1.2

Adjusted Signal

1.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

5.1K

Stars

C++

Language

98.3K

Lines of Code

249

Files

120

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 117 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 6.0/100 · LOW

Which changes need focused human review? 120 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 1LOW 119

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 120 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block105 hits · 105 pts

Severity	File	Line	Snippet	Context
LOW	CMakeLists.txt	1	# nghttp2 - HTTP/2 C Library	COMMENT
LOW	CMakeLists.txt	361	# AC_TYPE_UINT64_T	COMMENT
LOW	author.py	1	#!/usr/bin/env python3	COMMENT
LOW	help2rst.py	1	#!/usr/bin/env python3	COMMENT
LOW	help2rst.py	21	# The positional argument is enclosed with < and >:	COMMENT
LOW	tests/main.c	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	tests/nghttp2_session_test.c	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	integration-tests/nghttpx_http1_test.go	121	// res, err := st.http1(requestParam{	COMMENT
LOW	integration-tests/nghttpx_http1_test.go	1361		COMMENT
LOW	integration-tests/nghttpx_http2_test.go	821	}	COMMENT
LOW	integration-tests/nghttpx_http2_test.go	2781	// st.ts.Close()	COMMENT
LOW	contrib/tlsticketupdate.go	1	//	COMMENT
LOW	examples/libevent-client.c	41	#ifdef HAVE_UNISTD_H	COMMENT
LOW	examples/libevent-server.c	41	# include <sys/socket.h>	COMMENT
LOW	examples/libevent-server.c	61	#endif /* !defined(__sgi) */	COMMENT
LOW	examples/client.c	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	examples/client.c	41	#include <sys/types.h>	COMMENT
LOW	lib/nghttp2_hd.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	lib/nghttp2_frame.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	lib/nghttp2_option.h	61	#define NGHTTP2_OPT_NO_HTTP_MESSAGING 0x08U	COMMENT
LOW	lib/nghttp2_session.c	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	lib/nghttp2_net.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	lib/nghttp2_stream.h	101	#define NGHTTP2_HTTP_FLAG__AUTHORITY 0x01U	COMMENT
LOW	lib/sfparse.c	41	#define SFPARSE_STATE_INNER_LIST 0x04U	COMMENT
LOW	lib/nghttp2_session.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	lib/includes/nghttp2/nghttp2.h	41	#endif	COMMENT
LOW	lib/includes/nghttp2/nghttp2.h	61	(__has_declspec_attribute(dllexport) && __has_declspec_attribute(dllimport))	COMMENT
LOW	doc/CMakeLists.txt	221	set(PAPEROPT_a4 -D latex_paper_size=a4)	COMMENT
LOW	doc/mkapiref.py	1	#!/usr/bin/env python3	COMMENT
LOW	third-party/llhttp/include/llhttp.h	541	#ifdef __cplusplus	COMMENT
LOW	third-party/llhttp/src/llhttp.c	1	#include <stdlib.h>	COMMENT
LOW	src/shrpx_http3_upstream.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_http2_downstream_connection.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_rate_limit.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_quic.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/memchunk.h	41	#include <cassert>	COMMENT
LOW	src/shrpx_connection.h	41	#else // !defined(NGHTTP2_OPENSSL_IS_WOLFSSL)	COMMENT
LOW	src/tls.h	61	// for TLSv1.3 by mozilla.	COMMENT
LOW	src/shrpx_live_check.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_tls.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_tls.h	41	# include <openssl/ssl.h>	COMMENT
LOW	src/shrpx_tls.h	141	// Wildcard host sharing only suffix is probably rare, so we just do	COMMENT
LOW	src/shrpx_tls.h	161	//	COMMENT
LOW	src/shrpx_tls.h	281		COMMENT
LOW	src/app_helper.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_worker_process.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_memcached_dispatcher.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/h2load.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/h2load.h	41	#include <unordered_map>	COMMENT
LOW	src/h2load.h	61	# include <ngtcp2/ngtcp2_crypto_ossl.h>	COMMENT
LOW	src/h2load.h	141	bool base_uri_unix{};	COMMENT
LOW	src/h2load.h	281	// subset of req_failed.	COMMENT
LOW	src/shrpx_quic_connection_handler.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_client_handler.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_dns_resolver.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_dns_resolver.h	61	// \|result\| points to the resolved address. Note that port portion of	COMMENT
LOW	src/ssl_compat.h	81	# ifdef NGHTTP2_GENUINE_OPENSSL	COMMENT
LOW	src/shrpx_config.h	21	* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION	COMMENT
LOW	src/shrpx_config.h	41	#include <cinttypes>	COMMENT
LOW	src/shrpx_config.h	501	std::string_view hostport;	COMMENT
45 more matches not shown…

Deep Nesting8 hits · 8 pts

Severity	File	Line	Context
LOW	mkhufftbl.py	362	CODE
LOW	doc/mkapiref.py	122	CODE
LOW	doc/mkapiref.py	226	CODE
LOW	doc/mkapiref.py	249	CODE
LOW	doc/_exts/rubydomain/rubydomain.py	95	CODE
LOW	doc/_exts/rubydomain/rubydomain.py	336	CODE
LOW	doc/_exts/rubydomain/rubydomain.py	488	CODE
LOW	doc/_exts/rubydomain/rubydomain.py	608	CODE

Unused Imports3 hits · 3 pts

Severity	File	Line	Context
LOW	mkhufftbl.py	11	CODE
LOW	mkcipherlist.py	11	CODE
LOW	doc/mkapiref.py	30	CODE

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/shrpx_worker.h	122	// utilize TCP connection.	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	src/shrpx_api_downstream_connection.h	38	// If new method is added, don't forget to update API_METHOD_STRING as	COMMENT

Hyper-Verbose Identifiers2 hits · 1 pts

Severity	File	Line	Snippet	Context
LOW	mkhufftbl.py	356	def huffman_tree_build_transition_table(ctx):	STRING
LOW	mkhufftbl.py	389	def huffman_tree_print_transition_table(ctx):	STRING

nghttp2/nghttp2

Open-Source Code Quality, Security and Technical Debt Review