1.5

Adjusted Signal

1.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

30.4K

Stars

Language

691.6K

Lines of Code

3.2K

Files

773

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 578 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.1/100 · LOW

Are imports declared and package/API names verified? 127 finding(s).

Agent Over-Engineering Ratio 1.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 71 finding(s).

PR Review Velocity Impact 6.8/100 · LOW

Which changes need focused human review? 773 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 0MEDIUM 96LOW 676

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 773 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block455 hits · 454 pts

Severity	File	Line	Snippet	Context
LOW	release_files/freebsd-port-issue-body.sh	1	#!/bin/bash	COMMENT
LOW	release_files/freebsd-port-diff.sh	1	#!/bin/bash	COMMENT
LOW	release_files/rpm-changelog.sh	1	#!/bin/sh	COMMENT
LOW	idp/dex/config.go	101	RPDisplayName string `yaml:"rpDisplayName" json:"rpDisplayName"`	COMMENT
LOW	tools/idp-migrate/main.go	1	// Package main provides a standalone CLI tool to migrate user IDs from an	COMMENT
LOW	tools/gotestsummary/main.go	1	// Package main turns a `go test -json` stream into a readable CI log.	COMMENT
LOW	proxy/server.go	181	// pairs (<name>.crt / <name>.key). Wildcard patterns are extracted from	COMMENT
LOW	proxy/server.go	201	// WireguardPort is the port for the NetBird tunnel interface. Use 0	COMMENT
LOW	proxy/server.go	221	// RequireSubdomain indicates whether a subdomain label is required	COMMENT
LOW	proxy/server.go	241	// CrowdSecAPIURL is the CrowdSec LAPI URL. Empty disables CrowdSec.	COMMENT
LOW	proxy/inbound_test.go	501	// logrus PipeWriter that backs each per-account http.Server's ErrorLog.	COMMENT
LOW	proxy/lifecycle.go	21	type Config struct {	COMMENT
LOW	proxy/lifecycle.go	41	ProxyToken string	COMMENT
LOW	proxy/lifecycle.go	61	// ACMEEABHMACKey is the External Account Binding HMAC key for CAs	COMMENT
LOW	proxy/lifecycle.go	81	HealthAddr string	COMMENT
LOW	proxy/lifecycle.go	101	// embedded client this proxy creates. Zero values fall back to	COMMENT
LOW	proxy/lifecycle.go	121	// being applied before the receive loop reconnects to resync. Zero falls	COMMENT
LOW	proxy/internal/middleware/types.go	1	// Package middleware defines the per-target middleware chain that runs	COMMENT
LOW	proxy/internal/middleware/types.go	21	// (request parsing vs response parsing vs cost metering) into separate	COMMENT
LOW	proxy/internal/middleware/types.go	61	const (	COMMENT
LOW	proxy/internal/middleware/types.go	81	// requests use the tolerant routing scan instead of buffering.	COMMENT
LOW	proxy/internal/middleware/types.go	141		COMMENT
LOW	proxy/internal/middleware/types.go	161	// upstream tags so attribution dashboards stay readable. Slice may	COMMENT
LOW	proxy/internal/middleware/types.go	201	// Mutations describes the deltas a middleware wants applied to the	COMMENT
LOW	proxy/internal/middleware/types.go	221	// the router needs. They bypass the framework's HeadersAdd /	COMMENT
LOW	proxy/internal/middleware/types.go	241	// about. Empty Path leaves the original target's path	COMMENT
LOW	proxy/internal/middleware/keys.go	1	package middleware	COMMENT
LOW	proxy/internal/middleware/keys.go	21	// session, read from the per-provider session marker in the request	COMMENT
LOW	proxy/internal/middleware/keys.go	41	// LLM cached-input bucket. For OpenAI it's the SUBSET of input	COMMENT
LOW	proxy/internal/middleware/keys.go	61		COMMENT
LOW	proxy/internal/middleware/keys.go	81	// groups; the marker only tells the limits gate that a per-model	COMMENT
LOW	proxy/internal/middleware/chain.go	121	}	COMMENT
LOW	proxy/internal/middleware/middleware.go	1	package middleware	COMMENT
LOW	proxy/internal/middleware/bodytap/request.go	1	// Package bodytap owns the framework-side body capture used by the	COMMENT
LOW	proxy/internal/middleware/builtin/builtin.go	21	// builtin middlewares may use during request / response handling.	COMMENT
LOW	…rnal/middleware/builtin/llm_identity_inject/factory.go	21	ProviderID string `json:"provider_id"`	COMMENT
LOW	…rnal/middleware/builtin/llm_identity_inject/factory.go	41	}	COMMENT
LOW	…l/middleware/builtin/llm_identity_inject/middleware.go	1	// Package llm_identity_inject implements the SlotOnRequest middleware	COMMENT
LOW	…l/middleware/builtin/llm_identity_inject/middleware.go	221	// OpenAI-standard identity fields this middleware writes. A surface	COMMENT
LOW	…l/middleware/builtin/llm_identity_inject/middleware.go	241	surface, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)	COMMENT
LOW	…nternal/middleware/builtin/llm_limit_record/factory.go	1	// Package llm_limit_record is the SlotOnResponse middleware that	COMMENT
LOW	proxy/internal/middleware/builtin/cost_meter/factory.go	21		COMMENT
LOW	…y/internal/middleware/builtin/cost_meter/middleware.go	161	{Key: middleware.KeyCostUSDCache, Value: usd(costs.CacheUSD)},	COMMENT
LOW	…y/internal/middleware/builtin/cost_meter/middleware.go	201	// usd renders a cost as the fixed-precision string every cost.usd_* key	COMMENT
LOW	proxy/internal/middleware/builtin/llm_router/factory.go	21	// is the catchall). AuthHeaderName + AuthHeaderValue are the	COMMENT
LOW	proxy/internal/middleware/builtin/llm_router/factory.go	41	// Vendor remains supported for existing single-surface configurations.	COMMENT
LOW	proxy/internal/middleware/builtin/llm_router/factory.go	61	// Empty means the listing is served from UpstreamHost like everything else.	COMMENT
LOW	proxy/internal/middleware/builtin/llm_router/factory.go	81	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	141	// known to a provider that no policy authorises for the caller deny	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	281	// discoverableModels returns the model ids a caller in userGroups may actually	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	401	}	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	501	// to the other model-less endpoints. Only a listing gets an upstream redirect	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	541	// provider's upstream is normally the runtime host ("bedrock-runtime.<region>"),	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	701	// outright; multiple fall to the longest UpstreamPath prefix-match, then	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	881	}	COMMENT
LOW	…y/internal/middleware/builtin/llm_router/middleware.go	921	return parsed.Path	COMMENT
LOW	…internal/middleware/builtin/llm_limit_check/factory.go	1	// Package llm_limit_check is the SlotOnRequest middleware that asks	COMMENT
LOW	…ernal/middleware/builtin/llm_limit_check/middleware.go	81	// also be a no-op so counters stay at zero. This matches	COMMENT
LOW	…xy/internal/middleware/builtin/llm_guardrail/redact.go	21	// phoneNARgx accepts the 3-3-4 North-American shape with any of the common	COMMENT
LOW	…nternal/middleware/builtin/llm_guardrail/middleware.go	121	return nil	COMMENT
395 more matches not shown…

Decorative Section Separators68 hits · 184 pts

Severity	File	Line	Snippet	Context
MEDIUM	…dleware/builtin/agentnetwork_chain_integration_test.go	143	// ── Stage 1 — gate: pre-flight check ──────────────────────	COMMENT
MEDIUM	…dleware/builtin/agentnetwork_chain_integration_test.go	162	// ── Stage 2 — recorder: post-flight write ─────────────────	COMMENT
MEDIUM	…dleware/builtin/agentnetwork_chain_integration_test.go	180	// ── Stage 3 — assert state in sqlite ──────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	35	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	37	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	59	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	61	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	134	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	136	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	208	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	management/server/types/networkmap_benchmark_test.go	210	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	262	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	264	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	331	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	333	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	394	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	396	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	426	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	428	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	527	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	529	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	585	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	587	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	634	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	636	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	703	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	705	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	771	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	773	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	801	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	803	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	842	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	844	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	990	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	992	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1033	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1035	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1083	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1085	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1160	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1162	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1201	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1203	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1240	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1242	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1279	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/types/networkmap_components_correctness_test.go	1281	// ──────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	infrastructure_files/getting-started.sh	159	# ------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	198	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	201	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	333	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	335	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	526	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	528	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	656	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	659	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	785	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	787	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	1278	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	infrastructure_files/migrate-to-enterprise.sh	1280	# ---------------------------------------------------------------------------	COMMENT
8 more matches not shown…

Fake / Example Data126 hits · 146 pts

Severity	File	Line	Snippet	Context
LOW⚡	encryption/route53_test.go	69	{"example.com", "admin@example.com"},	CODE
LOW⚡	encryption/route53_test.go	70	{"x.example.com", "admin@example.com"},	CODE
LOW⚡	encryption/route53_test.go	71	{"x.x.example.com", "admin@example.com"},	CODE
LOW⚡	encryption/route53_test.go	72	{"*.example.com", "admin@example.com"},	CODE
LOW	…al/middleware/builtin/llm_guardrail/middleware_test.go	273	assert.NotContains(t, prompt, "user@example.com", "raw email must not leak")	CODE
LOW	…ternal/middleware/builtin/llm_guardrail/redact_test.go	56	assert.NotContains(t, out, "555-1234", "raw NA phone must not survive in %q", in)	CODE
LOW	…ternal/middleware/builtin/llm_guardrail/redact_test.go	92	assert.NotContains(t, out, "user@example.com", "raw email must not survive combined input")	CODE
LOW⚡	…ternal/middleware/builtin/llm_guardrail/redact_test.go	165	{"Brian Smith", "brian.smith@example.org", "987-65-4321", "202-555-0163"},	CODE
LOW⚡	…ternal/middleware/builtin/llm_guardrail/redact_test.go	168	{"Evelyn Parker", "evelyn.parker@example.org", "333-44-5555", "1-202-555-0112"},	CODE
LOW⚡	…ternal/middleware/builtin/llm_guardrail/redact_test.go	171	{"Hassan Ali", "hassan.ali@example.org", "666-77-8888", "+1 (202) 555-0175"},	CODE
LOW	proxy/internal/proxy/reverseproxy_test.go	1443	cd.SetUserEmail("user@example.com")	CODE
LOW	proxy/internal/proxy/reverseproxy_test.go	1467	assert.Equal(t, "user@example.com", in.UserEmail, "user email must propagate")	CODE
LOW	proxy/internal/auth/middleware_test.go	333	UserEmail: "user@example.com",	CODE
LOW	util/crypt/crypt_test.go	55	{name: "Email Address", input: "user@example.com"},	CODE
LOW	management/cmd/admin/admin_test.go	32	Email: "user@example.com",	CODE
LOW⚡	management/cmd/admin/admin_test.go	69	err := runChangePassword(ctx, st, &out, userSelector{email: "user@example.com"}, "NewPass1!", "")	CODE
LOW⚡	management/cmd/admin/admin_test.go	73	user, err := st.GetPassword(ctx, "user@example.com")	CODE
LOW⚡	management/cmd/admin/admin_test.go	83	err := runChangePassword(context.Background(), st, io.Discard, userSelector{email: "user@example.com"}, "short", "")	CODE
LOW	management/cmd/admin/admin_test.go	117	err := runResetMFA(ctx, st, &out, userSelector{email: "user@example.com"}, "")	CODE
LOW	management/cmd/admin/admin_test.go	202	require.Error(t, userSelector{email: "user@example.com", userID: "user-1"}.validate())	CODE
LOW	management/server/user_test.go	467	Name: "John Doe",	CODE
LOW	management/server/user_test.go	1340	tud := &idp.UserData{ID: externalUser.Id, Name: "Test User", Email: "user@example.com"}	CODE
LOW	management/server/user_test.go	1358	assert.Equal(t, "user@example.com", user.Email)	CODE
LOW	management/server/idp/jumpcloud_test.go	81	assert.Equal(t, "John Doe", userData.Name)	CODE
LOW	management/server/idp/embedded_test.go	45	invitedByEmail := "admin@example.com"	CODE
LOW	management/server/idp/embedded_test.go	111	userData, err := manager.CreateUser(ctx, "test@example.com", "Test User", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	147	userData, err := manager.CreateUser(ctx, "delete-me@example.com", "Delete Me", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	182	_, err = manager.CreateUser(ctx, "user1@example.com", "User 1", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	185	_, err = manager.CreateUser(ctx, "user2@example.com", "User 2", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	226	userData, err := manager.CreateUser(ctx, "jwt-test@example.com", "JWT Test", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	541	userData, err := manager1.CreateUser(ctx, "preserved@example.com", "Preserved User", "account1", "admin@example.com")	CODE
LOW	management/server/idp/embedded_test.go	637	_, err = manager2.CreateUser(ctx, "newuser@example.com", "New User", "account1", "admin@example.com")	CODE
LOW⚡	management/server/idp/azure_test.go	132	"displayName": "John Doe",	CODE
LOW⚡	management/server/idp/azure_test.go	137	Name: "John Doe",	CODE
LOW⚡	management/server/idp/azure_test.go	146	"displayName": "John Doe",	CODE
LOW⚡	management/server/idp/azure_test.go	151	Name: "John Doe",	CODE
LOW	management/server/idp/okta_test.go	30	Name: "John Doe",	CODE
LOW	management/server/idp/migration/migration_test.go	631	"acc-1": {{ID: "original-idp-id", Email: "user@example.com", Name: "User"}},	CODE
LOW	management/server/idp/migration/migration_test.go	641	assert.Equal(t, "user@example.com", ms.updateInfoCalls[0].Email)	CODE
LOW⚡	management/server/types/user_test.go	238	email: "user@example.com",	CODE
LOW⚡	management/server/types/user_test.go	239	uname: "John Doe",	CODE
LOW⚡	management/server/types/user_test.go	248	email: "user@example.com",	CODE
LOW	management/server/types/user_test.go	308	email: "admin@example.com",	CODE
LOW	…/server/activity/store/sql_store_idp_migration_test.go	84	"email": "user@example.com",	CODE
LOW	…/server/activity/store/sql_store_idp_migration_test.go	102	"email": "user@example.com",	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	162	assert.Equal(t, "admin@example.com", email)	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	174	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin User"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	188	assert.Equal(t, "admin@example.com", response.Email)	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	195	body := `{"email": "admin@example.com", "password": "securepassword123"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	239	body := `{"email": "admin@example.com", "name": "User"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	253	body := `{"email": "admin@example.com", "password": "short", "name": "User"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	286	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "User"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	305	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "User"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	322	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin", "create_pat": true}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	341	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin"}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	381	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin", "create_pat": true}`	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	403	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin", "create_pat": true, "pat_expi	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	445	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin", "create_pat": true, "pat_expi	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	460	assert.Equal(t, "admin@example.com", gotAccountArgs.email)	CODE
LOW	…server/http/handlers/instance/instance_handler_test.go	492	body := `{"email": "admin@example.com", "password": "securepassword123", "name": "Admin", "create_pat": true, "pat_expi	CODE
66 more matches not shown…

Structural Annotation Overuse37 hits · 80 pts

Severity	File	Line	Snippet	Context
LOW⚡	proxy/server.go	908	// Step 1: Fail readiness probe so load balancers stop routing new traffic.	COMMENT
LOW⚡	proxy/server.go	913	// Step 2: When running behind a load balancer, wait for endpoint removal	COMMENT
LOW⚡	proxy/server.go	920	// Step 3: Stop accepting new connections and drain in-flight requests.	COMMENT
LOW⚡	proxy/server.go	931	// Step 4: Close hijacked connections (WebSocket) that Shutdown does not handle.	COMMENT
LOW⚡	proxy/server.go	939	// Step 5: Stop all remaining background services.	COMMENT
LOW	proxy/internal/tcp/router_test.go	1531	// Step 1: Add fallback first (port mapping), then SNI route (TLS service).	COMMENT
LOW	proxy/internal/tcp/router_test.go	1561	// Step 2: Remove SNI route. Fallback still works, router not empty.	COMMENT
LOW	proxy/internal/tcp/router_test.go	1576	// Step 3: Remove fallback. Router is now empty.	COMMENT
LOW	client/internal/updater/reposign/artifact_test.go	1019	// Step 1: Create root key	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1043	// Step 2: Generate artifact key	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1047	// Step 3: Create and validate key bundle	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1061	// Step 4: Sign artifact data	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1066	// Step 5: Validate artifact	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	826	// Step 1: Create empty revocation list	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	830	// Step 2: Validate it	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	838	// Step 3: Revoke a key	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	846	// Step 4: Validate the extended list	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	855	// Step 5: Verify the revocation time is reasonable	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	413	// Step 1: Generate root key	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	420	// Step 2: Parse the private key back	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	426	// Step 3: Generate an artifact key using root key	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	431	// Step 4: Verify the artifact key signature	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	450	// Step 5: Use artifact key to sign data	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	456	// Step 6: Verify the artifact data signature	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	68	// Step 1: Generate root key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	72	// Step 2: Generate artifact key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	79	// Step 3: Create revocation list	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	83	// Step 4: Bundle artifact keys	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	87	// Step 5: Create test artifact	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	93	// Step 6: Sign artifact	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	97	// Step 7: Setup mock HTTP server	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	118	// Step 8: Create ArtifactVerify with test root key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	127	// Step 9: Verify artifact	COMMENT
LOW⚡	client/internal/getent/getent_test.go	101	// Step 1: CurrentUser must resolve the running user.	COMMENT
LOW⚡	client/internal/getent/getent_test.go	107	// Step 2: LookupUser by the same username must return matching identity.	COMMENT
LOW⚡	client/internal/getent/getent_test.go	114	// Step 3: GroupIDs must return at least the primary GID.	COMMENT
LOW	client/iface/bind/dual_stack_conn.go	41	// NOTE: This method is NOT used in the data path. ICEBind receives packets via	COMMENT

Verbosity Indicators36 hits · 78 pts

Severity	File	Line	Snippet	Context
LOW⚡	proxy/server.go	908	// Step 1: Fail readiness probe so load balancers stop routing new traffic.	COMMENT
LOW⚡	proxy/server.go	913	// Step 2: When running behind a load balancer, wait for endpoint removal	COMMENT
LOW⚡	proxy/server.go	920	// Step 3: Stop accepting new connections and drain in-flight requests.	COMMENT
LOW⚡	proxy/server.go	931	// Step 4: Close hijacked connections (WebSocket) that Shutdown does not handle.	COMMENT
LOW⚡	proxy/server.go	939	// Step 5: Stop all remaining background services.	COMMENT
LOW	proxy/internal/tcp/router_test.go	1531	// Step 1: Add fallback first (port mapping), then SNI route (TLS service).	COMMENT
LOW	proxy/internal/tcp/router_test.go	1561	// Step 2: Remove SNI route. Fallback still works, router not empty.	COMMENT
LOW	proxy/internal/tcp/router_test.go	1576	// Step 3: Remove fallback. Router is now empty.	COMMENT
LOW	client/internal/updater/reposign/artifact_test.go	1019	// Step 1: Create root key	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1043	// Step 2: Generate artifact key	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1047	// Step 3: Create and validate key bundle	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1061	// Step 4: Sign artifact data	COMMENT
LOW⚡	client/internal/updater/reposign/artifact_test.go	1066	// Step 5: Validate artifact	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	826	// Step 1: Create empty revocation list	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	830	// Step 2: Validate it	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	838	// Step 3: Revoke a key	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	846	// Step 4: Validate the extended list	COMMENT
LOW⚡	client/internal/updater/reposign/revocation_test.go	855	// Step 5: Verify the revocation time is reasonable	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	413	// Step 1: Generate root key	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	420	// Step 2: Parse the private key back	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	426	// Step 3: Generate an artifact key using root key	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	431	// Step 4: Verify the artifact key signature	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	450	// Step 5: Use artifact key to sign data	COMMENT
LOW⚡	client/internal/updater/reposign/root_test.go	456	// Step 6: Verify the artifact data signature	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	68	// Step 1: Generate root key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	72	// Step 2: Generate artifact key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	79	// Step 3: Create revocation list	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	83	// Step 4: Bundle artifact keys	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	87	// Step 5: Create test artifact	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	93	// Step 6: Sign artifact	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	97	// Step 7: Setup mock HTTP server	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	118	// Step 8: Create ArtifactVerify with test root key	COMMENT
LOW⚡	client/internal/updater/reposign/verify_test.go	127	// Step 9: Verify artifact	COMMENT
LOW⚡	client/internal/getent/getent_test.go	101	// Step 1: CurrentUser must resolve the running user.	COMMENT
LOW⚡	client/internal/getent/getent_test.go	107	// Step 2: LookupUser by the same username must return matching identity.	COMMENT
LOW⚡	client/internal/getent/getent_test.go	114	// Step 3: GroupIDs must return at least the primary GID.	COMMENT

Modern AI Meta-Vocabulary24 hits · 72 pts

Severity	File	Line	Snippet	Context
MEDIUM	…agement/server/permissions/agent_network_roles_test.go	68	// groups, peers, the provider list) — no policies, guardrails, budgets, or	COMMENT
MEDIUM	management/server/permissions/roles/usage_viewer.go	18	// guardrails, budgets, or Agent Network settings.	COMMENT
MEDIUM	…gement/server/permissions/roles/agent_network_admin.go	10	// area: full control over providers, policies, guardrails, budgets, usage,	COMMENT
MEDIUM	management/server/store/store.go	377	// Agent Network persistence (providers, policies, guardrails, settings).	COMMENT
MEDIUM	management/server/store/sql_store_account.go	193	// Dependents first: policies point at providers and guardrails, and settings	COMMENT
MEDIUM	…ernals/modules/agentnetwork/policyselect_model_test.go	19	// to reach providerID under the given guardrails. Uncapped keeps the selector's	COMMENT
MEDIUM	…ernals/modules/agentnetwork/policyselect_model_test.go	247	// allowlist guardrails permits the union of their models (not just the first).	COMMENT
MEDIUM	…ernals/modules/agentnetwork/policyselect_model_test.go	273	// resolving the candidate policies' guardrails surfaces as an error, not a	COMMENT
MEDIUM	…nagement/internals/modules/agentnetwork/synthesizer.go	1174	// mergeGuardrails folds the referencing policies' guardrails into the	COMMENT
MEDIUM	…nagement/internals/modules/agentnetwork/synthesizer.go	1177	// guardrails now.	COMMENT
MEDIUM	…s/agentnetwork/synthesizer_guardrail_realstore_test.go	104	// Save a provider and a policy with NO guardrails attached — proves the	COMMENT
MEDIUM	management/internals/modules/agentnetwork/manager.go	274	// the models their guardrails permit, and an unrestricted policy	COMMENT
MEDIUM	…es/agentnetwork/synthesizer_provider_allowlist_test.go	13	// under the given guardrails (both optional). Groups are irrelevant to	COMMENT
MEDIUM	…ent/internals/modules/agentnetwork/synthesizer_test.go	69	// in the happy path: settings, providers, policies, guardrails.	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	267	// guardrail, so the selector can skip loading guardrails when none do.	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	278	// it keeps the candidates whose guardrails permit the model (none enabled =	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	314	// anything. Disabled allowlists, stale guardrail references, and guardrails	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	330	// loadGuardrailsByID loads the account's guardrails indexed by ID. Used by the	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	331	// model-allowlist gate to resolve each candidate policy's attached guardrails.	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/policyselect.go	366	// filterModelPermittedPolicies returns the subset of policies whose guardrails	COMMENT
MEDIUM	…agement/internals/modules/agentnetwork/types/policy.go	16	// guardrails carry only model allowlist and prompt capture.	COMMENT
MEDIUM	shared/management/client/rest/agentnetwork.go	185	// ListGuardrails lists all Agent Network guardrails	COMMENT
MEDIUM	shared/management/client/rest/client.go	148	// providers, policies, guardrails, budget rules and account settings.	COMMENT
MEDIUM	docs/netbird-macos.sh	33	# - you orchestrate via JumpCloud Commands and want the same	COMMENT

Redundant / Tautological Comments11 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	release_files/post_install.sh	46	# Check if this is a clean install or an upgrade	COMMENT
LOW	release_files/install.sh	270	# Check if the package is already installed	COMMENT
LOW	release_files/freebsd-port-diff.sh	82	# Check if old version had PORTREVISION	COMMENT
LOW	release_files/ui-post-install.sh	6	# Check if netbird-ui is running	COMMENT
LOW	.github/workflows/check-license-dependencies.yml	95	# Check if any importer is NOT in management/signal/relay	COMMENT
LOW	infrastructure_files/migrate.sh	390	# Check if this volume exists in Docker	COMMENT
LOW	infrastructure_files/migrate.sh	709	# Check if it's only the default ["0.0.0.0/0"]	COMMENT
LOW	infrastructure_files/getting-started.sh	814	# Check if docker compose is installed using check_docker_compose function	COMMENT
LOW	infrastructure_files/configure.sh	44	# Check if PostgreSQL is set as the store engine	COMMENT
LOW	infrastructure_files/configure.sh	157	# Check if letsencrypt was disabled	COMMENT
LOW	infrastructure_files/configure.sh	185	# Check if management identity provider is set	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	.github/workflows/release.yml	958	const shortSha = context.payload.pull_request.head.sha.slice(0, 7);	CODE

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	management/server/idp/embedded.go	293	// Absolutely required, otherwise the dex server will omit the MFA configuration entirely	COMMENT
MEDIUM	…ment/internals/modules/agentnetwork/catalog/catalog.go	241	// remains a robust fallback for spend tracking in those cases.	COMMENT
MEDIUM	.github/workflows/agent-network-e2e.yml	43	# Container-driver builder so the harness can build the combined/proxy/	COMMENT

TODO Padding5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	management/server/idp/embedded.go	440	// TODO: implement	COMMENT
LOW	client/iface/freebsd/iface.go	18	// TODO: implement without allocations	COMMENT
LOW	client/iface/freebsd/iface.go	29	// TODO: implement without allocations	COMMENT
LOW	client/iface/freebsd/iface.go	96	// TODO: implement without allocations	COMMENT
LOW	client/firewall/uspfilter/filter.go	607	// TODO: implement outbound SNAT	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	release_files/install.sh	151	# Create the necessary file structure for /dev/net/tun	COMMENT

Hyper-Verbose Identifiers3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	release_files/rpm-changelog.sh	52	def first_line_of_double_quoted(value):	CODE
LOW	client/ui/frontend/src/hooks/useManagementUrl.ts	43	export async function checkManagementUrlReachable(	CODE
LOW	…end/src/modules/login/LoginWaitingForBrowserDialog.tsx	19	export default function LoginWaitingForBrowserDialog() {	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	infrastructure_files/migrate.sh	11	# Usage:	COMMENT
LOW	client/internal/routemanager/refcounter/refcounter.go	58	// Usage example:	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	proxy/web/src/data.ts	31	export function getData(): Data {	CODE

netbirdio/netbird

Open-Source Code Quality, Security and Technical Debt Review