The official Go library for the OpenAI API
This report summarizes scanner evidence for openai/openai-go, a Go project with 3,490 GitHub stars. SynthScan examined 185,246 lines of code across 579 source files, recording 1167 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 12.8 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 991 finding(s).
Are imports declared and package/API names verified? 176 finding(s).
Are wrappers, guards, and repeated structures necessary? 58 finding(s).
Which changes need focused human review? 1167 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1167 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | adminorganizationprojectspendlimit_test.go | 30 | _, err := client.Admin.Organization.Projects.SpendLimit.Get(context.TODO(), "proj_123") | CODE |
| CRITICAL | adminorganizationprojectspendlimit_test.go | 54 | _, err := client.Admin.Organization.Projects.SpendLimit.Update( | CODE |
| CRITICAL | adminorganizationprojectspendlimit_test.go | 86 | _, err := client.Admin.Organization.Projects.SpendLimit.Delete(context.TODO(), "proj_123") | CODE |
| CRITICAL | betaagentsessionturnitem_test.go | 30 | _, err := client.Beta.Agents.Sessions.Turns.Items.List( | CODE |
| CRITICAL | adminorganizationgrouprole_test.go | 30 | _, err := client.Admin.Organization.Groups.Roles.New( | CODE |
| CRITICAL | adminorganizationgrouprole_test.go | 60 | _, err := client.Admin.Organization.Groups.Roles.Get( | CODE |
| CRITICAL | adminorganizationgrouprole_test.go | 88 | _, err := client.Admin.Organization.Groups.Roles.List( | CODE |
| CRITICAL | adminorganizationgrouprole_test.go | 120 | _, err := client.Admin.Organization.Groups.Roles.Delete( | CODE |
| CRITICAL | adminorganizationgroupuser_test.go | 30 | _, err := client.Admin.Organization.Groups.Users.New( | CODE |
| CRITICAL | adminorganizationgroupuser_test.go | 60 | _, err := client.Admin.Organization.Groups.Users.Get( | CODE |
| CRITICAL | adminorganizationgroupuser_test.go | 88 | _, err := client.Admin.Organization.Groups.Users.List( | CODE |
| CRITICAL | adminorganizationgroupuser_test.go | 120 | _, err := client.Admin.Organization.Groups.Users.Delete( | CODE |
| CRITICAL | betathreadrunstep_test.go | 30 | _, err := client.Beta.Threads.Runs.Steps.Get( | CODE |
| CRITICAL | betathreadrunstep_test.go | 62 | _, err := client.Beta.Threads.Runs.Steps.List( | CODE |
| CRITICAL | adminorganizationprojectserviceaccount_test.go | 30 | _, err := client.Admin.Organization.Projects.ServiceAccounts.New( | CODE |
| CRITICAL | adminorganizationprojectserviceaccount_test.go | 62 | _, err := client.Admin.Organization.Projects.ServiceAccounts.Get( | CODE |
| CRITICAL | adminorganizationprojectserviceaccount_test.go | 90 | _, err := client.Admin.Organization.Projects.ServiceAccounts.Update( | CODE |
| CRITICAL | adminorganizationprojectserviceaccount_test.go | 122 | _, err := client.Admin.Organization.Projects.ServiceAccounts.List( | CODE |
| CRITICAL | adminorganizationprojectserviceaccount_test.go | 153 | _, err := client.Admin.Organization.Projects.ServiceAccounts.Delete( | CODE |
| CRITICAL | betaagentsessiontrace_test.go | 30 | _, err := client.Beta.Agents.Sessions.Traces.List( | CODE |
| CRITICAL | agents_helpers_example_test.go | 48 | items := client.Beta.Agents.Sessions.Items.ListAutoPaging(context.Background(), "session_id", openai.BetaAgentSessionIt | CODE |
| CRITICAL | adminorganizationprojecthostedtoolpermission_test.go | 30 | _, err := client.Admin.Organization.Projects.HostedToolPermissions.Get(context.TODO(), "project_id") | CODE |
| CRITICAL | adminorganizationprojecthostedtoolpermission_test.go | 54 | _, err := client.Admin.Organization.Projects.HostedToolPermissions.Update( | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 100 | if _, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{destination: source | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 108 | if _, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), files); err == nil { | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 114 | if _, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/x": sym | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 118 | if _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), filepath.Dir(source), "/works | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 121 | if _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), "", "/workspace", []string{"* | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 312 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), files) | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 322 | prepared, err = client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), directory, "/workspace", [ | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 331 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/a": | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 399 | if _, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/input.tx | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 402 | if _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), selected, "/workspace/data", | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 405 | if _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), alias, "/workspace/data", []s | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 408 | if _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), alias+string(filepath.Separat | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 577 | _, err := client.Beta.Agents.Environments.Files.Prepare(ctx, map[string]string{"/workspace/input": missing}) | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 581 | _, err = client.Beta.Agents.Environments.Files.PrepareDirectory(ctx, missing, "/workspace", []string{"*"}) | CODE |
| CRITICAL⚡ | beta_agents_files_test.go | 585 | _, err = client.Beta.Agents.Environments.Files.Upload(ctx, "env", missing, "/workspace/input") | CODE |
| CRITICAL | beta_agents_files_test.go | 76 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/inpu | CODE |
| CRITICAL | beta_agents_files_test.go | 84 | staged, err := client.Beta.Agents.Environments.Files.Upload(context.Background(), "env", source, "/workspace/input.txt" | CODE |
| CRITICAL | beta_agents_files_test.go | 147 | _, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), directory, "/workspace/data", | CODE |
| CRITICAL | beta_agents_files_test.go | 172 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), files) | CODE |
| CRITICAL | beta_agents_files_test.go | 180 | if _, err := keyed.Beta.Agents.Environments.Files.Prepare(context.Background(), files, opts...); err == nil { | CODE |
| CRITICAL | beta_agents_files_test.go | 204 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), directory, "/workspace/da | CODE |
| CRITICAL | beta_agents_files_test.go | 242 | artifacts := client.Beta.Agents.Sessions.Artifacts.ForResult(result) | CODE |
| CRITICAL | beta_agents_files_test.go | 266 | _, err := client.Beta.Agents.Sessions.Artifacts.ForResult(&openai.BetaAgentTurnResult{Turn: openai.Turn{ID: "root", S | CODE |
| CRITICAL | beta_agents_files_test.go | 350 | _, err := client.Beta.Agents.Environments.Files.Upload(context.Background(), "env", betaLocalFile(t, "input", "source") | CODE |
| CRITICAL | beta_agents_files_test.go | 370 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/a": | CODE |
| CRITICAL | beta_agents_files_test.go | 444 | artifact, err := client.Beta.Agents.Sessions.Artifacts.ForResult(&openai.BetaAgentTurnResult{Turn: openai.Turn{ID: "roo | CODE |
| CRITICAL | beta_agents_files_test.go | 474 | _, err := client.Beta.Agents.Environments.Files.Upload(context.Background(), "env", betaLocalFile(t, "input", "source | CODE |
| CRITICAL | beta_agents_files_test.go | 501 | _, err = client.Beta.Agents.Environments.Files.Upload(context.Background(), "env", source, "/workspace/a") | CODE |
| CRITICAL | beta_agents_files_test.go | 503 | _, err = client.Beta.Agents.Environments.Files.Prepare(context.Background(), map[string]string{"/workspace/a": sourc | CODE |
| CRITICAL | beta_agents_files_test.go | 533 | prepared, err := client.Beta.Agents.Environments.Files.Prepare(ctx, map[string]string{"/workspace/a": first, "/workspac | CODE |
| CRITICAL | beta_agents_files_test.go | 566 | _, err := client.Beta.Agents.Sessions.Artifacts.ForResult(&openai.BetaAgentTurnResult{Turn: openai.Turn{ID: "root", Ses | CODE |
| CRITICAL | beta_agents_files_test.go | 619 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), root, "/workspace", []st | CODE |
| CRITICAL | beta_agents_files_test.go | 626 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), root, "/workspace", []st | CODE |
| CRITICAL | beta_agents_files_test.go | 655 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), root, "/workspace", []st | CODE |
| CRITICAL | beta_agents_files_test.go | 664 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), root, "/workspace", []str | CODE |
| CRITICAL | beta_agents_files_test.go | 677 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), filepath.Dir(source), "/ | CODE |
| CRITICAL | beta_agents_files_test.go | 707 | prepared, err := client.Beta.Agents.Environments.Files.PrepareDirectory(context.Background(), test.directory, "/works | CODE |
| 88 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | finetuningjob.go | 21 | "github.com/openai/openai-go/v3/shared/constant" | COMMENT |
| LOW | finetuningjob.go | 181 | FineTunedModel string `json:"fine_tuned_model" api:"required"` | COMMENT |
| LOW | finetuningjob.go | 201 | // `validating_files`, `queued`, `running`, `succeeded`, `failed`, or `cancelled`. | COMMENT |
| LOW | finetuningjob.go | 521 | const ( | COMMENT |
| LOW | finetuningjob.go | 581 | return apijson.UnmarshalRoot(data, r) | COMMENT |
| LOW | finetuningjob.go | 601 | // [preference](https://developers.openai.com/api/docs/guides/direct-preference-optimization) | COMMENT |
| LOW | finetuningjob.go | 621 | // periodically during fine-tuning. These metrics can be viewed in the fine-tuning | COMMENT |
| LOW | finetuningjob.go | 761 | return param.MarshalObject(r, (*shadow)(&r)) | COMMENT |
| LOW | embedding.go | 141 | // ID of the model to use. You can use the | COMMENT |
| LOW | betaagent.go | 141 | Metadata map[string]string `json:"metadata" api:"required"` | COMMENT |
| LOW | betaagent.go | 461 | type AgentCreateSubagentCallItem struct { | COMMENT |
| LOW | betaagent.go | 661 | COMMENT | |
| LOW | betaagent.go | 741 | COMMENT | |
| LOW | betaagent.go | 861 | COMMENT | |
| LOW | betaagent.go | 1021 | // AgentOutputItemUnionOutput provides convenient access to the sub-properties of | COMMENT |
| LOW | betaagent.go | 1441 | // The object type. Always `agent.session`. | COMMENT |
| LOW | betaagent.go | 1481 | } | COMMENT |
| LOW | betaagent.go | 1521 | COMMENT | |
| LOW | betaagent.go | 1641 | } | COMMENT |
| LOW | betaagent.go | 2361 | COMMENT | |
| LOW | betaagent.go | 2381 | // [AgentSessionSubagentActiveEvent], [AgentSessionSubagentClosedEvent], | COMMENT |
| LOW | betaagent.go | 2401 | // "agent.output.command_execution_output.delta", "agent.session.created", | COMMENT |
| LOW | betaagent.go | 2521 | // case openai.AgentSessionTurnCreatedEvent: | COMMENT |
| LOW | betaagent.go | 2881 | raw string | COMMENT |
| LOW | betaagent.go | 2921 | // AgentSessionEventUnionItemError is an implicit subunion of | COMMENT |
| LOW | betaagent.go | 2941 | COMMENT | |
| LOW | betaagent.go | 3021 | } `json:"-"` | COMMENT |
| LOW | betaagent.go | 3521 | // [AgentMcpCallItem], [AgentSessionItemComputerUseCall], | COMMENT |
| LOW | betaagent.go | 3641 | func (AgentSendSubagentInputCallItem) implAgentSessionItemUnion() {} | COMMENT |
| LOW | betaagent.go | 3801 | COMMENT | |
| LOW | betaagent.go | 5261 | COMMENT | |
| LOW | betaagent.go | 5381 | AllowedTools []string `json:"allowed_tools" api:"required"` | COMMENT |
| LOW | betaagent.go | 5801 | // `false`. | COMMENT |
| LOW | betaagent.go | 5981 | } | COMMENT |
| LOW | betaagent.go | 6101 | // An environment hosted by OpenAI. | COMMENT |
| LOW | betaagent.go | 6421 | // | COMMENT |
| LOW | betaagent.go | 6441 | CapabilityDirectories []string `json:"capability_directories,omitzero"` | COMMENT |
| LOW | betaagent.go | 7361 | // McpTransportUnion contains all possible properties and values from | COMMENT |
| LOW | betaagent.go | 7621 | COMMENT | |
| LOW | betaagent.go | 8341 | COMMENT | |
| LOW | betaagent.go | 8381 | "connection_origin", "service", "environment", | COMMENT |
| LOW | betaagent.go | 8861 | Name string `json:"name" api:"required"` | COMMENT |
| LOW | betaagent.go | 9221 | // anyWebSearchAction is implemented by each variant of [WebSearchActionUnion] to | COMMENT |
| LOW | betaagent.go | 9421 | Instructions param.Opt[string] `json:"instructions,omitzero"` | COMMENT |
| LOW | completion.go | 201 | COMMENT | |
| LOW | completion.go | 261 | func (r CompletionUsagePromptTokensDetails) RawJSON() string { return r.JSON.raw } | COMMENT |
| LOW | completion.go | 281 | // the highest log probability per token). Results cannot be streamed. | COMMENT |
| LOW | completion.go | 301 | // the sampled token, so there may be up to `logprobs+1` elements in the response. | COMMENT |
| LOW | completion.go | 321 | // talk about new topics. | COMMENT |
| LOW | completion.go | 341 | Temperature param.Opt[float64] `json:"temperature,omitzero"` | COMMENT |
| LOW | upload.go | 41 | } | COMMENT |
| LOW | upload.go | 81 | } | COMMENT |
| LOW | upload.go | 121 | CreatedAt int64 `json:"created_at" api:"required" format:"unixtime"` | COMMENT |
| LOW | adminorganizationexternalstorage.go | 201 | // values from [AwsExternalStorageProvider], [AzureExternalStorageProvider], | COMMENT |
| LOW | adminorganizationexternalstorage.go | 261 | // [ExternalStorageConfigurationProviderUnion] to add type safety for the return | COMMENT |
| LOW | betaagentvaultcredential.go | 601 | // The destinations where the proxy can substitute this secret. The environment | COMMENT |
| LOW | betaagentvaultcredential.go | 1421 | COMMENT | |
| LOW | betathreadrunstep.go | 21 | "github.com/openai/openai-go/v3/shared/constant" | COMMENT |
| LOW | betathreadrunstep.go | 421 | COMMENT | |
| LOW | betathreadrunstep.go | 761 | AssistantID string `json:"assistant_id" api:"required"` | COMMENT |
| 856 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/castiron/test_custom_code_github.py | 60 | def test_trusted_report_recomputes_pr_output_in_a_bare_repository(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 163 | def test_fork_association_fallback_paginates_candidates(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 181 | def test_trusted_report_rejects_invalid_or_stale_association_before_fetch(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 246 | def test_queue_membership_uses_synthetic_commit_not_original_pr_ancestry(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 317 | def test_merge_queue_rule_is_required_before_passing(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 324 | def test_wrong_or_superseded_source_runs_fail_before_fetching(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 338 | def test_reuses_only_matching_main_job_report(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 364 | def test_queue_cannot_reuse_pr_measurement(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 370 | def test_evaluation_error_emits_failure_outputs_and_diagnostic_summary(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 425 | def test_queue_context_refuses_stale_checkout_before_fetching(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 432 | def test_github_uses_fresh_bare_data_repo_and_checks_current_head(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_github.py | 458 | def test_stale_pull_and_wrong_target_fail_before_objects_created(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 19 | def test_git_preserves_authentication_without_inherited_repository_routing(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 48 | def test_rust_and_python_hashes_match(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 72 | def test_reporting_script_can_be_a_mixed_file(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 82 | def test_hash_vector_and_exclusions(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 126 | def test_report_ignores_handwritten_files_and_shows_custom_patch(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 144 | def test_bad_hash_and_lost_checkpoint_fail(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 156 | def test_stats_symlink_is_rejected(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 165 | def test_public_snapshot_rejects_private_governance_and_unpublished_paths(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 196 | def test_zero_new_files_summary_reports_existing_changes(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 211 | def test_new_mixed_file_headline_includes_changed_generated_baselines(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 229 | def test_removals_include_changed_baselines_but_not_handwritten_only_files(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_report.py | 256 | def test_public_snapshot_has_no_private_history_and_reports_without_private_remote( | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 32 | def test_additions_and_deletions_do_not_cancel(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 38 | def test_below_equal_and_above_limit(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 48 | def test_whole_generated_file_deletion_is_counted(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 54 | def test_restoring_generated_content_removes_customization(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 62 | def test_handwritten_only_files_keep_existing_report_scope(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 66 | def test_increase_is_isolated_but_does_not_apply_to_itself(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 73 | def test_entire_pr_must_be_budget_only_not_just_latest_commit(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 83 | def test_new_base_budget_is_used_for_stale_pr_branch(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 95 | def test_decrease_must_fit_current_usage(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 104 | def test_missing_base_policy_fails_closed(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_budget.py | 111 | def test_policy_deletion_rename_symlink_and_mode_change_fail(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 128 | def test_invalid_policy_values_fail(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 149 | def test_bad_snapshot_and_binary_change_fail_budget(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 163 | def test_budget_uses_existing_reporter_with_strict_verification(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 172 | def test_queue_isolates_prs_but_uses_main_budget_for_combined_tree(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 187 | def test_queue_without_verified_members_fails(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 192 | def test_cli_executes_trusted_reporter_not_inspected_repo(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_budget.py | 217 | def test_summary_has_counts_revisions_and_no_longer_generated(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 44 | def test_trusted_failure_publisher_updates_one_current_comment(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 88 | def test_workflow_reports_all_branches_without_write_credentials(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 126 | def test_comment_only_rerun_links_to_the_compute_artifact_attempt(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 195 | def test_comment_updates_existing_bot_comment_and_skips_stale(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 238 | def test_comment_rejects_older_runs_attempts_and_wrong_pr(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 358 | def test_statuses_attach_to_candidate_not_main(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 367 | def test_fork_statuses_with_no_commit_association(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 387 | def test_stale_pr_head_is_not_published(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 390 | def test_pr_snapshot_survives_main_advancing(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 396 | def test_queue_still_rejects_main_advancing(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 401 | def test_missing_evaluation_publishes_actionable_failures(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 410 | def test_superseded_or_wrong_source_run_cannot_publish(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 420 | def test_independent_check_failures_are_preserved(self) -> None: | CODE |
| LOW⚡ | scripts/castiron/test_custom_code_publication.py | 424 | def test_older_evaluation_cannot_overwrite_newer_failure(self) -> None: | CODE |
| LOW | scripts/castiron/test_custom_code_publication.py | 436 | def test_publication_guard_allows_current_retry_and_ignores_unrelated_statuses(self) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | finetuningjob.go | 541 | // through directly to WandB. Some default tags are generated by OpenAI: | COMMENT |
| HIGH | finetuningjob.go | 784 | // through directly to WandB. Some default tags are generated by OpenAI: | COMMENT |
| HIGH | contentprovenancecheck.go | 45 | // uploaded file. The content could still have been generated by OpenAI if the | COMMENT |
| HIGH | contentprovenancecheck.go | 48 | // signals were available. Content could also still be AI-generated by another | COMMENT |
| HIGH | contentprovenancecheck.go | 174 | // file. The content could still have been generated by OpenAI if the metadata was | COMMENT |
| HIGH | contentprovenancecheck.go | 177 | // available. Content could also still be AI-generated by another company's model, | COMMENT |
| HIGH | contentprovenancecheck.go | 215 | // could still have been generated by OpenAI if the metadata was stripped or has | COMMENT |
| HIGH | contentprovenancecheck.go | 218 | // Content could also still be AI-generated by another company's model, which the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | data_residency_contract_test.go | 45 | return []option.RequestOption{option.WithAPIKey("dummy-key"), option.WithHTTPClient(recorder), option.WithMaxRetries(0) | CODE |
| LOW | retry_delay_test.go | 119 | option.WithAPIKey("fake-key"), | CODE |
| LOW | retry_delay_test.go | 176 | option.WithAPIKey("fake-key"), | CODE |
| LOW | multipart_scalar_test.go | 82 | option.WithBaseURL("https://sdk.test/"), option.WithAPIKey("fake-key"), | CODE |
| LOW | azure/data_residency_integration_test.go | 43 | return []option.RequestOption{option.WithAPIKey("dummy-key"), option.WithHTTPClient(recorder), option.WithMaxRetries(0) | CODE |
| LOW | azure/provider_headers_test.go | 19 | t.Setenv("OPENAI_CUSTOM_HEADERS", "X-Api-Key: fake-secret\nCookie: fake-cookie\nX-Amz-Security-Token: fake-token\nX-Cus | CODE |
| LOW | azure/provider_headers_test.go | 84 | } else if received.Get("Authorization") != "Bearer fake_token" || received.Get("Api-Key") != "" { | CODE |
| LOW | azure/provider_headers_test.go | 117 | if received.Get("X-Azure-Gateway") != "fake-gateway-key" || received.Get("Authorization") != "Bearer fake_token" || rec | CODE |
| LOW | azure/azure_test.go | 399 | headerValue: "Bearer fake_token", | CODE |
| LOW | azure/azure_test.go | 512 | headerValue: "Bearer fake_token", | CODE |
| LOW | azure/azure_test.go | 991 | headerValue: "Bearer fake_token", | CODE |
| LOW | azure/azure_test.go | 1088 | headerValue: "Bearer fake_token", | CODE |
| LOW | azure/authentication_test.go | 189 | wantAuthorization: "Bearer fake_token", | CODE |
| LOW | azure/authentication_test.go | 274 | wantAuthorization: "Bearer fake_token", | CODE |
| LOW | azure/authentication_test.go | 521 | wantAuthorization: "Bearer fake_token", | CODE |
| LOW | internal/requestconfig/websocket_test.go | 42 | if r.Header.Get("Authorization") != "Bearer fake-key" || r.Header.Get("OpenAI-Organization") != "org-test" || r.Header | CODE |
| LOW | internal/requestconfig/websocket_test.go | 64 | connection, err := dialPrepared(t, option.WithBaseURL(server.URL+"/custom/v1?base=yes"), option.WithAPIKey("fake-key"), | CODE |
| LOW | internal/requestconfig/websocket_test.go | 95 | _, err := dialPrepared(t, option.WithBaseURL(server.URL), option.WithAPIKey("fake-key")) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/castiron/custom_code_report.py | 6 | Hash v1: SHA256(domain || u64(entry count) || entries), where each entry is | STRING |
| HIGH | scripts/castiron/custom_code_report.py | 7 | u64(path length) || path bytes || six ASCII Git mode bytes || u64(blob length) | STRING |
| HIGH | scripts/castiron/test_custom_code_budget.py | 138 | '{"schema_version":1,"max_custom_patch_lines":null}', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/castiron/custom_code_budget.py | 9 | CODE | |
| LOW | scripts/castiron/test_custom_code_github.py | 4 | CODE | |
| LOW | scripts/castiron/test_custom_code_report.py | 2 | CODE | |
| LOW | scripts/castiron/custom_code_report.py | 12 | CODE | |
| LOW | scripts/castiron/custom_code_test_support.py | 4 | CODE | |
| LOW | scripts/castiron/test_custom_code_budget.py | 3 | CODE | |
| LOW | scripts/castiron/test_custom_code_publication.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/castiron/test_custom_code_github.py | 60 | CODE | |
| LOW | scripts/castiron/test_custom_code_github.py | 181 | CODE | |
| LOW | scripts/castiron/test_custom_code_github.py | 338 | CODE | |
| LOW | scripts/castiron/custom_code_report.py | 598 | CODE | |
| LOW | scripts/castiron/custom_code_report.py | 950 | CODE | |
| LOW | scripts/castiron/test_custom_code_budget.py | 111 | CODE | |
| LOW | scripts/castiron/test_custom_code_publication.py | 44 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ills/openai-go-pr-review/references/learned-gotchas.md | 33 | ## Shared scaffolding can be generated without looking generated | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | streamaccumulator_test.go | 26 | Santorini is a gem in the Aegean Sea, known for its stunning sunsets, white-washed buildings, and crystal-clear waters. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/castiron/test_custom_code_publication.py | 313 | CODE |