3.3

Adjusted Signal

3.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

40.2K

Stars

TypeScript

Language

1.3M

Lines of Code

10.2K

Files

3.7K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 3269 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.7/100 · LOW

Are imports declared and package/API names verified? 322 finding(s).

Agent Over-Engineering Ratio 11.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 3020 finding(s).

PR Review Velocity Impact 14.4/100 · LOW

Which changes need focused human review? 3668 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 18MEDIUM 81LOW 3563

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3668 distinct pattern matches across 19 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers2943 hits · 2986 pts

Severity	File	Line	Snippet	Context
LOW	…/skills/add-channel-whats-next-onboarding/reference.md	26	function escapeJsxStringAttributeValue(value: string): string {	CODE
LOW	…/skills/add-channel-whats-next-onboarding/reference.md	30	function buildDiscordConnectSnippet(integrationIdentifier: string, applicationIdentifier: string): string {	CODE
LOW	…/skills/add-channel-whats-next-onboarding/reference.md	58	export function buildDiscordWhatsNextConfig({	CODE
LOW	…/skills/add-channel-whats-next-onboarding/reference.md	154	export function DiscordAgentConnectedDetails({	CODE
LOW	…ground/web-chat/src/components/assistant-ui/thread.tsx	20	function approvalStandaloneGroupBy(	CODE
LOW	…components/assistant-ui/elements/tool-fallback.aui.tsx	340	function ToolFallbackApprovalResolved({	CODE
LOW	playground/web-chat/src/lib/thread-list-mapper.ts	23	export function mapConversationsToThreadData(	CODE
LOW	playground/web-chat/src/lib/approval-options.ts	15	export function decisionFromApprovalOption(	CODE
LOW	…nd/web-chat/src/lib/agent-message-to-thread-message.ts	89	export function agentMessageToThreadMessage(message: AgentMessage): ThreadMessageLike {	CODE
LOW	playground/nextjs/src/lib/fcm-web.ts	120	export function getMissingFirebaseConfigKeys(config: FirebaseWebConfig = getFirebaseWebConfig()): string[] {	CODE
LOW	playground/nextjs/src/lib/fcm-web.ts	143	export function resolveNotificationContent(payload: PushPayload): {	CODE
LOW	playground/nextjs/src/lib/fcm-web.ts	196	export async function ensureFirebaseCompatLoaded(): Promise<FirebaseCompat> {	CODE
LOW	playground/nextjs/src/lib/slack-dm-endpoint-connect.ts	93	export async function ensureSlackUserDmEndpoint(args: {	CODE
LOW	…ayground/nextjs/src/lib/msteams-dm-endpoint-connect.ts	68	export async function ensureMsTeamsUserDmEndpoint(args: {	CODE
LOW	playground/nextjs/src/lib/dm-endpoint-context.ts	26	export function findConnectionForProvider(	CODE
LOW	playground/nextjs/src/lib/dm-endpoint-context.ts	67	export function mismatchedContextEndpointMessage(hasContextOnRequest: boolean): string {	CODE
LOW	…d/nextjs/src/pages/connect-opsgenie-end-user/index.tsx	5	export default function ConnectOpsgenieEndUserPage() {	CODE
LOW	…/nextjs/src/pages/connect-pagerduty-end-user/index.tsx	5	export default function ConnectPagerDutyEndUserPage() {	CODE
LOW	…ayground/nextjs/src/pages/subscription-hooks/index.tsx	336	export default function SubscriptionComponentsPage() {	CODE
LOW	…und/nextjs/src/pages/subscription-components/index.tsx	7	export default function SubscriptionComponentsPage() {	CODE
LOW	…nd/nextjs/src/pages/connect-grafana-end-user/index.tsx	5	export default function ConnectGrafanaEndUserPage() {	CODE
LOW	playground/nextjs/src/pages/send-email/index.tsx	11	function readFileAsAttachmentPayload(	CODE
LOW	playground/nextjs/src/pages/api/grafana-endpoint.ts	47	function resolveIntegrationIdentifier(explicit: string \| undefined): string \| null {	CODE
LOW	playground/nextjs/src/pages/api/opsgenie-endpoint.ts	48	function resolveIntegrationIdentifier(explicit: string \| undefined): string \| null {	CODE
LOW	playground/nextjs/src/pages/api/pagerduty-endpoint.ts	48	function resolveIntegrationIdentifier(explicit: string \| undefined): string \| null {	CODE
LOW	…ayground/nextjs/src/pages/api/firebase-messaging-sw.ts	46	function resolveNotificationContent(payload) {	CODE
LOW	…d/nextjs/src/pages/connect-telegram-end-user/index.tsx	5	export default function ConnectTelegramEndUserPage() {	CODE
LOW	playground/nextjs/src/pages/fcm-web-push/index.tsx	321	async function subscribeTokenToNewsUpdates(deviceToken: string): Promise<void> {	CODE
LOW	enterprise/workers/step-resolver/src/utils/worker-id.ts	1	export function generateStepResolverWorkerId(organizationId: string, stepResolverHash: string): string {	CODE
LOW	enterprise/workers/thalamus-observer/src/validation.ts	20	export function validateObservationParams(body: unknown): body is ObservationParams {	CODE
LOW	…ents/skills/figma-use/references/component-patterns.md	507	async function getLocalComponentMetadata(componentId) {	CODE
LOW	…ents/skills/figma-use/references/component-patterns.md	530	async function getPublishedComponentMetadata(componentKey) {	CODE
LOW	…s/skills/figma-use/references/effect-style-patterns.md	107	function applyEffectStyleToMatchingNodes(styleId, nodeNamePattern) {	CODE
LOW	…skills/figma-use/references/plugin-api-standalone.d.ts	210	* function someNestedFunctionCallThatClosesThePlugin() {	COMMENT
LOW	…gents/skills/figma-use/references/variable-patterns.md	285	async function listVariableCollectionsAndVariables() {	CODE
LOW	…nts/skills/figma-use/references/text-style-patterns.md	179	async function applyTextStyleToMatchingNodes(styleId, nodeNamePattern) {	CODE
LOW	libs/agent-evals/src/core/recorder.ts	145	export function isForbiddenWatcherCommand(command: string): boolean {	CODE
LOW	libs/agent-evals/src/core/tools.ts	58	function resolveLexicalFixturePath(projectRoot: string, filePath: string): string {	CODE
LOW	…e/src/editor/bubble-suggestions/suggestion-registry.ts	106	export function registerSuggestionProvider(name: string, factory: SuggestionProviderFactory) {	CODE
LOW	…ble-suggestions/providers/inline-decorator-provider.ts	44	export function createInlineDecoratorProvider(editor: Editor): SuggestionProvider \| null {	CODE
LOW	…ly-core/src/editor/nodes/card-actions/card-actions.tsx	39	export function findCardActionsFromSelection(selection: Selection): CardActionsMatch \| null {	CODE
LOW	libs/maily-core/src/editor/nodes/button/button-view.tsx	280	function BackgroundColorPickerPopup(props: ColorPickerProps) {	CODE
LOW	…e/src/editor/plugins/drag-handle/drag-handle-plugin.ts	203	function getSelectionRangesNearCursor(e: MouseEvent, t: Editor) {	CODE
LOW	libs/maily-core/src/editor/utils/sanitize-email-html.ts	74	function normalizeMalformedClosingTags(html: string): string {	CODE
LOW	libs/maily-core/src/editor/utils/liquid-variables.tsx	22	export function setKeepCardActionsMenuOpen(editor: Editor, value: boolean): void {	CODE
LOW	libs/maily-core/src/editor/utils/liquid-variables.tsx	49	export function renderLiquidVariableSegments({	CODE
LOW	libs/maily-core/src/editor/utils/node-options.ts	29	export function getInlineDecoratorOptions(editor: Editor) {	CODE
LOW	libs/maily-core/src/editor/utils/node-options.ts	33	export function useInlineDecoratorOptions(editor: Editor) {	CODE
LOW	…editor/extensions/slash-command/slash-command-view.tsx	238	export function getSlashCommandSuggestions(	CODE
LOW	…/extensions/inline-decorator/inline-decorator-list.tsx	171	function createGetReferenceClientRect(props: any): GetReferenceClientRect {	CODE
LOW	…/extensions/inline-decorator/inline-decorator-list.tsx	253	export function getInlineDecoratorSuggestionsReact(	CODE
LOW	…editor/extensions/inline-decorator/inline-decorator.ts	122	function createSuggestionAllowHandler() {	CODE
LOW	…card-actions-menu/card-actions-bubble-menu-content.tsx	36	export function CardActionsBubbleMenuContent({ editor }: { editor: Editor }) {	CODE
LOW	libs/internal-sdk/src/types/unrecognized.ts	15	export function startCountingUnrecognized() {	CODE
LOW	…al-sdk/src/react-query/environmentVariablesRetrieve.ts	61	export function useEnvironmentVariablesRetrieve(	CODE
LOW	…al-sdk/src/react-query/environmentVariablesRetrieve.ts	90	export function useEnvironmentVariablesRetrieveSuspense(	CODE
LOW	…al-sdk/src/react-query/environmentVariablesRetrieve.ts	113	export function setEnvironmentVariablesRetrieveData(	CODE
LOW	…al-sdk/src/react-query/environmentVariablesRetrieve.ts	126	export function invalidateEnvironmentVariablesRetrieve(	CODE
LOW	…al-sdk/src/react-query/environmentVariablesRetrieve.ts	144	export function invalidateAllEnvironmentVariablesRetrieve(	CODE
LOW	libs/internal-sdk/src/react-query/workflowsSync.ts	81	export function buildWorkflowsSyncMutation(	CODE
2883 more matches not shown…

Fake / Example Data291 hits · 316 pts

Severity	File	Line	Snippet	Context
LOW	playground/nextjs/src/app/novu/workflows.ts	56	userName: z.string().default('John Doe'),	CODE
LOW	…ground/nextjs/src/app/api/agent-toolkit/lib/toolkit.ts	46	secretKey: process.env.NOVU_SECRET_KEY ?? 'dummy-key',	CODE
LOW	playground/nextjs/src/pages/api/hello.ts	9	res.status(200).json({ name: 'John Doe' });	CODE
LOW	playground/nestjs/src/user.service.ts	7	name: 'John Doe',	CODE
LOW	.agents/skills/react-email/SKILL.md	181	name: 'John Doe',	CODE
LOW	.agents/skills/react-email/SKILL.md	407	to: ['user@example.com'],	CODE
LOW	.agents/skills/react-email/references/I18N.md	141	to: ['user@example.com'],	CODE
LOW	.agents/skills/react-email/references/SENDING.md	38	to: ['user@example.com'],	CODE
LOW	.agents/skills/react-email/references/SENDING.md	67	to: ['user@example.com'],	CODE
LOW	.agents/skills/react-email/references/SENDING.md	93	to: 'user@example.com',	CODE
LOW	.agents/skills/react-email/references/SENDING.md	110	to: 'user@example.com',	CODE
LOW	.agents/skills/react-email/references/PATTERNS.md	67	email: 'user@example.com',	CODE
LOW	.agents/skills/react-email/references/PATTERNS.md	265	name: 'John Doe',	CODE
LOW	.agents/skills/react-email/references/PATTERNS.md	266	street: '123 Main St',	CODE
LOW	.agents/skills/react-email/references/PATTERNS.md	591	author: 'Jane Doe',	CODE
LOW	.agents/skills/react-email/references/PATTERNS.md	698	inviterName: 'John Doe',	CODE
LOW	.agents/skills/testerarmy-cli/SKILL.md	68	echo '{"kind":"login","label":"Admin","username":"admin@example.com","password":"secret"}' \| ta projects credentials-cre	CODE
LOW	docs/.mintlify/skills/manage-subscribers/SKILL.md	39	company: "Acme Inc",	CODE
LOW	…age-subscribers/references/subscriber-crud-examples.md	25	company: "Acme Inc",	CODE
LOW	…ls/framework-integration/references/email-templates.md	239	payloadSchema: z.object({ userName: z.string().default("John Doe") }),	CODE
LOW	…ls/framework-integration/references/email-templates.md	302	payloadSchema: z.object({ userName: z.string().default("John Doe") }),	CODE
LOW	…ger-notification/references/single-trigger-examples.md	19	companyName: "Acme Inc",	CODE
LOW	…ger-notification/references/single-trigger-examples.md	39	"companyName": "Acme Inc",	CODE
LOW	…ger-notification/references/single-trigger-examples.md	57	"companyName": "Acme Inc"	CODE
LOW	…on-generic/src/decorators/context-payload.decorator.ts	22	example: { name: 'Acme Corp', region: 'us-east-1' },	CODE
LOW	libs/application-generic/src/utils/maily-utils.ts	654	* (node) => ({ type: "text", text: "John Doe" })	COMMENT
LOW	libs/application-generic/src/utils/maily-utils.ts	661	* { type: "text", text: "John Doe" },	COMMENT
LOW	libs/application-generic/src/utils/json-schema-mock.ts	36	JSONSchemaFaker.format('email', () => 'user@example.com');	CODE
LOW	libs/application-generic/src/utils/json-schema-mock.ts	64	if (prop.format === 'email') return 'user@example.com';	CODE
LOW	libs/application-generic/src/utils/json-schema-mock.ts	73	return 'user@example.com';	CODE
LOW	libs/application-generic/src/utils/json-schema-mock.ts	120	return 'John Doe';	CODE
LOW	libs/application-generic/src/utils/json-schema-mock.ts	137	return '123 Main Street';	CODE
LOW	libs/application-generic/src/utils/json-schema-mock.ts	355	// Add examples for string properties to override lorem ipsum	COMMENT
LOW	…nel-endpoint/__tests__/channel-endpoint.schema.spec.ts	49	expect(validateEndpointForTypeFromSchema(ENDPOINT_TYPES.WEBEX_PERSON, { personEmail: 'user@example.com' })).toBe(	CODE
LOW	…nel-endpoint/__tests__/channel-endpoint.schema.spec.ts	67	personEmail: 'user@example.com',	CODE
LOW	…/application-generic/src/commands/base.command.spec.ts	43	TestCommand.create({ email: 'test@test.com', password: undefined });	CODE
LOW	…/application-generic/src/commands/base.command.spec.ts	55	const obj = { email: 'test@test.com', password: 'P@ssw0rd' };	CODE
LOW	…ecases/preview/services/mock-data-generator.service.ts	146	email: 'user@example.com',	CODE
LOW	libs/maily-render/src/maily.tsx	369	* name: 'John Doe',	COMMENT
LOW	libs/maily-render/src/render.test.ts	24	maily.setVariableValue('name', 'John Doe');	CODE
LOW	libs/maily-render/src/render.test.ts	29	expect(result).toMatchInlineSnapshot(`"John Doe"`);	CODE
LOW	packages/framework/src/jsonSchemaFaker.js	5774	LIPSUM_WORDS = `Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore	CODE
LOW	packages/framework/src/jsonSchemaFaker.js	5774	LIPSUM_WORDS = `Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore	CODE
LOW	packages/framework/src/types/context.types.ts	16	* data: { name: "Acme Corp", plan: "enterprise" }	COMMENT
LOW	packages/framework/src/types/context.types.ts	45	* data: { name: "Acme Corp", plan: "enterprise" }	COMMENT
LOW	packages/framework/src/types/context.types.ts	52	* tenant: { id: "org-acme", data: { name: "Acme Corp" } },	COMMENT
LOW	packages/framework/src/types/context.types.ts	90	* data: { name: "Acme Corp", plan: "enterprise", region: "us-east" }	COMMENT
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	226	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	259	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	289	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	316	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	331	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	348	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	372	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	397	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	408	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	440	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	469	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	507	to: 'test@test.com',	CODE
LOW	…ages/framework/src/resources/workflow/workflow.test.ts	515	to: 'test@test.com',	CODE
231 more matches not shown…

Decorative Section Separators63 hits · 189 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/community/setup.sh	98	# ── Main ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…extjs/src/app/agents-mcp/components/flow-simulator.tsx	169	// ── Common preamble (visualization only) ─────────────────────────────	COMMENT
MEDIUM	…extjs/src/app/agents-mcp/components/flow-simulator.tsx	184	// ── Real call: connection status ─────────────────────────────────────	COMMENT
MEDIUM	…extjs/src/app/agents-mcp/components/flow-simulator.tsx	214	// ── Miss branch ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…extjs/src/app/agents-mcp/components/flow-simulator.tsx	230	// ── Real call: generate authorize URL + open popup ───────────────────	COMMENT
MEDIUM	…und/nextjs/src/app/agents-mcp/components/flow-steps.ts	55	// ── Common preamble ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…und/nextjs/src/app/agents-mcp/components/flow-steps.ts	83	// ── Hit branch ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…und/nextjs/src/app/agents-mcp/components/flow-steps.ts	100	// ── Miss branch ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…und/nextjs/src/app/agents-mcp/components/flow-steps.ts	157	// ── Common epilogue ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…s/application-generic/src/utils/ssrf-url-validation.ts	237	// ────── Safe outbound HTTP ──────	COMMENT
MEDIUM	…rk/src/langchain/history-mapper/history-mapper.test.ts	75	// ─── Assertion helper: reduce a LangChain message to a comparable shape ─────────	COMMENT
MEDIUM	…rk/src/langchain/history-mapper/history-mapper.test.ts	137	// ─── Tests ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	35	// ─── Payload extractors ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	75	// ─── Approval index (one pre-scan per turn) ───────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	121	// ─── Cycle classification ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	137	// ─── LangChain message builders ───────────────────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	167	// ─── Ledger entry mapper ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…mework/src/langchain/history-mapper/approval-cycles.ts	200	// ─── Resume helpers ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/langchain/reply-mapper/index.ts	18	// ─── Guards ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/langchain/reply-mapper/index.ts	42	// ─── Text extraction ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/langchain/reply-mapper/index.ts	84	// ─── Config path (Novu-managed approval loop) ───────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/langchain/reply-mapper/index.ts	187	// ─── Router ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/ai-sdk/ai-sdk-agent.test.ts	14	// ─── Test fixtures ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/framework/src/ai-sdk/ai-sdk-agent.test.ts	130	// ─── Tests ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ework/src/ai-sdk/history-mapper/history-mapper.test.ts	5	// ─── Test fixtures ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ework/src/ai-sdk/history-mapper/history-mapper.test.ts	88	// ─── Expected AI SDK shapes (shortcuts for assertions) ────────────────────────	COMMENT
MEDIUM	…ework/src/ai-sdk/history-mapper/history-mapper.test.ts	123	// ─── Tests ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/history-mapper/approval-cycles.ts	30	// ─── Payload extractors ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/history-mapper/approval-cycles.ts	70	// ─── Approval index (one pre-scan per turn) ───────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/history-mapper/approval-cycles.ts	118	// ─── Cycle classification ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/history-mapper/approval-cycles.ts	134	// ─── AI SDK message builders ──────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/history-mapper/approval-cycles.ts	174	// ─── Ledger entry mappers ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/reply-mapper/reply-mapper.test.ts	8	// ─── Test fixtures ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…framework/src/ai-sdk/reply-mapper/reply-mapper.test.ts	97	// ─── Tests ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/shared/src/consts/providers/mcp-servers.ts	171	// ── Popular ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/shared/src/consts/providers/mcp-servers.ts	341	// ── All others ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…c/consts/providers/credentials/provider-credentials.ts	1691	// ─── Agent Runtime Providers ─────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/app/agents/management/skills/github-skill-bundle.ts	221	// ─── GitHub HTTP plumbing ───────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/app/agents/management/skills/github-skill-bundle.ts	345	// ─── Streaming tar pipeline ────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/app/agents/management/skills/github-skill-bundle.ts	501	// ─── Public entry points ───────────────────────────────────────────────────	COMMENT
MEDIUM	…ision-managed-agent/provision-managed-agent.usecase.ts	106	// ── Adopt mode ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ision-managed-agent/provision-managed-agent.usecase.ts	139	// ── Provision mode ────────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/app/agents/mcp/oauth/mcp-oauth-discovery.service.ts	53	// ── `novu-app` mode (Novu's pre-registered OAuth app) ────────────────────	COMMENT
MEDIUM	…oauth/mcp-oauth-callback/mcp-oauth-callback.usecase.ts	164	// ── execute sub-steps ─────────────────────────────────────────────────	COMMENT
MEDIUM	…nerate-mcp-oauth-url/generate-mcp-oauth-url.command.ts	34	// ── Session resume fields (source: 'user_chat') ──────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	197	// ─── Helpers ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	266	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	268	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	786	// ─── Integration validation (cross-variant) ─────────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	817	// ─── Request body validation (cross-variant) ────────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	905	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	907	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	1169	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/upload-custom-skill.e2e.ts	1171	// ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	142	// ─── POST /v1/integrations — agent-kind provisioning ─────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	217	// ─── POST /v1/agents — managed runtime ──────────────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	371	// ─── POST /v1/agents — externalEnvironmentId rebinding ─────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	506	// ─── GET /v1/agents/:identifier/runtime/config ──────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	603	// ─── PATCH /v1/agents/:identifier/runtime/config ────────────────────────────	COMMENT
MEDIUM	apps/api/src/app/agents/e2e/managed-agent.e2e.ts	734	// ─── POST /v1/agents — adopt existing managed agent ─────────────────────────	COMMENT
3 more matches not shown…

Structural Annotation Overuse101 hits · 182 pts

Severity	File	Line	Snippet	Context
LOW	…ursor/skills/nv-endpoint-routed-tool-provider/SKILL.md	23	## Step 0: Provider discovery gate (mandatory, before any code)	COMMENT
LOW	.cursor/skills/triage-agent-eval-failures/SKILL.md	29	## Step 1: identify which grader failed and its kind	COMMENT
LOW	.cursor/skills/triage-agent-eval-failures/SKILL.md	46	## Step 2: read the RunResult evidence	COMMENT
LOW	.cursor/skills/triage-agent-eval-failures/SKILL.md	57	## Step 3: classify the failure	COMMENT
LOW	.cursor/skills/triage-agent-eval-failures/SKILL.md	73	## Step 4: apply one bounded fix, then verify	COMMENT
LOW	.agents/skills/linear-release-setup/SKILL.md	14	### Step 1: Preflight	COMMENT
LOW	.agents/skills/linear-release-setup/SKILL.md	22	### Step 2: Map pipelines, then ask	COMMENT
LOW	.agents/skills/linear-release-setup/SKILL.md	48	### Step 3: Generate the CI configuration	COMMENT
LOW	.agents/skills/linear-release-setup/SKILL.md	80	### Step 4: Remind about secrets	COMMENT
LOW	…ges/providers/src/lib/chat/msTeams/msTeams.provider.ts	170	// Step 1: Create 1:1 conversation	COMMENT
LOW	…ges/providers/src/lib/chat/msTeams/msTeams.provider.ts	193	// Step 2: Send message to the conversation	COMMENT
LOW	…/providers/src/lib/email/sendgrid/sendgrid.provider.ts	236	// Step 1: Create a new Event Webhook	COMMENT
LOW	…/providers/src/lib/email/sendgrid/sendgrid.provider.ts	264	// Step 2: Enable Signature Verification	COMMENT
LOW	…es/providers/src/lib/email/mailgun/mailgun.provider.ts	184	// Step 2: Retrieve HTTP Webhook Signing Key from Mailgun API	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	19	# Step 1: Fetch the latest commit hash from the private repository's target branch	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	53	# Step 2: Get the current commit hash from the .source submodule	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	78	# Step 3: Compare the hashes	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	110	### Step 1: Package Installation	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	121	### Step 2: Environment Variable Configuration	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	137	### Step 3: Subscriber ID Detection	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	152	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	256	### Step 5: Component Creation	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	270	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	278	### Step 7: Validation & Testing	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	289	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	301	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	310	### Step 10: Final Output Requirements	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	137	### Step 1: Package Installation	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	157	### Step 2: Environment Variable Configuration	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	175	### Step 3: Composable Creation	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	212	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	311	### Step 5: Component Creation	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	325	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	333	### Step 7: Validation & Testing	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	345	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	358	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	367	### Step 10: Final Output Requirements	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	117	### Step 1: Package Installation	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	137	### Step 2: Environment Variable Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	154	### Step 3: Subscriber ID Detection	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	169	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	273	### Step 5: Component Creation	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	287	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	295	### Step 7: Validation & Testing	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	306	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	318	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	327	### Step 10: Final Output Requirements	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	122	### Step 1: Package Installation	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	142	### Step 2: Environment Variable Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	160	### Step 3: Root Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	208	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	307	### Step 5: Component Creation	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	321	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	329	### Step 7: Validation & Testing	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	341	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	354	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	363	### Step 10: Final Output Requirements	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	302	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	310	### Step 7: Validation & Testing	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	337	### Step 9: Iterative Refinement Process	COMMENT
41 more matches not shown…

Verbosity Indicators94 hits · 171 pts

Severity	File	Line	Snippet	Context
LOW	…usecases/create-workflow-v0/create-workflow.usecase.ts	371	// userPreferences is optional, so we need to check if it's defined before calling the upsert	COMMENT
LOW	…usecases/update-workflow-v0/update-workflow.usecase.ts	219	* userPreferences is optional, so we need to check if it's defined before calling the upsert.	COMMENT
LOW	…ges/providers/src/lib/chat/msTeams/msTeams.provider.ts	170	// Step 1: Create 1:1 conversation	COMMENT
LOW	…ges/providers/src/lib/chat/msTeams/msTeams.provider.ts	193	// Step 2: Send message to the conversation	COMMENT
LOW	…/providers/src/lib/email/sendgrid/sendgrid.provider.ts	236	// Step 1: Create a new Event Webhook	COMMENT
LOW	…/providers/src/lib/email/sendgrid/sendgrid.provider.ts	264	// Step 2: Enable Signature Verification	COMMENT
LOW	…es/providers/src/lib/email/mailgun/mailgun.provider.ts	184	// Step 2: Retrieve HTTP Webhook Signing Key from Mailgun API	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	19	# Step 1: Fetch the latest commit hash from the private repository's target branch	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	53	# Step 2: Get the current commit hash from the .source submodule	COMMENT
LOW	.github/workflows/scripts/validate-submodule-sync.sh	78	# Step 3: Compare the hashes	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	110	### Step 1: Package Installation	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	121	### Step 2: Environment Variable Configuration	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	137	### Step 3: Subscriber ID Detection	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	152	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	256	### Step 5: Component Creation	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	270	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	278	### Step 7: Validation & Testing	COMMENT
LOW	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	289	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	301	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…/welcome/ai-prompts/framework-prompts/nextjs-prompt.ts	310	### Step 10: Final Output Requirements	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	137	### Step 1: Package Installation	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	157	### Step 2: Environment Variable Configuration	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	175	### Step 3: Composable Creation	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	212	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	311	### Step 5: Component Creation	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	325	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	333	### Step 7: Validation & Testing	COMMENT
LOW	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	345	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	358	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…nts/welcome/ai-prompts/framework-prompts/vue-prompt.ts	367	### Step 10: Final Output Requirements	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	117	### Step 1: Package Installation	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	137	### Step 2: Environment Variable Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	154	### Step 3: Subscriber ID Detection	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	169	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	273	### Step 5: Component Creation	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	287	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	295	### Step 7: Validation & Testing	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	306	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	318	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/react-prompt.ts	327	### Step 10: Final Output Requirements	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	122	### Step 1: Package Installation	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	142	### Step 2: Environment Variable Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	160	### Step 3: Root Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	208	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	307	### Step 5: Component Creation	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	321	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	329	### Step 7: Validation & Testing	COMMENT
LOW	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	341	### Step 8: AI Model Verification (Internal Process)	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	354	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…s/welcome/ai-prompts/framework-prompts/remix-prompt.ts	363	### Step 10: Final Output Requirements	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	302	### Step 6: UI Placement Strategy	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	310	### Step 7: Validation & Testing	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	337	### Step 9: Iterative Refinement Process	COMMENT
LOW⚡	…me/ai-prompts/framework-prompts/react-native-prompt.ts	347	### Step 10: Final Output Requirements	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	126	### Step 1: Package Installation	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	147	### Step 2: Environment Variable Configuration	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	165	### Step 3: Root Configuration	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	192	### Step 4: Inline Appearance Configuration	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	288	### Step 5: Component Creation	COMMENT
LOW	…me/ai-prompts/framework-prompts/react-native-prompt.ts	323	### Step 8: AI Model Verification (Internal Process)	COMMENT
34 more matches not shown…

Over-Commented Block75 hits · 75 pts

Severity	File	Line	Snippet	Context
LOW	pnpm-workspace.yaml	41	# compressed request body. Patched in 1.20.9 (1.x line) and 2.4.0 (2.x line).	COMMENT
LOW	pnpm-workspace.yaml	101	# GHSA-m9gg-hp2v-232j (high) / GHSA-f596-whhp-79r4 (low): @grpc/grpc-js	COMMENT
LOW	pnpm-workspace.yaml	141	# GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 plus	COMMENT
LOW	pnpm-workspace.yaml	161	# Pin playground `nextjs` package's `next` to the patched 15.5.x release.	COMMENT
LOW	pnpm-workspace.yaml	181	# on 16.4.1+.	COMMENT
LOW	pnpm-workspace.yaml	201	# / GHSA-j8rh-479h-cp32 / GHSA-4hqw-qxg8-jxx2 / GHSA-44g4-m2mj-wpvx	COMMENT
LOW	pnpm-workspace.yaml	241	# (patch bump within the 7.x line). Widen the previous `<7.0.5` floor so	COMMENT
LOW	pnpm-workspace.yaml	261	# GHSA-6pq8-jhm2-2vcw (moderate): qs prototype pollution via `__proto__` in	COMMENT
LOW	pnpm-workspace.yaml	281	# token exfiltration via a malicious server. Patched in 1.31.0. Pulled	COMMENT
LOW	pnpm-workspace.yaml	301	# Patched in 7.1.0. Transitive via @microsoft/teams.apps > @azure/msal-node	COMMENT
LOW	pnpm-workspace.yaml	321	# <=3.4.16: additional sanitization bypasses in the SVG/foreign-content	COMMENT
LOW	pnpm-workspace.yaml	341	markdown-it@>=13.0.0 <14.3.3: ^14.3.3	COMMENT
LOW	pnpm-workspace.yaml	401	# The npm `aws-lambda` package (a debugging CLI, last published 2020) still	COMMENT
LOW	pnpm-workspace.yaml	421	# body-less code path, enabling response-splitting / request-smuggling-like	COMMENT
LOW	pnpm-workspace.yaml	441	# pick up the fix.	COMMENT
LOW	pnpm-workspace.yaml	501	'@better-auth/sso@<1.6.13': ^1.6.23	COMMENT
LOW	pnpm-workspace.yaml	521	# transitive 1.10.0 resolutions (via npm-run-all and cpx) pick up the fix.	COMMENT
LOW	pnpm-workspace.yaml	541	react-router@>=6.0.0 <7.18.0: ^7.18.0	COMMENT
LOW	pnpm-workspace.yaml	561	# uncontrolled AST recursion in nested pseudo-selectors. Patched in 6.1.3.	COMMENT
LOW	pnpm-workspace.yaml	581	# or `YYYY` tokens. Patched in 2.31.0 (minor bump within the 2.x line).	COMMENT
LOW	.cursor/scripts/start.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…rprise/workers/step-resolver/worker-configuration.d.ts	10141	} : T;	COMMENT
LOW	…rprise/workers/step-resolver/worker-configuration.d.ts	10161	// For properties, rewrite types to be `Result`s.	COMMENT
LOW	…rprise/workers/step-resolver/worker-configuration.d.ts	10181	interface Env {	COMMENT
LOW	…rprise/workers/step-resolver/worker-configuration.d.ts	10501	readonly type: "attributes";	COMMENT
LOW	…tep-resolver/scripts/configure-eu-regional-hostname.sh	1	#!/usr/bin/env bash	COMMENT
LOW	.agents/skills/figma-use/references/gotchas.md	521	// For horizontal layout, stretch height:	COMMENT
LOW	…s/application-generic/src/utils/ssrf-url-validation.ts	1	// IMPORTANT: this file is a hand-maintained mirror of two source modules:	COMMENT
LOW	libs/notifications/src/workflows/usage-report/email.tsx	1101	</Body>	COMMENT
LOW	libs/notifications/src/workflows/usage-report/email.tsx	1121	// topProviders: [	COMMENT
LOW	scripts/sync-skills.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/setup-agent.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packages/js/src/ui/novuUI.tsx	41	#container: Accessor<Node \| null \| undefined>;	COMMENT
LOW	packages/providers/src/utils/esm-import.ts	1	// Chat SDK adapters (`@chat-adapter/*`) are ESM-only; when this package is built as	COMMENT
LOW	packages/novu/src/index.ts	141	},	COMMENT
LOW	packages/novu/src/index.ts	161	// .option('--yes', 'Skip the bootstrap countdown and auto-pick the first detected MCP editor', false)	COMMENT
LOW	…/commands/init/templates/app-chat-sdk/ts/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	…mands/init/templates/app-agent-ai-sdk/ts/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	…ds/init/templates/app-agent-langchain/ts/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	…src/commands/init/templates/app-agent/ts/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	packages/novu/src/commands/wizard/pipeline/runner.ts	61	const bootstrapProject = store.session.get().project;	COMMENT
LOW	packages/novu/src/commands/wizard/pipeline/runner.ts	141	if (mcpInstalled.length > 0) {	COMMENT
LOW	…ages/novu/src/commands/connect/ui/orb/orb-renderer.tsx	41	return <Orb phase={frame} scale={scale} tintColor={tintColor} label={label} morphProgress={morphProgress} />;	COMMENT
LOW	…ages/novu/src/commands/connect/ui/orb/orb-renderer.tsx	61	// matrix to produce the classic 1-bit ordered-dithered look. Lit hemisphere	COMMENT
LOW	.github/workflows/codeql-analysis.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/on-pr.yml	341	with:	COMMENT
LOW	.github/workflows/on-pr.yml	461	# with:	COMMENT
LOW	apps/dashboard/src/pages/edit-step-template-v2.tsx	61	// Reactive resets for server-sourced changes while this step stays mounted (resolver	COMMENT
LOW	apps/human-dashboard/src/react-canary.d.ts	1	// The App Router runs React's canary release, which has `<ViewTransition>`; these are its types.	COMMENT
LOW	apps/api/src/app/bridge/usecases/sync/sync.usecase.ts	81	this.sendAnalytics(command, environment, discover);	COMMENT
LOW	…ision-managed-agent/provision-managed-agent.usecase.ts	221		COMMENT
LOW	…oauth/mcp-oauth-callback/mcp-oauth-callback.usecase.ts	941	// `token_endpoint_auth_methods_supported` list at DCR time (RFC 8414).	COMMENT
LOW	…managed-vault/ensure-provider-managed-vault.usecase.ts	101	* `userId` to the dashboard subscriber row.	COMMENT
LOW	…ed-vault/complete-provider-managed-redirect.usecase.ts	141	subscriberId: payload.subscriberId,	COMMENT
LOW	apps/api/src/app/agents/shared/util/esm-import.ts	1	// Chat SDK packages are ESM-only; SWC rewrites import() → require() for CJS output.	COMMENT
LOW	apps/api/src/app/agents/e2e/agent-mcp-servers.e2e.ts	701	// No extra HTTP discovery or registration calls on the reuse path.	COMMENT
LOW	…ps/api/src/app/agents/e2e/agent-slack-roundtrip.e2e.ts	201		COMMENT
LOW	…ses/parse-event-request/parse-event-request.usecase.ts	321	return discover.workflows.find((findWorkflow) => findWorkflow.workflowId === command.identifier) \|\| null;	COMMENT
LOW	apps/inbound-mail/src/python/spf.py	41	# Revision 1.108.2.107 2013/07/23 18:37:17 customdesigned	COMMENT
LOW	apps/inbound-mail/src/python/spf.py	61	# Functional alias for __email__	COMMENT
15 more matches not shown…

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	…mes/anthropic/anthropic-agent-runtime.provider.spec.ts	183	mockClient.beta.skills.versions.create.mockResolvedValue({ id: 'sv_17', version: 'v17' });	CODE
CRITICAL	…mes/anthropic/anthropic-agent-runtime.provider.spec.ts	225	mockClient.beta.skills.versions.create.mockResolvedValue({ id: 'sv_42', version: 'v42' });	CODE
CRITICAL	…mes/anthropic/anthropic-agent-runtime.provider.spec.ts	260	mockClient.beta.skills.versions.create.mockRejectedValue(	CODE
CRITICAL	…mes/anthropic/anthropic-agent-runtime.provider.spec.ts	286	mockClient.beta.skills.versions.create.mockResolvedValue({ id: 'sv_99', version: 'v99' });	CODE
CRITICAL	apps/api/src/app/inbox/e2e/update-preferences.e2e.ts	231	expect(response.body.errors.general.messages.some((msg: string) => msg.includes('must be in 12-hour format'))).to	CODE
CRITICAL	…s/api/src/app/workflows-v2/e2e/generate-preview.e2e.ts	854	const eventMatches = previewResponse3.result.result.preview.body.match(/'id':'example-id-\d+'/g);	CODE

Magic Placeholder Names9 hits · 45 pts

Severity	File	Line	Snippet	Context
HIGH	…s/providers/src/lib/email/braze/braze.provider.spec.ts	5	apiKey: 'your-api-key',	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	25	const secretKey = 'your-api-key';	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	48	const secretKey = 'your-api-key';	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	86	const secretKey = 'your-api-key';	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	100	const secretKey = 'your-api-key';	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	118	const secretKey = 'your-api-key';	CODE
HIGH	packages/novu/src/commands/sync.spec.ts	125	const secretKey = 'your-api-key';	CODE
HIGH	…board/src/components/workflow-editor/workflow-tabs.tsx	82	const apiKey = canReadApiKeys ? (apiKeysResponse?.data?.[0]?.key ?? 'your-api-key-here') : 'your-api-key-here';	CODE
HIGH	…workflow-editor/test-workflow/test-workflow-drawer.tsx	83	const apiKey = canReadApiKeys ? (apiKeysResponse?.data?.[0]?.key ?? 'your-api-key-here') : 'your-api-key-here';	CODE

Empty Error Handlers8 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH	apps/inbound-mail/src/python/spf.py	900	except: pass	CODE
HIGH	apps/inbound-mail/src/python/spf.py	948	except AmbiguityWarning:	CODE
HIGH	apps/inbound-mail/src/python/DNS/win32dns.py	89	except EnvironmentError:	CODE
HIGH	apps/inbound-mail/src/python/DNS/win32dns.py	109	except EnvironmentError:	CODE
HIGH	apps/inbound-mail/src/python/DNS/win32dns.py	62	except EnvironmentError:	CODE
HIGH	apps/inbound-mail/src/python/DNS/win32dns.py	103	except EnvironmentError:	CODE
HIGH	apps/inbound-mail/src/python/DNS/Base.py	289	except:	CODE
HIGH	apps/inbound-mail/src/python/dkim/dnsplug.py	35	except dns.resolver.NXDOMAIN: pass	CODE

Modern AI Meta-Vocabulary14 hits · 37 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ursor/skills/nv-onboard-dcr-mcp/blocked-mcp-servers.md	36	\| `new-relic` \| New Relic \| `https://mcp.newrelic.com/mcp/` \| 2026-08-30 \| `redirect-whitelist` \| Was wrongly catalogued	CODE
MEDIUM	…ursor/skills/nv-onboard-dcr-mcp/blocked-mcp-servers.md	63	\| `bigdata-com` \| Bigdata.com \| `https://mcp.bigdata.com/` \| 2026-06-03 \| `no-registration-endpoint` \| OAuth AS is Clerk	CODE
MEDIUM	.cursor/skills/sanity-changelog/SKILL.md	43	- Improvements & fixes roundup: review Linear releases since the last published changelog. See [reference.md](refere	CODE
MEDIUM	…nboarding/scenarios/bridge-scaffold-ai-sdk/scenario.ts	37	' Dashboard: https://dashboard.novu.test/agents/scaffold-ai-1',	CODE
MEDIUM	…ing/scenarios/bridge-scaffold-ai-sdk/project/README.md	1	# Empty workspace — CLI will scaffold a Novu AI SDK agent app here.	COMMENT
MEDIUM	…arding/scenarios/bridge-scaffold-langchain/scenario.ts	37	' Dashboard: https://dashboard.novu.test/agents/scaffold-lc-1',	CODE
MEDIUM	…/scenarios/bridge-scaffold-langchain/project/README.md	1	# Empty workspace — CLI will scaffold a Novu LangChain agent app here.	COMMENT
MEDIUM	packages/novu/src/commands/init/templates/index.ts	424	// Framework only uses chat for card components; ai-sdk scaffold installs ai@7.	COMMENT
MEDIUM	…u/src/commands/connect/LLM_AUTH_IMPLEMENTATION_PLAN.md	1	# LLM auth during `novu connect` scaffold	COMMENT
MEDIUM	…ovu/src/commands/connect/ui/format-web-chat-success.ts	66	// Fall back to the default agent scaffold port.	COMMENT
MEDIUM	…src/commands/connect/pipeline/bridge-adapter/engine.ts	59	// Empty-dir scaffold: pick LLM provider, confirm, then install template (see pipeline/llm-auth/README.md).	COMMENT
MEDIUM	…mmands/connect/pipeline/web-chat/run-web-chat-setup.ts	86	// A standalone scaffold writes into a new empty directory, so only a bridge merge has env to reuse.	COMMENT
MEDIUM	…/novu/src/commands/connect/pipeline/llm-auth/README.md	1	# LLM auth during bridge scaffold	COMMENT
MEDIUM	…/dashboard/src/components/agents/agent-setup-steps.tsx	75	// Self-hosted agents add three handler steps (scaffold + run + send) below the provider guide.	COMMENT

Redundant / Tautological Comments14 hits · 21 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/deployment-summary.yml	67	# Check if this is a release PR	COMMENT
LOW	.github/workflows/on-push-trigger.yml	68	# Check if only CI/CD label exists (standalone)	COMMENT
LOW	.github/workflows/deploy.yml	274	# Check if service has environments filter, otherwise deploy to all	COMMENT
LOW	.github/workflows/deploy.yml	282	# Check if any of the selected environments match the allowed environments	COMMENT
LOW	.github/workflows/deploy.yml	304	# Check if service has environments filter, otherwise deploy to all	COMMENT
LOW	.github/workflows/deploy.yml	312	# Check if any of the selected environments match the allowed environments	COMMENT
LOW	.github/workflows/conventional-commit.yml	113	# Check if PR title already has the Linear ticket format	COMMENT
LOW	.github/workflows/conventional-commit.yml	136	# Check if title has Linear ticket format manually added	COMMENT
LOW	.github/workflows/conventional-commit.yml	155	# Check if title ends with "fixes TICKET-ID" pattern	COMMENT
LOW	.github/workflows/rollback.yml	212	# Check if service has environments filter, otherwise rollback to all	COMMENT
LOW	.github/workflows/rollback.yml	220	# Check if any of the selected environments match the allowed environments	COMMENT
LOW	.github/workflows/rollback.yml	242	# Check if service has environments filter, otherwise rollback to all	COMMENT
LOW	.github/workflows/rollback.yml	250	# Check if any of the selected environments match the allowed environments	COMMENT
LOW	.github/workflows/scripts/stop-only.sh	18	# Check if any files were found	COMMENT

Deep Nesting19 hits · 19 pts

Severity	File	Line	Context
LOW	.github/workflows/scripts/check-workflow-security.py	55	CODE
LOW	.github/workflows/scripts/check-workflow-security.py	114	CODE
LOW	apps/inbound-mail/src/python/spf.py	458	CODE
LOW	apps/inbound-mail/src/python/spf.py	506	CODE
LOW	apps/inbound-mail/src/python/spf.py	679	CODE
LOW	apps/inbound-mail/src/python/spf.py	840	CODE
LOW	apps/inbound-mail/src/python/spf.py	1031	CODE
LOW	apps/inbound-mail/src/python/spf.py	1223	CODE
LOW	apps/inbound-mail/src/python/spf.py	1279	CODE
LOW	apps/inbound-mail/src/python/spf.py	1381	CODE
LOW	apps/inbound-mail/src/python/spf.py	1466	CODE
LOW	apps/inbound-mail/src/python/spf.py	1655	CODE
LOW	apps/inbound-mail/src/python/DNS/win32dns.py	48	CODE
LOW	apps/inbound-mail/src/python/DNS/Base.py	173	CODE
LOW	apps/inbound-mail/src/python/DNS/Base.py	330	CODE
LOW	apps/inbound-mail/src/python/DNS/Base.py	372	CODE
LOW	apps/inbound-mail/src/python/dkim/__init__.py	189	CODE
LOW	apps/inbound-mail/src/python/dkim/asn1.py	46	CODE
LOW	apps/inbound-mail/src/python/dkim/asn1.py	120	CODE

Unused Imports15 hits · 15 pts

Severity	File	Line	Context
LOW	docs/scripts/fix-step-duplicates.py	4	CODE
LOW	.github/workflows/scripts/check-workflow-security.py	26	CODE
LOW	apps/inbound-mail/src/python/spf.py	162	CODE
LOW	apps/inbound-mail/src/python/DNS/Lib.py	28	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	23	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	24	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	25	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	26	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	30	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	31	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	33	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	16	CODE
LOW	apps/inbound-mail/src/python/DNS/__init__.py	19	CODE
LOW	apps/inbound-mail/src/python/dkim/__init__.py	23	CODE
LOW	apps/inbound-mail/src/python/dkim/__init__.py	24	CODE

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/scripts/stop-only.sh	3	# Define the search directory (default to current directory)	COMMENT
MEDIUM	apps/inbound-mail/src/python/DNS/__init__.py	4	# This file is part of the py3dns project.	COMMENT
MEDIUM	apps/inbound-mail/src/python/DNS/lazy.py	3	# This file is part of the pydns project.	COMMENT

Modern Structural Boilerplate6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	apps/inbound-mail/src/python/dkim/canonicalization.py	24	__all__ = [	CODE
LOW	apps/inbound-mail/src/python/dkim/dnsplug.py	23	__all__ = [	CODE
LOW	apps/inbound-mail/src/python/dkim/util.py	28	__all__ = [	CODE
LOW	apps/inbound-mail/src/python/dkim/__init__.py	52	__all__ = [	CODE
LOW	apps/inbound-mail/src/python/dkim/crypto.py	22	__all__ = [	CODE
LOW	apps/inbound-mail/src/python/dkim/asn1.py	22	__all__ = [	CODE

Cross-Language Confusion (JS/TS)1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	packages/agentinbox/src/screen/screen.ts	55	print(text: string): void;	CODE

AI Slop Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/js/src/ui/core/style/resolveStyle.ts	41	// Find appearance keys in the className and utilize them as well.	COMMENT
LOW	apps/inbound-mail/src/python/spf.py	887	# just use last one in lax mode	STRING

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	…skills/figma-use/references/plugin-api-standalone.d.ts	2418	* ## Example usage	COMMENT
LOW	scripts/sync-skills.sh	11	# Usage:	COMMENT

Slop Phrases2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…s/framework/src/utils/normalize-controls.utils.test.ts	204	data: "{'user':{'name':'John O\\'Connor','message':\"Don't forget to check the user's profile\",'metadata':{'use	CODE
LOW	…s/framework/src/utils/normalize-controls.utils.test.ts	214	expect(parsed.user.message).toBe("Don't forget to check the user's profile");	CODE

novuhq/novu

Open-Source Code Quality, Security and Technical Debt Review