1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

7.7K

Stars

JavaScript

Language

204.1K

Lines of Code

812

Files

179

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 174 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 2.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 104 finding(s).

PR Review Velocity Impact 4.5/100 · LOW

Which changes need focused human review? 179 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 174

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 179 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers99 hits · 99 pts

Severity	File	Line	Snippet	Context
LOW	test/retry-handler-controller-proxy.js	22	function activeConnectionController () {	CODE
LOW	test/no-strict-content-length.js	22	function assertEmitWarningCalledAndReset () {	CODE
LOW	test/client-pipelining.js	455	function pipeliningNonIdempotentWithBody (bodyType) {	CODE
LOW	test/mock-interceptor-unused-assertions.js	30	function mockAgentWithOneInterceptor () {	CODE
LOW	test/websocket/pong-backpressure.js	13	function createBackpressuredSocket () {	CODE
LOW	test/node-test/client-errors.js	125	function installErrorAndReconnectServer (server, p, { contentLength, trackPostWithPlan }) {	CODE
LOW	test/node-test/client-errors.js	238	function errorAndChunkedEncodingPipelining (type) {	CODE
LOW	test/node-test/abort-controller.js	190	function writeHeadersStartedWithBody (body, type) {	CODE
LOW	test/node-test/abort-event-emitter.js	211	function writeHeadersStartedWithBody (body, type) {	CODE
LOW	test/utils/node-http.js	12	function closeClientAndServerAsPromise (client, server) {	CODE
LOW	test/utils/redirecting-servers.js	90	async function startRedirectingWithBodyServer () {	CODE
LOW	test/utils/redirecting-servers.js	107	function startRedirectingWithoutLocationServer () {	CODE
LOW	test/utils/redirecting-servers.js	125	async function startRedirectingChainServers () {	CODE
LOW	test/utils/redirecting-servers.js	168	async function startRedirectingWithAuthorization (authorization) {	CODE
LOW	test/utils/redirecting-servers.js	191	async function startRedirectingWithCookie (cookie) {	CODE
LOW	test/utils/redirecting-servers.js	214	async function startRedirectingWithRelativePath (t) {	CODE
LOW	test/utils/redirecting-servers.js	235	async function startRedirectingWithQueryParams (t) {	CODE
LOW	test/utils/h2-disconnect-guard.js	13	function guardAgainstUnexpectedDisconnect (t, client) {	CODE
LOW	test/fetch/issue-4897.js	6	function createAssertingDispatcher (t, expectedPath) {	CODE
LOW	test/fetch/issue-4897.js	25	async function assertCredentialsRejected (t, url) {	CODE
LOW	lib/handler/cache-handler.js	108	function appendConnectionHeaderTokens (headersToRemove, connectionHeader) {	CODE
LOW	lib/handler/cache-handler.js	617	function deleteCachedValueIfNotModified (statusCode, store, cacheKey) {	CODE
LOW	lib/handler/cache-handler.js	629	function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheControlDirectives) {	CODE
LOW	lib/handler/retry-handler.js	13	function calculateRetryAfterHeader (retryAfter) {	CODE
LOW	lib/handler/retry-handler.js	18	function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {	CODE
LOW	lib/core/util.js	416	function bufferToLowerCasedHeaderName (value) {	CODE
LOW	lib/core/util.js	938	function getProtocolFromUrlStringSlow (urlString) {	CODE
LOW	lib/core/request.js	31	function isValidContentLengthHeaderValue (val) {	CODE
LOW	lib/core/connect.js	178	function maybeNormalizeConnectError (err, socket, opts) {	CODE
LOW	lib/cache/sqlite-cache-store.js	579	function isCompressibleContentType (contentType) {	CODE
LOW	lib/util/cache.js	55	function splitCacheControlHeaderValue (value) {	CODE
LOW	lib/util/cache.js	106	function markInvalidCacheControlDirective (directives, key) {	CODE
LOW	lib/util/cache.js	119	function hasInvalidCacheControlDirective (directives, key) {	CODE
LOW	lib/util/cache.js	123	function getMalformedRestrictiveDirectiveName (key) {	CODE
LOW	lib/util/cache.js	647	function isInvalidOrWildcardVaryHeader (varyHeader) {	CODE
LOW	lib/util/runtime-features.js	16	function detectRuntimeFeatureByNodeModule (moduleName) {	CODE
LOW	lib/web/eventsource/eventsource-stream.js	78	function createMaxEventSizeExceededError () {	CODE
LOW	lib/web/eventsource/util.js	28	function createPotentialCORSRequest (url, destination, corsAttributeState, sameOriginFallback) {	CODE
LOW	lib/web/websocket/util.js	288	function validateCloseCodeAndReason (code, reason) {	CODE
LOW	lib/web/websocket/connection.js	26	function establishWebSocketConnection (url, protocols, client, handler, options) {	CODE
LOW	lib/web/websocket/stream/websocketerror.js	8	function createInheritableDOMException () {	CODE
LOW	lib/web/infra/index.js	14	function collectASequenceOfCodePoints (condition, input, position) {	CODE
LOW	lib/web/infra/index.js	41	function collectASequenceOfCodePointsFast (char, input, position) {	CODE
LOW	lib/web/infra/index.js	216	function serializeJavascriptValueToJSONString (value) {	CODE
LOW	lib/web/fetch/data-url.js	397	function collectAnHTTPQuotedString (input, position, extractValue = false) {	CODE
LOW	lib/web/fetch/data-url.js	536	function minimizeSupportedMimeType (mimeType) {	CODE
LOW	lib/web/fetch/util.js	201	function setRequestReferrerPolicyOnRedirect (request, actualResponse) {	CODE
LOW	lib/web/fetch/util.js	213	function crossOriginResourcePolicyCheck () {	CODE
LOW	lib/web/fetch/util.js	261	function appendRequestOriginHeader (request) {	CODE
LOW	lib/web/fetch/util.js	322	function clampAndCoarsenConnectionTimingInfo (connectionTimingInfo, defaultStartTime, crossOriginIsolatedCapability) {	CODE
LOW	lib/web/fetch/util.js	345	function coarsenedSharedCurrentTime (crossOriginIsolatedCapability) {	CODE
LOW	lib/web/fetch/util.js	386	function determineRequestsReferrer (request) {	CODE
LOW	lib/web/fetch/util.js	575	function isOriginIPPotentiallyTrustworthy (origin) {	CODE
LOW	lib/web/fetch/util.js	600	function isOriginPotentiallyTrustworthy (origin) {	CODE
LOW	lib/web/fetch/util.js	661	function isURLPotentiallyTrustworthy (url) {	CODE
LOW	lib/web/fetch/util.js	688	function tryUpgradeRequestToAPotentiallyTrustworthyURL (request) {	CODE
LOW	lib/web/fetch/response.js	479	function makeAppropriateNetworkError (fetchParams, err = null) {	CODE
LOW	lib/web/fetch/index.js	79	function appendHeadersListFromResponseHeaders (headersList, headers, rawHeaders) {	CODE
LOW	lib/web/fetch/index.js	2217	function dispatchWithProtocolPreference (body, allowH2) {	CODE
LOW	lib/web/fetch/formdata-parser.js	209	function parseContentDispositionAttribute (input, position) {	CODE
39 more matches not shown…

Over-Commented Block64 hits · 64 pts

Severity	File	Line	Snippet	Context
LOW	test/http2-resume-null-request.js	1	'use strict'	COMMENT
LOW	test/issue-4880.js	1	'use strict'	COMMENT
LOW	test/issue-5356.js	1	'use strict'	COMMENT
LOW	test/http2-request-never-settles.js	21	// version gate here once a Node.js 22.x release carries the fix.	COMMENT
LOW	test/tls.js	1	'use strict'	COMMENT
LOW	test/tls.js	21		COMMENT
LOW	test/tls.js	41	// t.error(err)	COMMENT
LOW	test/tls.js	61	// method: 'GET',	COMMENT
LOW	test/tls.js	81		COMMENT
LOW	test/tls.js	101		COMMENT
LOW	test/tls.js	121		COMMENT
LOW	test/tls.js	141	// .resume()	COMMENT
LOW	test/tls.js	161	// }, (err, data) => {	COMMENT
LOW	test/tls.js	181	// headers: {	COMMENT
LOW	test/http2-response-after-completion.js	1	'use strict'	COMMENT
LOW	test/get-head-body.js	121	// // This URL will send double responses when receiving a	COMMENT
LOW	test/cookie/cookies.js	1	// MIT License	COMMENT
LOW	test/cookie/npm-cookie.js	1	'use strict'	COMMENT
LOW	test/busboy/test-parser.js	1	'use strict'	COMMENT
LOW	test/busboy/formdata-test.js	1	'use strict'	COMMENT
LOW	docs/docs/api/MockAgent.md	461		COMMENT
LOW	docs/docs/api/MockAgent.md	521		COMMENT
LOW	.github/workflows/codeql.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/ci.yml	261	with:	COMMENT
LOW	lib/handler/retry-handler.js	41	// flow-controlling the original (now-dead) controller while data flows on the	COMMENT
LOW	lib/web/eventsource/eventsource-stream.js	221	this.consumeCurrentByte()	COMMENT
LOW	lib/web/eventsource/eventsource.js	261	fetchParams.processResponseEndOfBody = processEventSourceEndOfBody	COMMENT
LOW	lib/web/eventsource/eventsource.js	361		COMMENT
LOW	lib/web/websocket/receiver.js	21	// This code was influenced by ws released under the MIT license.	COMMENT
LOW	lib/web/websocket/websocket.js	261	// 2. Run the appropriate set of steps from the following list:	COMMENT
LOW	lib/web/websocket/websocket.js	281		COMMENT
LOW	lib/web/websocket/websocket.js	301	this.#bufferedAmount += data.byteLength	COMMENT
LOW	lib/web/websocket/websocket.js	621	// at the WebSocket object.	COMMENT
LOW	lib/web/websocket/connection.js	121	// list values given `Sec-WebSocket-Protocol` and response’s	COMMENT
LOW	lib/web/websocket/connection.js	141	failHandshake(handler, response, 1002, 'Server did not set Upgrade header to "websocket".')	COMMENT
LOW	lib/web/fetch/util.js	261	function appendRequestOriginHeader (request) {	COMMENT
LOW	lib/web/fetch/util.js	761	// 1. Let interface be the interface for which the iterator prototype object exists.	COMMENT
LOW	lib/web/fetch/request.js	241	unsafeRequest: request.unsafeRequest,	COMMENT
LOW	lib/web/fetch/index.js	241	// 12. Let handleFetchDone given response response be to finalize and	COMMENT
LOW	lib/web/fetch/index.js	521	// "image"	COMMENT
LOW	lib/web/fetch/index.js	601	// - request’s current URL’s scheme is "http"	COMMENT
LOW	lib/web/fetch/index.js	681	}	COMMENT
LOW	lib/web/fetch/index.js	721	internalResponse.urlList.push(...request.urlList)	COMMENT
LOW	lib/web/fetch/index.js	1721	// 2. If request’s body is non-null, then:	COMMENT
LOW	lib/web/fetch/index.js	1741	if (request.useURLCredentials === undefined \|\| isAuthenticationFetch) {	COMMENT
LOW	lib/web/fetch/index.js	1881	// 8. Switch on request’s mode:	COMMENT
LOW	lib/web/fetch/index.js	1901		COMMENT
LOW	lib/web/fetch/index.js	1921		COMMENT
LOW	lib/web/fetch/index.js	2081	// 2. If response is not a network error and request’s cache mode is	COMMENT
LOW	lib/web/cookies/parse.js	161	// 6. If the attribute-value is longer than 1024 octets, ignore the	COMMENT
LOW	lib/web/cookies/parse.js	201	// character, ignore the cookie-av.	COMMENT
LOW	lib/web/cookies/parse.js	261	}	COMMENT
LOW	lib/web/cookies/parse.js	281	} else if (attributeNameLowercase === 'samesite') {	COMMENT
LOW	lib/dispatcher/fixed-queue.js	1	'use strict'	COMMENT
LOW	lib/dispatcher/fixed-queue.js	21	// \| item \| \| item \| \| undefined \|	COMMENT
LOW	lib/dispatcher/fixed-queue.js	41	// \| undefined \| \| item \|	COMMENT
LOW	deps/llhttp/include/llhttp.h	541	} /* extern "C" */	COMMENT
LOW	deps/llhttp/src/llhttp.c	1	#include <stdlib.h>	COMMENT
LOW	deps/milo/README.md	141	//	COMMENT
LOW	deps/milo/parser/src/native.rs	101	#[unsafe(no_mangle)]	COMMENT
4 more matches not shown…

Decorative Section Separators5 hits · 20 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/issue-4880.js	30	// ── Server (runs in worker thread) ──────────────────────────────────────────	COMMENT
MEDIUM	test/issue-4880.js	60	// ── Client / tests (runs in main thread) ────────────────────────────────────	COMMENT
MEDIUM⚡	docs/docs/api/MockAgent.md	584	// ┌─────────┬────────┬───────────────────────┬──────┬─────────────┬────────────┬─────────────┬───────────┐	COMMENT
MEDIUM⚡	docs/docs/api/MockAgent.md	586	// ├─────────┼────────┼───────────────────────┼──────┼─────────────┼────────────┼─────────────┼───────────┤	COMMENT
MEDIUM⚡	docs/docs/api/MockAgent.md	588	// └─────────┴────────┴───────────────────────┴──────┴─────────────┴────────────┴─────────────┴───────────┘	COMMENT

Verbosity Indicators6 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	test/fetch/range-open-ended.js	8	// Step 18: "If rangeStartValue and rangeEndValue are numbers, and	COMMENT
LOW	docs/examples/snapshot-testing.js	36	// Step 1: Record mode - capture API responses	COMMENT
LOW	docs/examples/snapshot-testing.js	62	// Step 2: Playback mode - use recorded responses (server can be down)	COMMENT
LOW	lib/web/eventsource/eventsource-stream.js	224	// event. We need to check if the next character is an	COMMENT
LOW	lib/web/eventsource/eventsource-stream.js	239	// set the crlfCheck flag to true, as we need to check if the	COMMENT
LOW	lib/web/eventsource/eventsource-stream.js	263	// set the crlfCheck flag to true, as we need to check if the	COMMENT

TODO Padding3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	test/interceptors/dump-interceptor.js	11	// TODO: Fix tests on windows	COMMENT
LOW	lib/web/fetch/util.js	264	// TODO: implement "byte-serializing a request origin"	COMMENT
LOW	lib/web/fetch/index.js	2242	// TODO: implement connection timing	COMMENT

Structural Annotation Overuse2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	docs/examples/snapshot-testing.js	36	// Step 1: Record mode - capture API responses	COMMENT
LOW	docs/examples/snapshot-testing.js	62	// Step 2: Playback mode - use recorded responses (server can be down)	COMMENT

nodejs/undici

Open-Source Code Quality, Security and Technical Debt Review