Optimized and Maintenance-free Kubernetes on Hetzner Cloud in one command!
This report presents the forensic synthetic code analysis of mysticaltech/terraform-hcloud-kube-hetzner, a HCL project with 3,922 GitHub stars. SynthScan v2.0 examined 43,170 lines of code across 159 source files, recording 143 pattern matches distributed across 9 syntactic categories. The overall adjusted score of 4.8 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 143 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 49 | ## Step 1: Identify the Server | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 55 | ## Step 2: Enable Rescue Mode & Reboot | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 65 | ## Step 3: SSH into Rescue | COMMENT |
| LOW⚡ | .claude/skills/debug-node/SKILL.md | 71 | ## Step 4: Mount the Filesystem | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 98 | ## Step 5: Diagnostic Checklist | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 211 | ## Step 6: Apply a Fix | COMMENT |
| LOW | .claude/skills/debug-node/SKILL.md | 232 | ## Step 7: Reboot to Normal | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 52 | ## Step 1: Format Check | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 61 | ## Step 2: Forbid null_resource Usage | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 75 | ## Step 3: Initialize Local Providers | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 84 | ## Step 4: Validate Module | COMMENT |
| LOW⚡ | .claude/skills/test-changes/SKILL.md | 93 | ## Step 5: Validate OpenTofu Compatibility | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 111 | ## Step 6: Validate `kube.tf.example` Parseability | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 169 | ## Step 7: Initialize Test Environment | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 178 | ## Step 8: Plan Against Test Cluster | COMMENT |
| LOW | .claude/skills/test-changes/SKILL.md | 218 | ## Step 9: Review Plan Output | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 41 | ## Step 1: Fetch Issue Details | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 51 | ## Step 2: Classify Issue Type | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 76 | ## Step 3: Check for Duplicates | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 89 | ## Step 4: Security Analysis | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 121 | ## Step 5: Draft Response | COMMENT |
| LOW | .claude/skills/triage-issue/SKILL.md | 216 | ## Step 6: Recommend Action | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 66 | ## Step 1: Extract Variables from Source | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 78 | ## Step 2: Find Undocumented Variables | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 87 | ## Step 3: Generate Documentation | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 114 | ## Step 4: Update docs/llms.md | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 138 | ## Step 5: Update kube.tf.example | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 152 | ## Step 6: Update README if Needed | COMMENT |
| LOW | .claude/skills/sync-docs/SKILL.md | 244 | ## Step 7: Verify Consistency | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 57 | ## Step 1: Fetch PR Details | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 73 | ## Step 2: Assess Author Risk | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 93 | ## Step 3: Analyze Changed Files | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 132 | ## Step 4: Security Review | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 161 | ## Step 5: Backward Compatibility | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 205 | ## Step 6: Code Quality | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 219 | ## Step 7: Release Classification | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 239 | ## Step 8: MANDATORY - Independent Verification | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 312 | ## Step 9: Final Recommendation | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 105 | ## Step 1: Analyze Changes | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 125 | ## Step 2: Classify Release Type | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 144 | ## Step 3: Update CHANGELOG.md | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 189 | ## Step 4: Update Version Badges | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 202 | ## Step 5: Update Knowledge File (if applicable) | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 216 | ## Step 6: Verify Release Notes Content | COMMENT |
| LOW | .claude/skills/prepare-release/SKILL.md | 351 | ## Step 7: Commit Preparation | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 45 | ## Step 1: Fetch Issue Details | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 55 | ## Step 2: Classify Issue Type | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 82 | ## Step 3: Verify Before Fixing | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 100 | ## Step 4: Deep Investigation | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 133 | ## Step 5: Enter Plan Mode | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 145 | ## Step 6: Implement Fix | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 162 | ## Step 7: Test Changes | COMMENT |
| LOW | .claude/skills/fix-issue/SKILL.md | 200 | ## Step 8: Commit & Push | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 106 | ## Step 1: Sync Branch and Run Gates | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 123 | ## Step 2: Kill Stale Runs and Clean State | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 169 | ## Step 3: Verify Snapshot Prerequisites | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 206 | ## Step 4: Run Matrix (Simple to Complex) | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 222 | ## Step 5: Proactive Debugging During Runs | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 313 | ## Step 6: Fix + Targeted Rerun Loop | COMMENT |
| LOW | .claude/skills/running-stabilization-loop/SKILL.md | 338 | ## Step 7: Full Regression Rerun | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 48 | def _rewrite_repo_relative_links(markdown: str) -> str: | CODE |
| LOW | scripts/sync_docs_site.py | 205 | def _extract_configuration_keys(example: str) -> list[str]: | CODE |
| LOW | scripts/render_harness.py | 136 | def extract_addon_default_versions() -> dict[str, str]: | CODE |
| LOW | scripts/render_harness.py | 172 | def assert_addon_default_versions() -> None: | CODE |
| LOW | scripts/render_harness.py | 293 | def assert_opensuse_ssh_cloudinit_contract() -> None: | CODE |
| LOW | scripts/render_harness.py | 325 | def assert_baked_selinux_package_contract() -> None: | CODE |
| LOW | scripts/render_harness.py | 352 | def assert_kubernetes_artifact_architecture_contract() -> None: | CODE |
| LOW | scripts/render_harness.py | 656 | def run_autoscaler_overlay_retry_simulation(overlay_script: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 758 | def run_post_install_readiness_deployment_retry_simulation(script: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 833 | def run_post_install_readiness_deadline_simulation(script: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 963 | def run_autoscaler_standard_node_ip_simulation(node_ip_script: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 1045 | def run_autoscaler_standard_public_fallback_failure_simulation(node_ip_script: str) -> None: | CODE |
| LOW | scripts/render_harness.py | 1117 | def run_autoscaler_standard_node_ip_checks() -> None: | CODE |
| LOW | scripts/render_harness.py | 1158 | def run_autoscaler_tailscale_bootstrap_scope_checks() -> None: | CODE |
| LOW | scripts/render_harness.py | 1255 | def node_annotation_write_files(scratch: TerraformScratch) -> list[dict[str, str]]: | STRING |
| LOW | scripts/render_harness.py | 1292 | def render_cloudinit_with_vars(render_vars: dict[str, Any], template_path: Path) -> tuple[str, Any]: | STRING |
| LOW | scripts/render_harness.py | 1301 | def assert_node_annotation_payload(name: str, document: Any, rendered: str) -> None: | STRING |
| LOW | scripts/render_harness.py | 1366 | def run_node_annotation_cloudinit_checks(scratch: TerraformScratch) -> None: | STRING |
| LOW | scripts/render_harness.py | 1406 | def run_autoscaler_overlay_node_ip_checks() -> None: | STRING |
| LOW | scripts/render_harness.py | 1476 | def run_autoscaler_manifest_checks(scratch: TerraformScratch) -> None: | STRING |
| LOW | scripts/render_harness.py | 1671 | def run_kustomization_path_checks(scratch: TerraformScratch) -> None: | STRING |
| LOW | scripts/smoke_v3_plan_matrix.py | 160 | def discover_external_network_id(env: dict[str, str]) -> str | None: | STRING |
| LOW | scripts/contract_negative_tests.py | 197 | def provider_reachability_blocked(output: str) -> bool: | CODE |
| LOW | scripts/contract_negative_tests.py | 225 | def provider_rpc_sockets_available() -> bool: | CODE |
| LOW | scripts/v2_to_v3_migration_assistant.py | 248 | def collect_topology_warnings(root: Path) -> list[TopologyWarning]: | CODE |
| LOW | scripts/v2_to_v3_migration_assistant.py | 301 | def find_control_plane_network_id(root: Path) -> list[str]: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 73 | def extract_named_block_count(text: str, name: str) -> int: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 92 | def placement_groups_for_static_counts(*counts: int) -> int: | CODE |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 96 | def validate_secure_tailscale_exposure(text: str, example_name: str) -> dict[str, bool]: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | locals.tf | 3627 | # Create the kube_hetzner_selinux.te file, that allows in SELinux to not interfere with various needed services | COMMENT |
| MEDIUM⚡ | locals.tf | 3637 | # Create the distribution-specific registries file before Kubernetes starts. | COMMENT |
| MEDIUM⚡ | locals.tf | 3644 | # Create the distribution-specific kubelet config file if needed. | COMMENT |
| MEDIUM | init.tf | 794 | # This method is a stub which could be replaced by a more practical helm implementation | COMMENT |
| MEDIUM | scripts/create.sh | 95 | # Create the folder if folder_name is provided | COMMENT |
| MEDIUM | modules/host/main.tf | 452 | # Creating the swap filesystem | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/render_harness.py | 1139 | "private route probe tolerates retry": "ip -4 route get '10.0.0.1' 2>/dev/null || true", | CODE |
| HIGH | scripts/render_harness.py | 671 | count=$(cat "$file" 2>/dev/null || echo 0) | STRING |
| HIGH | scripts/render_harness.py | 682 | count=$(cat "$file" 2>/dev/null || echo 0) | STRING |
| HIGH | scripts/render_harness.py | 779 | count=$(cat "$file" 2>/dev/null || echo 0) | STRING |
| HIGH | scripts/render_harness.py | 843 | count=$(cat "$state" 2>/dev/null || echo 0) | STRING |
| HIGH | scripts/render_harness.py | 978 | count=$(cat "$file" 2>/dev/null || echo 0) | STRING |
| HIGH | scripts/render_harness.py | 1437 | "IPv4 route probe tolerates retry": "ip -4 route get 172.31.1.1 2>/dev/null | route_dev || true", | STRING |
| HIGH | scripts/render_harness.py | 1438 | "IPv6 route probe tolerates retry": "ip -6 route show default 2>/dev/null | route_dev || true", | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | locals.tf | 3561 | MAC=$(cat /sys/class/net/eth1/address) | COMMENT |
| LOW | .pre-commit-config.yaml | 21 | # - '--args=--only=terraform_documented_outputs' | COMMENT |
| LOW | docs/llms.md | 321 | **Section 2.1: `control_plane_nodepools` - The Brains of the Operation** | COMMENT |
| LOW | docs/llms.md | 361 | COMMENT | |
| LOW | docs/llms.md | 601 | --- | COMMENT |
| LOW | docs/llms.md | 741 | --- | COMMENT |
| LOW | docs/llms.md | 761 | # labels = { # Note: This is a map, not a list of strings like other labels | COMMENT |
| LOW | docs/llms.md | 841 | # The default is the official image from the Kubernetes project: registry.k8s.io/autoscaling/cluster-autoscaler | COMMENT |
| LOW | docs/llms.md | 901 | # | COMMENT |
| LOW | docs/llms.md | 1701 | # - issuer: | COMMENT |
| LOW | docs/llms.md | 1881 | * **Purpose:** | COMMENT |
| LOW | docs/llms.md | 2241 | ``` | COMMENT |
| LOW | docs/llms.md | 2301 | # | COMMENT |
| LOW | docs/llms.md | 2341 | **Section 2.20: Rancher Integration** | COMMENT |
| LOW | docs/llms.md | 2441 | # Properties of each value: | COMMENT |
| LOW | docs/llms.md | 3181 | COMMENT | |
| LOW | docs/llms.md | 3201 | # Custom Hetzner CSI values | COMMENT |
| LOW | docs/llms.md | 3241 | # haproxy_version = "1.41.0" | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 4 | CODE | |
| LOW | scripts/smoke_v3_plan_matrix.py | 9 | CODE | |
| LOW | scripts/validate_v3_final_polish_examples.py | 4 | CODE | |
| LOW | scripts/contract_negative_tests.py | 4 | CODE | |
| LOW | scripts/contract_negative_tests.py | 13 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 8 | CODE | |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 13 | CODE | |
| LOW | scripts/validate_tailscale_large_scale_examples.py | 22 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_docs_site.py | 67 | CODE | |
| LOW | scripts/sync_docs_site.py | 135 | CODE | |
| LOW | scripts/sync_docs_site.py | 172 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 211 | CODE | |
| LOW | scripts/v2_to_v3_migration_assistant.py | 301 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/terraform.md | 189 | | <a name="input_automatically_upgrade_os"></a> [automatically\_upgrade\_os](#input\_automatically\_upgrade\_os) | Wheth | CODE |
| MEDIUM | docs/terraform.md | 254 | | <a name="input_enable_kured"></a> [enable\_kured](#input\_enable\_kured) | Whether to include kured (the Kubernetes Re | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | locals.tf | 196 | # Check if the user has set custom DNS servers. | COMMENT |
| LOW | scripts/create.sh | 19 | # Check if terraform, packer and hcloud CLIs are present | COMMENT |