3.9

Adjusted Signal

3.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

10.8K

Stars

PHP

Language

36.6K

Lines of Code

350

Files

104

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 17.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 104 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 8.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 59 finding(s).

PR Review Velocity Impact 16.3/100 · LOW

Which changes need focused human review? 104 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 8LOW 94

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 104 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers59 hits · 62 pts

Severity	File	Line	Snippet	Context
LOW	app/composer/composer/InstalledVersions.php	58	public static function getInstalledPackagesByType($type)	CODE
LOW	php/tests/tests/initial-setup.spec.js	178	async function getUnblockLoginPrivateKey() {	CODE
LOW	php/public/containers-form-submit.js	36	function checkForOptionContainerChanges() {	CODE
LOW	php/public/containers-form-submit.js	58	function checkForCommunityContainerChanges() {	CODE
LOW	php/public/containers-form-submit.js	92	function handleDockerSocketProxyWarning() {	CODE
LOW	php/src/Docker/DockerActionManager.php	70	public function GetContainerRestartingState(Container $container): ContainerState {	CODE
LOW	php/src/Docker/DockerActionManager.php	113	public function GetContainerStartingState(Container $container): ContainerState {	CODE
LOW	php/src/Docker/DockerActionManager.php	668	private function isContainerUpdateAvailable(string $id): string {	CODE
LOW	php/src/Docker/DockerActionManager.php	727	private function GetAllNextcloudExecCommands(): string {	CODE
LOW	php/src/Docker/DockerActionManager.php	732	private function GetRepoDigestsOfContainer(string $containerName): ?array {	CODE
LOW	php/src/Docker/DockerActionManager.php	827	public function IsMastercontainerUpdateAvailable(): bool {	CODE
LOW	php/src/Docker/DockerActionManager.php	917	private function DisconnectContainerFromBridgeNetwork(string $id): void {	CODE
LOW	php/src/Docker/DockerActionManager.php	937	private function ConnectContainerIdToNetwork(string $id, string $internalPort, string $network = 'nextcloud-aio', bo	CODE
LOW	php/src/Docker/DockerActionManager.php	989	public function ConnectMasterContainerToNetwork(): void {	CODE
LOW	php/src/Docker/DockerActionManager.php	995	public function ConnectContainerToNetwork(Container $container): void {	CODE
LOW	php/src/Docker/DockerActionManager.php	1027	public function GetBackupcontainerExitCode(): int {	CODE
LOW	php/src/Docker/DockerActionManager.php	1049	public function GetDatabasecontainerExitCode(): int {	CODE
LOW	php/src/Docker/DockerActionManager.php	1089	private function GetCreatedTimeOfNextcloudImage(string $imageName): ?string {	CODE
LOW	php/src/Docker/DockerActionManager.php	1106	public function GetAndGenerateSecretWrapper(string $secretId): string {	CODE
LOW	php/src/Docker/DockerActionManager.php	1138	public function RunNextcloudUpgradeToLatestMajor(\Closure $addToStreamingResponseBody): void {	CODE
LOW	php/src/Auth/AuthManager.php	111	public function IsLoginUnblockedForSession() : bool {	CODE
LOW	php/src/Auth/AuthManager.php	116	public function RegisterFailedLoginAttempt() : void {	CODE
LOW	php/src/Controller/DockerController.php	30	private function PerformRecursiveContainerStart(string $id, bool $pullImage = true, ?\Closure $addToStreamingRespons	CODE
LOW	php/src/Controller/DockerController.php	53	private function PerformRecursiveImagePull(string $id) : void {	CODE
LOW	php/src/Controller/DockerController.php	94	public function StartBackupContainerBackup(Request $request, Response $response, array $args) : Response {	CODE
LOW	php/src/Controller/DockerController.php	117	public function StartBackupContainerCheck(Request $request, Response $response, array $args) : Response {	CODE
LOW	php/src/Controller/DockerController.php	155	public function StartBackupContainerRestore(Request $request, Response $response, array $args) : Response {	CODE
LOW	php/src/Controller/DockerController.php	178	public function StartBackupContainerCheckRepair(Request $request, Response $response, array $args) : Response {	CODE
LOW	php/src/Controller/DockerController.php	298	private function PerformRecursiveContainerStop(string $id, bool $forceStopNextcloud = false, ?\Closure $addToStreami	CODE
LOW	php/src/Controller/DockerController.php	345	public function RunNextcloudUpgradeToLatestMajor(Request $request, Response $response, array $args) : Response {	CODE
LOW	php/src/Controller/DockerController.php	382	public function StartDomaincheckContainer() : void	CODE
LOW	php/src/Controller/DockerController.php	424	private function getStreamingResponseHtmlStart() : string {	CODE
LOW	php/src/Controller/DockerController.php	459	private function getAddToStreamingResponseBody(Response $nonbufResp) : \Closure {	CODE
LOW⚡	php/src/Controller/DockerController.php	482	private function finalizeStreamingResponse(Response $nonbufResp) : void {	CODE
LOW⚡	php/src/Controller/DockerController.php	486	private function getStreamingResponseHtmlEnd() : string {	CODE
LOW⚡	php/src/Controller/DockerController.php	490	private function getTimestampForDockerLogsApiSince(string $input) : string	CODE
LOW	php/src/Data/DataConst.php	39	public static function GetAdditionalBackupDirectoriesFile() : string {	CODE
LOW⚡	php/src/Data/DataConst.php	59	public static function GetCommunityContainersDirectory() : string {	CODE
LOW⚡	php/src/Data/DataConst.php	63	public static function GetCollaboraSeccompProfilePath() : string {	CODE
LOW⚡	php/src/Data/DataConst.php	67	public static function GetContainersDefinitionPath() : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	280	public function isDesecAwaitingVerification(): bool {	CODE
LOW	php/src/Data/ConfigurationManager.php	423	private function setDockerSocketProxyEnabled(bool $value) : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	522	public function getAndGenerateSecret(string $secretId) : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	809	public function deleteBorgBackupLocationItems() : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	827	public function setBorgRestoreLocationVarsAndPassword(string $location, string $repo, string $password) : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	905	private function getEnvironmentalVariableOrConfig(string $envVariableName, string $configName, string $defaultValue)	CODE
LOW	php/src/Data/ConfigurationManager.php	932	public function getCollaboraSeccompPolicy() : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	978	private function getDailyBackupFileContent() : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	1009	public function areAutomaticUpdatesEnabled() : bool {	CODE
LOW	php/src/Data/ConfigurationManager.php	1030	public function setAdditionalBackupDirectories(string $additionalBackupDirectories) : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	1051	public function getAdditionalBackupDirectoriesString() : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	1058	public function getAdditionalBackupDirectoriesArray() : array {	CODE
LOW	php/src/Data/ConfigurationManager.php	1089	public function shouldDomainValidationBeSkipped(bool $skipDomainValidation) : bool {	CODE
LOW	php/src/Data/ConfigurationManager.php	1096	public function getApacheAdditionalNetwork() : string {	CODE
LOW	php/src/Data/ConfigurationManager.php	1115	private function validateCollaboraDictionaries(string $CollaboraDictionaries) : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	1128	public function deleteCollaboraDictionaries() : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	1135	private function validateCollaboraAdditionalOptions(string $additionalCollaboraOptions) : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	1148	public function deleteAdditionalCollaboraOptions() : void {	CODE
LOW	php/src/Data/ConfigurationManager.php	1152	public function listAvailableCommunityContainers() : array {	CODE

Redundant / Tautological Comments22 hits · 35 pts

Severity	File	Line	Snippet	Context
LOW	Containers/nextcloud/entrypoint.sh	67	# Check if variable is an actual cert	COMMENT
LOW	Containers/nextcloud/entrypoint.sh	187	# Check if it skips a major version	COMMENT
LOW	Containers/nextcloud/entrypoint.sh	591	# Check if appdata is present	COMMENT
LOW	Containers/nextcloud/start.sh	50	# Check if /dev/dri device is present and apply correct permissions	COMMENT
LOW	Containers/postgresql/start.sh	31	# Check if dump dir is writeable	COMMENT
LOW	Containers/postgresql/start.sh	107	# Check if the line we grep for later on is there	COMMENT
LOW	Containers/borgbackup/backupscript.sh	40	# Check if target is mountpoint	COMMENT
LOW	Containers/borgbackup/backupscript.sh	46	# Check if repo is uninitialized	COMMENT
LOW	Containers/mastercontainer/daily-backup.sh	9	# Check if initial configuration has been done, otherwise this script should do nothing.	COMMENT
LOW	Containers/mastercontainer/daily-backup.sh	38	# Check if apache is running/stopped, watchtower is stopped and backupcontainer is stopped	COMMENT
LOW	Containers/mastercontainer/cron.sh	57	# Check if AIO is outdated	COMMENT
LOW	Containers/mastercontainer/start.sh	27	# Check if running as root user	COMMENT
LOW	Containers/mastercontainer/start.sh	39	# Check if socket is available and readable	COMMENT
LOW	Containers/mastercontainer/start.sh	62	# Check if a group with the same group name of /var/run/docker.socket already exists in the container	COMMENT
LOW	Containers/mastercontainer/start.sh	90	# Check if DOCKER_API_VERSION is set globally	COMMENT
LOW	Containers/mastercontainer/start.sh	110	# Check if docker info can be used	COMMENT
LOW⚡	Containers/mastercontainer/start.sh	147	# Check if vfs is used: https://github.com/nextcloud/all-in-one/discussions/1467	COMMENT
LOW⚡	Containers/mastercontainer/start.sh	156	# Check if snap install	COMMENT
LOW⚡	Containers/mastercontainer/start.sh	163	# Check if startup command was executed correctly	COMMENT
LOW	Containers/mastercontainer/start.sh	358	# Check if ghcr.io is reachable	COMMENT
LOW	Containers/mastercontainer/start.sh	394	# Check if unsupported env are set (but don't exit as it would break many instances)	COMMENT
LOW	Containers/watchtower/start.sh	7	# Check if socket is available and readable	COMMENT

Slop Phrases8 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	compose.yaml	10	- /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the appl	CODE
LOW	compose.yaml	10	- /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the appl	CODE
MEDIUM	nextcloud-aio-helm-chart/values.yaml	47	STORAGE_CLASS: # By setting this, you can adjust the storage class for your volumes. This should be a fast storag	CODE
MEDIUM	nextcloud-aio-helm-chart/values.yaml	64	NAMESPACE: default # By changing this, you can adjust the namespace of the installation which allows to install m	CODE
MEDIUM	nextcloud-aio-helm-chart/values.yaml	65	NAMESPACE_DISABLED: "no" # By setting this to "yes", you can disabled the creation of the namespace so that you c	CODE
MEDIUM	nextcloud-aio-helm-chart/update-helm.sh	445	echo 'STORAGE_CLASS: # By setting this, you can adjust the storage class for your volumes. This should be a fast	CODE
MEDIUM	nextcloud-aio-helm-chart/update-helm.sh	456	NAMESPACE: default # By changing this, you can adjust the namespace of the installation which allows to install m	CODE
MEDIUM	nextcloud-aio-helm-chart/update-helm.sh	457	NAMESPACE_DISABLED: "no" # By setting this to "yes", you can disabled the creation of the namespace so that you c	CODE

Synthetic Comment Markers2 hits · 12 pts

Severity	File	Line	Snippet	Context
HIGH	AGENTS.md	90	See [HowToApplyALicense.md](https://github.com/nextcloud/server/blob/master/contribute/HowToApplyALicense.md) for detail	CODE
HIGH	php/src/Docker/DockerActionManager.php	1158	// Special-case images prune to include the dangling filter as requested	COMMENT

Over-Commented Block11 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW	compose.yaml	21	# APACHE_PORT: 11000 # Needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudf	COMMENT
LOW	compose.yaml	41	# TALK_PORT: 3478 # This allows to adjust the port that the talk container is using which is exposed on the host.	COMMENT
LOW	compose.yaml	61	# configs:	COMMENT
LOW	compose.yaml	81	# driver_opts:	COMMENT
LOW	nextcloud-aio-helm-chart/update-helm.sh	221	# shellcheck disable=SC1083	COMMENT
LOW	php/tests/tests/desec-existing.spec.js	1	import { test, expect } from '@playwright/test';	COMMENT
LOW	php/tests/tests/desec-register.spec.js	1	import { test, expect } from '@playwright/test';	COMMENT
LOW	php/src/Docker/DockerActionManager.php	481	// This is needed due to a bug in libwebsockets used in Janus which cannot handle unlimited ulimits	COMMENT
LOW	.github/workflows/desec-api-version-watch.yml	1	name: deSEC API version watch	COMMENT
LOW	.github/workflows/dependency-updates.yml	21	cd ./php	COMMENT
LOW	.github/scripts/get-helm-chart-branch.sh	1	#!/bin/bash	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	Containers/borgbackup/backupscript.sh	220	# Create the backup	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	Containers/borgbackup/backupscript.sh	477	# More robust than e.g. xargs as I got a ~"args line too long" error while testing that, but it's slower	COMMENT

nextcloud/all-in-one

Open-Source Code Quality, Security and Technical Debt Review