1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

9.4K

Stars

Language

1.0M

Lines of Code

7.7K

Files

1.5K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1280 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 163 finding(s).

Agent Over-Engineering Ratio 3.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 625 finding(s).

PR Review Velocity Impact 7.4/100 · LOW

Which changes need focused human review? 1483 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 46LOW 1433

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1483 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers585 hits · 575 pts

Severity	File	Line	Snippet	Context
LOW	landing/src/pages/pricing/index.tsx	119	function SelfHostedPricingListItem({	CODE
LOW⚡	ci/tests/test_workflows.py	461	def test_failed_probe_does_not_report_a_cache_hit_or_stamp_artifacts(self):	STRING
LOW⚡	ci/tests/test_workflows.py	470	def test_failed_checks_leave_dev_outputs_without_stamping_artifacts(self):	STRING
LOW⚡	ci/tests/test_workflows.py	479	def test_failed_environment_does_not_stamp_or_build_artifacts(self):	STRING
LOW⚡	ci/tests/test_workflows.py	485	def test_failed_artifact_build_retains_both_cache_graphs(self):	STRING
LOW⚡	ci/tests/test_workflows.py	495	def test_check_only_job_does_not_stamp_or_package_artifacts(self):	STRING
LOW⚡	ci/tests/test_workflows.py	502	def test_project_pre_check_hooks_run(self):	STRING
LOW⚡	ci/tests/test_workflows.py	509	def test_failed_project_pre_check_stops_checks_and_artifacts(self):	STRING
LOW	ci/tests/test_workflows.py	276	def assert_no_artifacts_or_stamp(self):	STRING
LOW	ci/tests/test_workflows.py	284	def test_ordering_and_publication_gates(self):	STRING
LOW	ci/tests/test_workflows.py	335	def test_cache_roots_record_locked_inputs_but_not_self(self):	STRING
LOW	ci/tests/test_workflows.py	348	def test_development_checks_precede_versioned_artifacts(self):	STRING
LOW	ci/tests/test_workflows.py	399	def test_dev_artifact_build_reuses_integration_image_and_binary(self):	STRING
LOW	ci/tests/test_workflows.py	419	def test_binary_only_artifacts_can_still_prepare_an_image_for_checks(self):	STRING
LOW	ci/tests/test_workflows.py	427	def test_secondary_architecture_skips_checks_and_image_import(self):	STRING
LOW	ci/tests/test_workflows.py	438	def test_build_only_release_does_not_import_image_or_evaluate_checks(self):	STRING
LOW	ci/tests/test_workflows.py	450	def test_cached_checks_build_artifacts_without_environment_or_import(self):	STRING
LOW	ci/tests/test_workflows.py	526	def test_project_specific_evaluation_flags_are_preserved(self):	STRING
LOW	ci/tests/test_workflows.py	554	def test_auxiliary_images_keep_their_local_import(self):	STRING
LOW	ci/tests/test_workflows.py	562	def test_local_default_and_parallel_environment_startup(self):	STRING
LOW	ci/tests/test_workflows.py	577	def test_macos_build_only_does_not_evaluate_or_build_a_linux_image(self):	STRING
LOW⚡	ci/tests/test_ci_sync.py	148	def test_receiver_read_write_permissions_are_preserved(self):	CODE
LOW⚡	ci/tests/test_ci_sync.py	158	def test_read_only_modes_report_drift_without_writes(self):	CODE
LOW⚡	ci/tests/test_ci_sync.py	167	def test_unpublished_sources_can_only_preview(self):	CODE
LOW⚡	ci/tests/test_ci_sync.py	177	def test_local_content_and_mode_edits_prevent_all_writes(self):	CODE
LOW	ci/tests/test_ci_sync.py	123	def test_apply_updates_hashes_pin_and_modes_and_is_idempotent(self):	CODE
LOW	ci/tests/test_ci_sync.py	196	def test_bootstrap_missing_files_and_legacy_hash_only_entries(self):	CODE
LOW	ci/tests/test_ci_sync.py	210	def test_preview_of_new_destinations_does_not_create_directories(self):	CODE
LOW	ci/tests/test_ci_sync.py	222	def test_paths_are_data_not_shell_commands(self):	CODE
LOW	ci/tests/test_ci_sync.py	233	def test_unsafe_destinations_are_rejected(self):	CODE
LOW	ci/tests/test_ci_sync.py	262	def test_git_metadata_cannot_be_the_target_root(self):	CODE
LOW	ci/tests/test_ci_sync.py	271	def test_invalid_sources_and_destination_collisions_are_rejected(self):	CODE
LOW	ci/tests/test_ci_sync.py	288	def test_symlinked_files_and_parents_are_rejected(self):	CODE
LOW	ci/tests/test_ci_sync.py	316	def test_invalid_metadata_and_corrupt_bundle_fail_without_writes(self):	CODE
LOW	ci/tests/test_ci_sync.py	348	def test_interrupted_copy_can_be_retried_with_manifest_written_last(self):	CODE
LOW	ci/tests/test_ci_sync.py	367	def test_changes_during_preflight_are_not_overwritten(self):	CODE
LOW	ci/tests/test_ci_sync.py	389	def test_nix_bundle_is_exactly_the_shared_source_files(self):	CODE
LOW	ci/tests/test_ci_sync.py	425	def test_ci_documentation_does_not_override_repository_readme(self):	CODE
LOW	ci/tests/test_ci_sync.py	429	def test_documented_install_works_with_only_packaged_exports(self):	CODE
LOW	ci/tests/test_ci_sync.py	499	def test_packaged_command_previews_real_bundle_without_writes(self):	CODE
LOW	ci/tests/test_ci_sync.py	525	def test_packaged_command_help(self):	CODE
LOW	ci/tests/test_runner_sizing.py	32	def test_shared_check_callers_select_literal_runner_lists(self):	CODE
LOW	ci/tests/test_runner_sizing.py	64	def test_api_metadata_and_transfer_jobs_keep_original_runners(self):	CODE
LOW	ci/tests/test_runner_sizing.py	88	def test_project_builds_keep_main_runner_sizes(self):	CODE
LOW	ci/tests/test_runner_sizing.py	99	def test_release_builds_keep_main_default_sizes(self):	CODE
LOW	ci/tests/test_runner_sizing.py	113	def test_frontend_builds_and_browser_suites_are_sized_separately(self):	CODE
LOW	ci/tests/test_runner_sizing.py	141	def test_analysis_and_cache_warming_keep_workload_specific_runners(self):	CODE
LOW	ci/tests/test_shared_ci.py	58	def test_cache_target_defaults_and_workflow_forwarding(self):	CODE
LOW	ci/tests/test_shared_ci.py	88	def test_runner_matrix_uses_caller_labels_verbatim(self):	CODE
LOW	ci/tests/test_shared_ci.py	112	def test_artifact_platform_comes_from_the_actual_runner(self):	CODE
LOW	ci/tests/test_shared_ci.py	141	def test_cache_probe_uses_native_target_and_preserves_failures(self):	CODE
LOW	ci/tests/test_shared_ci.py	183	def test_publisher_defaults_and_architecture_selection(self):	CODE
LOW	ci/tests/test_shared_ci.py	267	def test_publisher_rejects_missing_image_manifests(self):	STRING
LOW	ci/tests/test_ci_contracts.py	25	def test_all_local_workflow_and_action_inputs_are_valid(self):	CODE
LOW	ci/tests/test_ci_contracts.py	49	def test_secret_bearing_pr_checks_preserve_approval_and_exact_sha(self):	CODE
LOW	ci/tests/test_ci_contracts.py	64	def test_runner_and_artifact_contracts(self):	CODE
LOW	ci/tests/test_ci_contracts.py	105	def test_variants_and_release_build_only_calls_are_preserved(self):	CODE
LOW	ci/tests/test_ci_contracts.py	118	def test_cli_image_loader_does_not_record_an_unused_nix_shell(self):	CODE
LOW	ci/tests/test_ci_contracts.py	128	def test_post_publication_nix_cache_is_best_effort(self):	CODE
LOW	ci/tests/test_ci_contracts.py	149	def test_shared_action_changes_trigger_pr_and_merge_queue_checks(self):	CODE
525 more matches not shown…

Over-Commented Block632 hits · 480 pts

Severity	File	Line	Snippet	Context
LOW	cliff.toml	21		COMMENT
LOW	…ding/src/components/common/icons/TickIcon/TickIcon.tsx	1	import { DetailedHTMLProps, HTMLProps } from 'react'	COMMENT
LOW	tools/govulncheck-wrapper/main.go	181	// version. Only non-allowlisted findings are considered; for modules referenced	COMMENT
LOW	internal/lib/pgmigrate/doc.go	1	// Package pgmigrate validates and applies versioned PostgreSQL migration	COMMENT
LOW	internal/lib/jsontmpl/fuzz_test.go	1	package jsontmpl_test	COMMENT
LOW	internal/lib/jsontmpl/derived_test.go	1	package jsontmpl_test	COMMENT
LOW	internal/lib/jsontmpl/jsontmpl.go	1	// Package jsontmpl is a Go port of hasura/kriti-lang, the JSON	COMMENT
LOW	internal/lib/jsontmpl/jsontmpl.go	181	Value jsontext.Value	COMMENT
LOW	internal/lib/jsontmpl/lexer/lexer.go	1	// Package lexer tokenises jsontmpl source. Hand-rolled mode-stack	COMMENT
LOW	internal/lib/jsontmpl/parser/golden_test.go	61	binder string // Range value binder name	COMMENT
LOW	internal/lib/jsontmpl/parser/golden_test.go	161	g.kids[0].dump(b, depth+1, showSpans)	COMMENT
LOW	internal/lib/jsontmpl/parser/parser.go	1	// Package parser builds jsontmpl ASTs from token streams. Hand-rolled	COMMENT
LOW	internal/lib/jsontmpl/parser/parser.go	21	// Binops are non-associative and do not chain (Grammar.y:60-63). The	COMMENT
LOW	internal/lib/jsontmpl/eval/value.go	21	// IEEE 754 double precision)	COMMENT
LOW	internal/lib/oapi/middleware/cors.go	21	)	COMMENT
LOW	internal/lib/oapi/middleware/cors.go	41	// inspect a function, so callers are responsible for not blanket-allowing	COMMENT
LOW	internal/lib/oapi/middleware/cors.go	61	// - nil: reflects client's Access-Control-Request-Headers	COMMENT
LOW	…/content/docs/reference/javascript/nhost-js/storage.md	41	console.log(JSON.stringify(uploadResp, null, 2));	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/main.md	41	const uplFilesResp = await nhost.storage.uploadFiles({	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/main.md	61	// "uploadedByUserId": "3357aada-b6c7-4af1-9655-1307ca2883a2",	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/main.md	101	// {	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/main.md	161	});	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/main.md	181	// "name": "file-2",	COMMENT
LOW	…src/content/docs/reference/javascript/nhost-js/auth.md	61	// error: 'invalid-email-password',	COMMENT
LOW	…/content/docs/reference/javascript/nhost-js/graphql.md	61	genre	COMMENT
LOW	…/content/docs/reference/javascript/nhost-js/graphql.md	161		COMMENT
LOW	…/content/docs/reference/javascript/nhost-js/graphql.md	221	const resp = error as FetchError<GraphQLResponse>;	COMMENT
LOW	cli/cmd/configserver/local.go	21	// for every secret loaded from .secrets, so real secret material never enters	COMMENT
LOW	cli/internal/schemadiff/schemadiff.go	1	// Package schemadiff provides utilities for parsing two GraphQL schemas,	COMMENT
LOW	cli/dockercompose/compose.go	821		COMMENT
LOW	dashboard/CHANGELOG.md	361	- (dashboard) Migrate account/settings forms from Button v2 to v3 (#4667)	COMMENT
LOW	dashboard/CHANGELOG.md	381	# examples/quickstarts/react/pnpm-lock.yaml	COMMENT
LOW	examples/quickstarts/svelte/src/vite-env.d.ts	1	/// <reference types="svelte" />	COMMENT
LOW	packages/stripe-graphql-js/CHANGELOG.md	21	# docs/pnpm-lock.yaml	COMMENT
LOW	…/stripe-graphql-js/src/schema/customer-tax-location.ts	21	// type Source = 'billing_address' \| 'ip_address' \| 'payment_method' \| 'shipping_destination'	COMMENT
LOW	…ckages/stripe-graphql-js/src/schema/payment-methods.ts	21	// type: t({ // unable to get this to work	COMMENT
LOW	packages/nhost-js/src/auth/__tests__/docstrings.test.ts	41	throw err; // Re-throw if it's not a FetchError	COMMENT
LOW	…ages/nhost-js/src/storage/__tests__/docstrings.test.ts	21	// Upload files to storage	COMMENT
LOW	…ages/nhost-js/src/storage/__tests__/docstrings.test.ts	41	// "uploadedByUserId": "",	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	41	// {	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	61	// "updatedAt": "2025-05-09T17:26:04.596831+00:00",	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	101	// "name": "file-2",	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	161	],	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	181	// "id": "3f189004-21fd-42d0-be1d-1ead021ab167",	COMMENT
LOW	packages/nhost-js/src/__tests__/docstrings.test.ts	221	// {	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	21	director	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	41	// {	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	121	}	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	141	// title: 'The Godfather',	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	281	// {	COMMENT
LOW	…ages/nhost-js/src/graphql/__tests__/docstrings.test.ts	341	// "message": "field 'restrictedObject' not found in type: 'query_root'",	COMMENT
LOW	.github/workflows/gen_codeql-analysis.yml	41		COMMENT
LOW	.github/workflows/ci_safe_to_test.yaml	1	---	COMMENT
LOW	services/auth/go/oidc/idtoken.go	181	return ErrNonceMismatch	COMMENT
LOW	services/auth/go/controller/mock/validator.go	1	// Code generated by MockGen. DO NOT EDIT.	COMMENT
LOW	services/auth/go/api/server.gen.go	21	"github.com/gin-gonic/gin"	COMMENT
LOW	services/auth/go/api/server.gen.go	41	ElevateOTPEmail(c *gin.Context)	COMMENT
LOW	services/auth/go/api/server.gen.go	61	// (GET /healthz)	COMMENT
LOW	services/auth/go/api/server.gen.go	81	// OAuth2 Provider JWKS Endpoint	COMMENT
LOW	services/auth/go/api/server.gen.go	101	Oauth2UserinfoPost(c *gin.Context)	COMMENT
572 more matches not shown…

Fake / Example Data158 hits · 162 pts

Severity	File	Line	Snippet	Context
LOW	README.md	110	email: 'user@example.com',	CODE
LOW	cli/cmd/config/example.go	199	Allowed: []string{"asd@example.org"},	CODE
LOW	dashboard/e2e/utils.ts	441	.fill('123 Main Street');	CODE
LOW	…tabaseRecordInputGroup/NullDefaultToggleField.test.tsx	46	expect(input).toHaveAttribute('placeholder', 'NULL');	CODE
LOW	…tabaseRecordInputGroup/NullDefaultToggleField.test.tsx	57	expect(input).toHaveAttribute('placeholder', 'some_default');	CODE
LOW	…baseRecordInputGroup/DatabaseRecordInputGroup.test.tsx	55	'placeholder',	CODE
LOW	…/DatabaseRecordInputGroup/TemporalRecordField.test.tsx	90	expect(screen.getByRole('combobox')).toHaveAttribute('placeholder', 'NULL');	CODE
LOW	…/DatabaseRecordInputGroup/TemporalRecordField.test.tsx	116	'placeholder',	CODE
LOW⚡	…seTableForm/ColumnEditorRow/DefaultValueInput.test.tsx	51	describe('placeholder', () => {	CODE
LOW⚡	…seTableForm/ColumnEditorRow/DefaultValueInput.test.tsx	54	expect(getInput()).toHaveAttribute('placeholder', 'NULL');	CODE
LOW⚡	…seTableForm/ColumnEditorRow/DefaultValueInput.test.tsx	59	expect(getInput()).toHaveAttribute('placeholder', 'NO DEFAULT VALUE');	CODE
LOW	…ComputedFieldsSection/ComputedFieldFormFields.test.tsx	198	'placeholder',	CODE
LOW	…tFieldsSection/CustomGraphQLRootFieldsSection.test.tsx	259	'placeholder',	CODE
LOW	…taGrid/hooks/useTableQuery/createTableQueryKey.test.ts	198	{ column: 'email', op: '=', value: 'user@example.com', id: 'id' },	CODE
LOW	…RequestBody/buildServerlessFunctionRequestBody.test.ts	54	{ key: 'name', value: 'John Doe' },	CODE
LOW	…components/BaseCronTriggerForm/BaseCronTriggerForm.tsx	280	"name": "John Doe",	CODE
LOW	…-offs/components/CreateOneOffForm/CreateOneOffForm.tsx	100	"name": "John Doe",	CODE
LOW	…components/CreateOrgFormDialog/CreateOrgFormDialog.tsx	111	<Input placeholder="Acme Inc" {...field} />	CODE
LOW	…nents/CreateOrgFormDialog/CreateOrgFormDialog.test.tsx	81	'Acme Inc',	CODE
LOW	…general/components/GeneralSettings/GeneralSettings.tsx	101	<Input placeholder="Acme Inc" {...field} />	CODE
LOW	…mand-palette/components/CommandPaletteTrigger.test.tsx	604	'placeholder',	CODE
LOW	…mand-palette/components/CommandPaletteTrigger.test.tsx	616	'placeholder',	CODE
LOW	…mand-palette/components/CommandPaletteTrigger.test.tsx	847	expect(input).toHaveAttribute('placeholder', 'Search or navigate to...');	CODE
LOW	…mand-palette/components/CommandPaletteTrigger.test.tsx	1014	expect(input).toHaveAttribute('placeholder', 'Search or navigate to...');	CODE
LOW	dashboard/src/components/ui/v3/avatar.test.tsx	6	render(<Avatar name="Jane Doe" />);	CODE
LOW	dashboard/src/components/ui/v3/avatar.test.tsx	24	render(<Avatar name="Jane Doe" fallback="JD" />);	CODE
LOW	dashboard/src/pages/onboarding/index.tsx	325	<Input placeholder="Acme Inc" {...field} />	CODE
LOW	packages/nhost-js/README.md	31	email: 'user@example.com',	CODE
LOW	services/auth/go/cryto/crypto_test.go	207	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	services/auth/go/cryto/crypto_test.go	207	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	services/auth/go/providers/upstream_params_test.go	52	"login_hint": "user@example.com",	CODE
LOW	services/auth/go/providers/upstream_params_test.go	60	"login_hint": "user@example.com",	CODE
LOW	services/auth/go/providers/bitbucket_internal_test.go	137	t.Context(), srv.URL, "fake-token",	CODE
LOW	services/auth/go/oauth2/userinfo_test.go	28	DisplayName: "John Doe",	CODE
LOW	services/auth/go/oauth2/userinfo_test.go	59	Name: new("John Doe"),	CODE
LOW	services/auth/go/oauth2/userinfo_test.go	200	Name: new("John Doe"),	CODE
LOW	services/auth/go/oauth2/userinfo_test.go	410	Name: new("John Doe"),	CODE
LOW	services/auth/go/oauth2/token_test.go	555	Return("fake-token", nil).	CODE
LOW	services/auth/go/oauth2/token_test.go	580	if *resp.IdToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	581	t.Errorf("expected id_token 'fake-token', got %q", *resp.IdToken)	CODE
LOW	services/auth/go/oauth2/token_test.go	1225	Return("fake-token", nil).	CODE
LOW	services/auth/go/oauth2/token_test.go	1251	if *resp.IdToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	1252	t.Errorf("expected id_token 'fake-token', got %q", *resp.IdToken)	CODE
LOW	services/auth/go/oauth2/token_test.go	1328	return "fake-token", nil	CODE
LOW	services/auth/go/oauth2/token_test.go	1375	if resp.AccessToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	1376	t.Errorf("expected access token 'fake-token', got %q", resp.AccessToken)	CODE
LOW	services/auth/go/oauth2/token_test.go	1397	return "fake-token", nil	CODE
LOW	services/auth/go/oauth2/token_test.go	1429	if resp.AccessToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	1430	t.Errorf("expected access token 'fake-token', got %q", resp.AccessToken)	CODE
LOW	services/auth/go/oauth2/token_test.go	1551	Return("fake-token", nil)	CODE
LOW	services/auth/go/oauth2/token_test.go	1572	if resp.AccessToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	1573	t.Errorf("expected access token 'fake-token', got %q", resp.AccessToken)	CODE
LOW	services/auth/go/oauth2/token_test.go	1600	Return("fake-token", nil)	CODE
LOW	services/auth/go/oauth2/token_test.go	1621	if resp.AccessToken != "fake-token" {	CODE
LOW	services/auth/go/oauth2/token_test.go	1622	t.Errorf("expected access token 'fake-token', got %q", resp.AccessToken)	CODE
LOW	…ices/auth/go/controller/verify_elevate_otp_sms_test.go	126	DisplayName: "Jane Doe",	CODE
LOW	…ices/auth/go/controller/verify_elevate_otp_sms_test.go	226	DisplayName: "Jane Doe",	CODE
LOW	…ces/auth/go/controller/verify_sign_in_mfa_totp_test.go	34	DisplayName: "Jane Doe",	CODE
LOW	…ces/auth/go/controller/verify_sign_in_mfa_totp_test.go	110	DisplayName: "Jane Doe",	CODE
LOW	…es/auth/go/controller/sign_in_passwordless_sms_test.go	323	DisplayName: "Jane Doe",	CODE
98 more matches not shown…

Decorative Section Separators38 hits · 146 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/betterleaks/betterleaks.toml	368	# =================================================================================	STRING
MEDIUM	docs/public/openapi/auth.yaml	1957	# =========================================================================	COMMENT
MEDIUM	docs/public/openapi/auth.yaml	1959	# =========================================================================	COMMENT
MEDIUM	docs/public/openapi/auth.yaml	3837	# =========================================================================	COMMENT
MEDIUM	docs/public/openapi/auth.yaml	3839	# =========================================================================	COMMENT
MEDIUM	docs/src/schemas/auth.yaml	1957	# =========================================================================	COMMENT
MEDIUM	docs/src/schemas/auth.yaml	1959	# =========================================================================	COMMENT
MEDIUM	docs/src/schemas/auth.yaml	3837	# =========================================================================	COMMENT
MEDIUM	docs/src/schemas/auth.yaml	3839	# =========================================================================	COMMENT
MEDIUM	services/auth/docs/openapi.yaml	1957	# =========================================================================	COMMENT
MEDIUM	services/auth/docs/openapi.yaml	1959	# =========================================================================	COMMENT
MEDIUM	services/auth/docs/openapi.yaml	3837	# =========================================================================	COMMENT
MEDIUM	services/auth/docs/openapi.yaml	3839	# =========================================================================	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	47	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	52	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	263	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	266	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	302	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/integration/sqlite/setup.sh	304	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	10	// ┌─────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	15	// └─────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	18	// ┌───────────────────────────────────┐ ┌───────────────────────────────────┐	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	24	// │ - OnClose: cleanup │ └───────────────────────────────────┘	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	25	// └───────────────────────────────────┘	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	79	// ┌─────────────┐	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	81	// └─────────────┘	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	83	// ┌─────────────┐	COMMENT
MEDIUM⚡	services/constellation/controller/websocket/doc.go	85	// └─────────────┘	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	9	// ┌─────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	13	// └─────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	16	// ┌─────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	22	// └─────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	25	// ┌─────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	30	// └─────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	33	// ┌─────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	…rvices/constellation/connector/sql/subscription/doc.go	39	// └─────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM	services/constellation/api/openapi.yaml	390	# ================================================================	COMMENT
MEDIUM	services/constellation/api/openapi.yaml	392	# ================================================================	COMMENT

Verbosity Indicators21 hits · 41 pts

Severity	File	Line	Snippet	Context
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	86	// Step 1: Request a registration challenge from the server	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	105	// Step 2: Browser prompts user to create a new credential	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	120	// Step 3: Send the credential attestation to the server for verification	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	133	// Step 4: Handle registration success	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	168	// Step 1: Request challenge from server	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	173	// Step 2: Browser prompts user for security key or biometric verification	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	185	// Step 3: Send credential public key back to server for verification	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	193	// Step 4: Registration successful - update UI	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	41	// Step 1: Request a challenge from the server for credential discovery	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	47	// Step 2: Browser prompts user for their security key or biometric verification	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	61	// Step 3: Send the signed challenge to the server for verification	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	68	// Step 4: Handle authentication result	COMMENT
LOW	services/auth/go/providers/bitbucket.go	66	// Step 1: Get user profile from Bitbucket	COMMENT
LOW	services/auth/go/providers/bitbucket.go	78	// Step 2: Get email	COMMENT
LOW	services/auth/go/providers/bitbucket.go	119	// Step 3: Return profile. We only reach this point after selecting a	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	48	# Step 1: Create the SQLite schema.	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	264	# Step 2: Dump data from PostgreSQL and convert	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	303	# Step 3: Import data into SQLite.	COMMENT
LOW⚡	…ices/constellation/controller/websocket/server_test.go	553	// Step 1: connection_init	COMMENT
LOW⚡	…ices/constellation/controller/websocket/server_test.go	561	// Step 2: subscribe	COMMENT
LOW	…ices/constellation/controller/websocket/server_test.go	577	// Step 3: complete	COMMENT

Structural Annotation Overuse21 hits · 41 pts

Severity	File	Line	Snippet	Context
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	86	// Step 1: Request a registration challenge from the server	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	105	// Step 2: Browser prompts user to create a new credential	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	120	// Step 3: Send the credential attestation to the server for verification	COMMENT
LOW	…demos/react-demo/src/components/WebAuthnSignUpForm.tsx	133	// Step 4: Handle registration success	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	168	// Step 1: Request challenge from server	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	173	// Step 2: Browser prompts user for security key or biometric verification	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	185	// Step 3: Send credential public key back to server for verification	COMMENT
LOW⚡	…mples/demos/react-demo/src/components/SecurityKeys.tsx	193	// Step 4: Registration successful - update UI	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	41	// Step 1: Request a challenge from the server for credential discovery	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	47	// Step 2: Browser prompts user for their security key or biometric verification	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	61	// Step 3: Send the signed challenge to the server for verification	COMMENT
LOW⚡	…demos/react-demo/src/components/WebAuthnSignInForm.tsx	68	// Step 4: Handle authentication result	COMMENT
LOW	services/auth/go/providers/bitbucket.go	66	// Step 1: Get user profile from Bitbucket	COMMENT
LOW	services/auth/go/providers/bitbucket.go	78	// Step 2: Get email	COMMENT
LOW	services/auth/go/providers/bitbucket.go	119	// Step 3: Return profile. We only reach this point after selecting a	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	48	# Step 1: Create the SQLite schema.	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	264	# Step 2: Dump data from PostgreSQL and convert	COMMENT
LOW⚡	services/constellation/integration/sqlite/setup.sh	303	# Step 3: Import data into SQLite.	COMMENT
LOW⚡	…ices/constellation/controller/websocket/server_test.go	553	// Step 1: connection_init	COMMENT
LOW⚡	…ices/constellation/controller/websocket/server_test.go	561	// Step 2: subscribe	COMMENT
LOW	…ices/constellation/controller/websocket/server_test.go	577	// Step 3: complete	COMMENT

Cross-Language Confusion4 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	ci/tests/test_workflows.py	255	"inputs.BUILD && inputs.DOCKER && runner.os != 'macOS'": lambda: (	STRING
HIGH	ci/tests/test_workflows.py	325	"inputs.BUILD && inputs.DOCKER && runner.os != 'macOS'",	STRING
HIGH	ci/tests/test_shared_ci.py	84	"inputs.LOGIN_ECR && env.RUN_CHECKS == 'true'",	CODE
HIGH	ci/tests/test_shared_ci.py	109	"${{ inputs.CHECKS && matrix.runner == fromJSON(inputs.RUNS_ON)[0] }}",	CODE

Deep Nesting10 hits · 9 pts

Severity	File	Line	Context
LOW	ci/tests/test_ci_sync.py	177	CODE
LOW	ci/tests/test_ci_sync.py	316	CODE
LOW	ci/tests/test_runner_sizing.py	32	CODE
LOW	ci/tests/test_shared_ci.py	183	CODE
LOW	ci/tests/test_ci_contracts.py	25	CODE
LOW	ci/tests/test_ci_contracts.py	105	CODE
LOW	ci/tests/test_ci_contracts.py	149	CODE
LOW	ci/tests/test_ci_contracts.py	168	CODE
LOW	.github/actions/cache-nix/test_cache.py	233	CODE
LOW	…ces/postgres/extensions/check-pg-jsonschema-upgrade.py	60	CODE

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/gen.sh	19	# Create a temporary file	COMMENT
MEDIUM	packages/nhost-js/src/index.ts	22	* ### Creating an admin client	COMMENT

AI Slop Vocabulary2 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM	…hboard/src/components/layout/BaseLayout/BaseLayout.tsx	17	// TODO: Refactor modal management to utilize `DialogProvider` instead.	COMMENT
MEDIUM	services/auth/email-templates/en/elevate-otp/body.html	13	<p style="font-size: 15px; line-height: 1.4; margin: 0 0 10px; color: #3c4149">Use the following code to ele	CODE

Example Usage Blocks3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	services/constellation/benchmark/check.sh	11	# Usage:	COMMENT
LOW	services/constellation/integration/main_test.go	29	// Usage example:	COMMENT
LOW	services/constellation/integration/sqlite/setup.sh	6	# Usage:	COMMENT

Modern AI Meta-Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/ghactivity/README.md	117	7. `### 🎯 Today's focus` — scaffolding for the human to fill in.	CODE
MEDIUM	tools/ghactivity/README.md	118	8. `### 📝 Other` — scaffolding for the human to fill in.	CODE

Excessive Try-Catch Wrapping2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/actions/cache-nix/test_cache.py	83	print("An error occurred (403): Forbidden", file=sys.stderr)	CODE
MEDIUM	.github/actions/cache-nix/test_cache.py	87	print("An error occurred (404): Not Found", file=sys.stderr)	CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	services/postgres/postgres/bin/init.sh	72	# Check if postgres process is still running	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	dashboard/public/mockServiceWorker.js	137	async function handleRequest(event, requestId) {	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…ces/postgres/extensions/check-pg-jsonschema-upgrade.py	1		CODE

nhost/nhost

Open-Source Code Quality, Security and Technical Debt Review