) -> list[str]: | CODE |
| LOW | scripts/render_harness.py | 136 | def extract_addon_default_versions() -> dict[str, str]: | CODE |
| LOW | scripts/render_harness.py | 172 | def assert_addon_default_versions() -> None: | CODE |
| LOW | scripts/render_harness.py | 619 | def node_annotation_write_files(scratch: TerraformScratch) -> list[dict[str, str]]: | CODE |
| LOW | scripts/render_harness.py | 656 | def render_cloudinit_with_vars(render_vars: dict[str, Any], template_path: Path) -> tuple[str, Any]: | CODE |
| LOW | scripts/render_harness.py | 665 | def assert_node_annotation_payload(name: str, document: Any, rendered: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 730 | def run_node_annotation_cloudinit_checks(scratch: TerraformScratch) -> None: | CODE |
| LOW | scripts/render_harness.py | 785 | def run_autoscaler_manifest_checks(scratch: TerraformScratch) -> None: | CODE |
| LOW | scripts/render_harness.py | 980 | def run_kustomization_path_checks(scratch: TerraformScratch) -> None: | STRING |
| LOW | scripts/smoke_v3_plan_matrix.py | 158 | def discover_external_network_id(env: dict[str, str]) -> str | None: | STRING |
| LOW | scripts/contract_negative_tests.py | 149 | def provider_reachability_blocked(output: str) -> bool: | CODE |
| LOW | scripts/contract_negative_tests.py | 177 | def provider_rpc_sockets_available() -> bool: | CODE |
| LOW | scripts/v2_to_v3_migration_assistant.py | 248 | def collect_topology_warnings(root: Path) -> list[TopologyWarning]: | CODE |
| LOW | scripts/v2_to_v3_migration_assistant.py | 301 | def find_control_plane_network_id(root: Path) -> list[str]: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 73 | def extract_named_block_count(text: str, name: str) -> int: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 92 | def placement_groups_for_static_counts(*counts: int) -> int: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 96 | def validate_secure_tailscale_exposure(text: str, example_name: str) -> dict[str, bool]: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 4 | CODE | |
| LOW | scripts/smoke_v3_plan_matrix.py | 9 | CODE | |
| LOW | scripts/validate_v3_final_polish_examples.py | 4 | CODE | |
| LOW | scripts/contract_negative_tests.py | 4 | CODE | |
| LOW | scripts/contract_negative_tests.py | 13 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 8 | CODE | |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 13 | CODE | |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 22 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 41 | CODE | |
| LOW | scripts/sync_docs_site.py | 109 | CODE | |
| LOW | scripts/sync_docs_site.py | 146 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 211 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 301 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/terraform.md | 189 | | <a name="input_automatically_upgrade_os"></a> [automatically\_upgrade\_os](#input\_automatically\_upgrade\_os) | Wheth | CODE |
| MEDIUM | docs/terraform.md | 254 | | <a name="input_enable_kured"></a> [enable\_kured](#input\_enable\_kured) | Whether to include kured (the Kubernetes Re | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | locals.tf | 196 | # Check if the user has set custom DNS servers. | COMMENT |
| LOW | scripts/create.sh | 3 | # Check if terraform, packer and hcloud CLIs are present | COMMENT |