1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

6.1K

Stars

Language

201.1K

Lines of Code

517

Files

136

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 70 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 5.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 66 finding(s).

PR Review Velocity Impact 6.6/100 · LOW

Which changes need focused human review? 136 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 67LOW 68

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 136 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators66 hits · 207 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/listobjects/pipeline/doc.go	20	// ┌─────────┐ ┌─────────┐ ┌─────────┐	COMMENT
MEDIUM	internal/listobjects/pipeline/doc.go	23	// └─────────┘ └─────────┘ └─────────┘	COMMENT
MEDIUM	pkg/storage/keys_test.go	27	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	29	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	214	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	216	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	495	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	497	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	553	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	555	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	571	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	573	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	685	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	687	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	737	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/keys_test.go	739	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	23	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	25	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	395	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	397	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	604	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	606	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	879	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	881	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	961	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	963	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	1007	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	1009	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	1051	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/cached_reader_test.go	1053	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	20	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	22	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	32	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	34	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	36	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	pkg/storage/storagewrappers/iterator_cache.go	38	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache.go	67	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache.go	69	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache.go	357	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache.go	359	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	25	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	27	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	78	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	80	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	344	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	346	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	972	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	974	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	1219	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	1221	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	1243	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/storage/storagewrappers/iterator_cache_test.go	1245	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	27	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	29	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	80	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	82	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	171	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	173	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	260	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…orage/storagewrappers/iterator_cache_benchmark_test.go	262	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
6 more matches not shown…

Over-Commented Block68 hits · 68 pts

Severity	File	Line	Snippet	Context
LOW	internal/graph/recursive_resolver.go	21	"github.com/openfga/openfga/pkg/typesystem"	COMMENT
LOW	internal/graph/recursive_resolver.go	261	return finalResult, nil	COMMENT
LOW	internal/graph/interface.go	21	// parent request.	COMMENT
LOW	internal/graph/graph.go	121	//	COMMENT
LOW	internal/utils/reduce.go	1	package utils	COMMENT
LOW	internal/listobjects/pipeline/pipeline.go	461		COMMENT
LOW	internal/listobjects/pipeline/doc.go	1	// Package pipeline implements reverse expansion for authorization queries.	COMMENT
LOW	internal/listobjects/pipeline/doc.go	21	// │ Worker │◄────│ Worker │◄────│ Worker │	COMMENT
LOW	internal/listobjects/pipeline/doc.go	41	// - Coordinated shutdown ensures all in-flight messages are processed	COMMENT
LOW	internal/listobjects/pipeline/doc.go	61	// }	COMMENT
LOW	internal/listobjects/pipeline/internal/track/doc.go	1	// Package track provides coordination primitives for detecting when a	COMMENT
LOW	internal/listobjects/pipeline/internal/worker/cycle.go	81	}	COMMENT
LOW	internal/listobjects/pipeline/internal/worker/core.go	41	// [SpecificTypeAndRelation] node.	COMMENT
LOW	…ine/internal/worker/difference_direct_subtract_test.go	21	"github.com/openfga/openfga/pkg/storage/memory"	COMMENT
LOW	internal/listobjects/pipeline/internal/worker/doc.go	1	// Package worker implements the concurrent processing nodes that form	COMMENT
LOW	internal/modelgraph/benchmarks_test.go	21	// model is the FGA DSL for the authorization model.	COMMENT
LOW	internal/telemetry/tracing.go	61	samplingRatio float64	COMMENT
LOW	internal/containers/doc.go	1	// Package containers provides generic, concurrency-safe data structures.	COMMENT
LOW	internal/containers/mpmc/queue.go	21	// head or tail position.	COMMENT
LOW	internal/containers/mpmc/doc.go	1	// Package mpmc provides a bounded, multiple-producer, multiple-consumer	COMMENT
LOW	internal/containers/mpsc/doc.go	1	// Package mpsc provides a lock-free MPSC (multiple-producer, single-consumer)	COMMENT
LOW	internal/containers/mpsc/accumulator.go	21	Next atomic.Pointer[node[T]]	COMMENT
LOW	internal/check/check_test.go	681	// Same invariant as ResolveUnionEdges: the goroutine must not write to cache when	COMMENT
LOW	internal/check/strategies.go	61		COMMENT
LOW	internal/check/recursive_ttu_collision_test.go	21	// "full_admin from parent") sharing the same `visited` map. Both branches read	COMMENT
LOW	internal/check/weight2_test.go	1041	// 1. Right processes contextual value "group:9" → sets lastRightVal = "group:9"	COMMENT
LOW	internal/validation/doc.go	1	// Package validation provides tuple and request validation against an	COMMENT
LOW	.github/workflows/codeql.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/codeql.yml	81	# If you wish to specify custom queries, you can do so here or in a config file.	COMMENT
LOW	.github/workflows/scorecard.yml	41	with:	COMMENT
LOW	assets/tests/consolidated_1_1_tests.yaml	2841	# type group	COMMENT
LOW	assets/tests/consolidated_1_1_tests.yaml	2861	# user: group:1#member	COMMENT
LOW	assets/tests/abac_tests.yaml	1741	# - request:	COMMENT
LOW	pkg/server/server.go	401	// This number should be set depending on the RPS expected for Check and ListObjects APIs, the number of OpenFGA replica	COMMENT
LOW	pkg/server/server.go	841	// WithListObjectsBufferCapacity is only effective when the ListObjects "pipeline" algorithm	COMMENT
LOW	pkg/server/batch_check_test.go	821	CorrelationId: correlationID,	COMMENT
LOW	pkg/server/list_objects_test.go	201	require.NoError(t, err)	COMMENT
LOW	pkg/server/config/config.go	381	// ListObjectsPipelineEnabled defines whether the ListObjects pipeline optimization	COMMENT
LOW	pkg/server/commands/check.go	321	// the execute path). ErrThrottledTimeout and ErrTransactionThrottled are included since	COMMENT
LOW	pkg/server/commands/list_objects.go	901	// confirmListObjectsBreakingChange folds a single streamed object into the	COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	41	// check(o#r, r, o); v2 evaluates against the schema and returns FALSE.	COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	81	// CheckReasonFromV2Error maps a v2Check error to a v2-breaking reason when the	COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	101	return ""	COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	141		COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	241	if wildcardReachableUnderDifferenceBase(typesys, targetObjectType, relation, rewrite, subjectType) {	COMMENT
LOW	pkg/server/commands/v2breaking/v2breaking.go	281	// For the four per-user-shape reasons, this looks for the specific user that	COMMENT
LOW	pkg/server/commands/v2breaking/batch.go	21	// does NOT gate on the check's allowed result: the outcome reflects whichever	COMMENT
LOW	pkg/server/commands/reverseexpand/reverse_expand.go	261	return &copy	COMMENT
LOW	…rver/commands/reverseexpand/reverse_expand_weighted.go	121	// It will continue to dispatch and traverse the graph until it reaches a DirectEdge, which	COMMENT
LOW	…rver/commands/reverseexpand/reverse_expand_weighted.go	221	})	COMMENT
LOW	…commands/reverseexpand/reverse_expand_weighted_test.go	841	objectType: "org",	COMMENT
LOW	…commands/reverseexpand/reverse_expand_weighted_test.go	861	// define member: [team#member] and allowed	COMMENT
LOW	pkg/storage/storage.go	141	// Deletes is a typesafe alias for Delete arguments.	COMMENT
LOW	pkg/storage/storage.go	181	// and the filter	COMMENT
LOW	pkg/storage/storage.go	221	// OnMissingDeleteError indicates that if a delete operation is attempted on a tuple that does	COMMENT
LOW	pkg/storage/cache/keys/build.go	21		COMMENT
LOW	pkg/storage/cache/keys/build.go	161	e.WriteTo(kb)	COMMENT
LOW	pkg/storage/cache/keys/xtypes_test.go	841	//	COMMENT
LOW	pkg/storage/cache/keys/doc.go	1	// Package keys provides deterministic, collision-resistant cache key	COMMENT
LOW	pkg/storage/storagewrappers/iterator_cache.go	21	// Constants	COMMENT
8 more matches not shown…

AI Response Leakage1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/check/README.md	261	A tupleset relation `document#parent` must be a direct relationship and it has to be assignable to a direct object type,	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/codeql.yml	63	# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how	COMMENT

openfga/openfga

Open-Source Code Quality, Security and Technical Debt Review