Home / openspug / spug
AI Slop Code RIsk Monitor

openspug/spug

Spug is a lightweight agent-free automatic operation and maintenance platform designed for small and medium-sized enterprises. It integrates host management, host batch execution, host online terminal, file management, application release and deployment, pipelines, online task planning, configuration center, monitoring, alarm and so on.

6.1 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for openspug/spug, a JavaScript project with 11,083 GitHub stars. SynthScan examined 38,875 lines of code across 459 source files, recording 173 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 6.1 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

6.1
Adjusted Signal
6.1
Raw Pattern Score
100%
Time Factor
2026-10-11
Last Push
11.1K
Stars
JavaScript
Language
38.9K
Lines of Code
459
Files
173
Pattern Hits
2026-10-12
Scan Date
0.03
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 9.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 81 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.7/100 · LOW

Are imports declared and package/API names verified? 32 finding(s).

Agent Over-Engineering Ratio 14.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 63 finding(s).

PR Review Velocity Impact 28.6/100 · MEDIUM

Which changes need focused human review? 173 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 15MEDIUM 7LOW 151

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 173 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Empty Error Handlers13 hits · 65 pts
SeverityFileLineSnippetContext
HIGHspug_api/spug/settings.py147except ImportError:CODE
HIGHspug_api/libs/validators.py27except ValueError:CODE
HIGHspug_api/apps/pipeline/models.py135except FileNotFoundError:CODE
HIGHspug_api/apps/repository/models.py59except FileNotFoundError:CODE
HIGHspug_api/apps/repository/models.py65except FileNotFoundError:CODE
HIGHspug_api/apps/schedule/builtin.py63except IndexError:CODE
HIGHspug_api/apps/schedule/scheduler.py93except DatabaseError:CODE
HIGHspug_api/apps/monitor/scheduler.py48except DatabaseError:CODE
HIGHspug_api/apps/file/utils.py83except FileNotFoundError:CODE
HIGHspug_api/apps/deploy/models.py77except FileNotFoundError:CODE
HIGHspug_api/apps/deploy/models.py73except FileNotFoundError:CODE
HIGHspug_api/apps/deploy/models.py68except FileNotFoundError:CODE
HIGHspug_api/apps/exec/views.py160except ProcessLookupError:CODE
Deep Nesting57 hits · 57 pts
SeverityFileLineSnippetContext
LOWspug_api/libs/ldap.py60CODE
LOWspug_api/libs/spug.py41CODE
LOWspug_api/libs/spug.py192CODE
LOWspug_api/libs/parser.py29CODE
LOWspug_api/libs/utils.py133CODE
LOWspug_api/libs/ssh.py207CODE
LOWspug_api/libs/middleware.py34CODE
LOWspug_api/libs/middleware.py55CODE
LOWspug_api/consumer/utils.py51CODE
LOWspug_api/apps/pipeline/utils.py136CODE
LOWspug_api/apps/pipeline/utils.py249CODE
LOWspug_api/apps/pipeline/helper.py21CODE
LOWspug_api/apps/pipeline/helper.py59CODE
LOWspug_api/apps/pipeline/helper.py137CODE
LOWspug_api/apps/pipeline/views.py84CODE
LOWspug_api/apps/repository/utils.py93CODE
LOWspug_api/apps/schedule/utils.py17CODE
LOWspug_api/apps/schedule/builtin.py24CODE
LOWspug_api/apps/schedule/builtin.py78CODE
LOWspug_api/apps/schedule/scheduler.py96CODE
LOWspug_api/apps/monitor/executors.py101CODE
LOWspug_api/apps/monitor/executors.py139CODE
LOWspug_api/apps/monitor/utils.py48CODE
LOWspug_api/apps/monitor/scheduler.py51CODE
LOWspug_api/apps/monitor/views.py111CODE
LOWspug_api/apps/apis/config.py49CODE
LOWspug_api/apps/apis/deploy.py37CODE
LOWspug_api/apps/apis/exec.py70CODE
LOWspug_api/apps/apis/pipeline.py22CODE
LOWspug_api/apps/host/add.py30CODE
LOWspug_api/apps/host/utils.py189CODE
LOWspug_api/apps/host/group.py32CODE
LOWspug_api/apps/app/views.py123CODE
LOWspug_api/apps/file/utils.py25CODE
LOWspug_api/apps/file/utils.py73CODE
LOWspug_api/apps/deploy/ext1.py18CODE
LOWspug_api/apps/deploy/utils.py32CODE
LOWspug_api/apps/deploy/ext2.py17CODE
LOWspug_api/apps/deploy/ext2.py130CODE
LOWspug_api/apps/deploy/helper.py22CODE
LOWspug_api/apps/deploy/helper.py77CODE
LOWspug_api/apps/deploy/helper.py129CODE
LOWspug_api/apps/deploy/helper.py183CODE
LOWspug_api/apps/deploy/helper.py224CODE
LOWspug_api/apps/deploy/helper.py269CODE
LOWspug_api/apps/deploy/helper.py359CODE
LOWspug_api/apps/deploy/views.py217CODE
LOWspug_api/apps/deploy/views.py64CODE
LOWspug_api/apps/deploy/views.py125CODE
LOWspug_api/apps/exec/transfer.py122CODE
LOWspug_api/apps/exec/transfer.py32CODE
LOWspug_api/apps/exec/views.py134CODE
LOWspug_api/apps/exec/management/commands/runworker.py33CODE
LOWspug_api/apps/exec/management/commands/runworker.py52CODE
LOWspug_api/apps/alarm/views.py96CODE
LOWspug_api/apps/account/views.py184CODE
LOWspug_api/apps/account/management/commands/user.py34CODE
Excessive Try-Catch Wrapping47 hits · 56 pts
SeverityFileLineSnippetContext
LOWspug_api/libs/ldap.py56 except Exception as error:CODE
LOWspug_api/libs/ldap.py81 except Exception as error:CODE
LOWspug_api/libs/ldap.py103 except Exception as error:CODE
MEDIUMspug_api/libs/ldap.py49def connect(self):CODE
LOWspug_api/libs/webhook.py44 except Exception as e:CODE
LOWspug_api/libs/webhook.py50 except Exception:CODE
LOWspug_api/libs/webhook.py135 except Exception as e:CODE
MEDIUMspug_api/libs/webhook.py41def _request(url, data, mode):CODE
LOWspug_api/libs/spug.py44 except Exception as e:CODE
MEDIUMspug_api/libs/spug.py41def handle_request(url, data, mode=None):CODE
LOWspug_api/libs/middleware.py44 except Exception:CODE
LOWspug_api/libs/middleware.py80 except Exception:CODE
LOWspug_api/consumer/consumers.py119 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py120 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py129 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py241 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py292 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py323 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py357 except Exception as e:CODE
LOWspug_api/apps/pipeline/utils.py392 except Exception as e:CODE
LOWspug_api/apps/repository/utils.py69 except Exception as e:CODE
LOWspug_api/apps/repository/utils.py80 except Exception as e:CODE
LOWspug_api/apps/schedule/builtin.py42 except Exception as e:CODE
LOW⚡spug_api/apps/schedule/builtin.py89 except Exception as e:CODE
LOW⚡spug_api/apps/schedule/builtin.py97 except Exception as e:CODE
LOW⚡spug_api/apps/schedule/builtin.py107 except Exception as e:CODE
LOWspug_api/apps/monitor/executors.py29 except Exception as e:CODE
LOWspug_api/apps/monitor/executors.py44 except Exception as e:CODE
LOWspug_api/apps/monitor/executors.py85 except Exception as e:CODE
LOWspug_api/apps/monitor/executors.py97 except Exception as e:CODE
MEDIUMspug_api/apps/monitor/executors.py21def site_check(url, limit):CODE
MEDIUMspug_api/apps/monitor/executors.py37def port_check(addr, port):CODE
MEDIUMspug_api/apps/monitor/executors.py65def ping_check(addr):CODE
MEDIUMspug_api/apps/monitor/executors.py89def host_executor(host, command):CODE
LOWspug_api/apps/apis/deploy.py33 except Exception as e:CODE
LOWspug_api/apps/deploy/ext1.py69 except Exception as e:CODE
LOWspug_api/apps/deploy/ext1.py116 except Exception as e:CODE
LOWspug_api/apps/deploy/utils.py66 except Exception as e:CODE
LOWspug_api/apps/deploy/ext2.py119 except Exception as e:CODE
LOWspug_api/apps/deploy/ext2.py157 except Exception as e:CODE
LOWspug_api/apps/deploy/ext2.py167 except Exception as e:CODE
LOWspug_api/apps/exec/executors.py80 except Exception as e:CODE
LOWspug_api/apps/exec/management/commands/runworker.py43 except Exception as e:CODE
LOWspug_api/apps/setting/views.py179 except Exception as e:CODE
LOWspug_api/apps/setting/views.py216 except Exception as e:CODE
LOWspug_api/apps/setting/views.py231 except Exception as e:CODE
LOWspug_api/apps/setting/views.py247 except Exception as e:CODE
Unused Imports30 hits · 30 pts
SeverityFileLineSnippetContext
LOWspug_api/spug/settings.py146CODE
LOWspug_api/libs/__init__.py4CODE
LOWspug_api/libs/__init__.py4CODE
LOWspug_api/libs/__init__.py5CODE
LOWspug_api/libs/__init__.py6CODE
LOWspug_api/libs/__init__.py7CODE
LOWspug_api/libs/__init__.py8CODE
LOWspug_api/libs/ssh.py9CODE
LOWspug_api/consumer/routing.py6CODE
LOWspug_api/apps/home/urls.py6CODE
LOWspug_api/apps/notify/urls.py6CODE
LOWspug_api/apps/repository/urls.py6CODE
LOWspug_api/apps/repository/views.py6CODE
LOWspug_api/apps/repository/views.py7CODE
LOWspug_api/apps/schedule/builtin.py6CODE
LOWspug_api/apps/schedule/urls.py6CODE
LOWspug_api/apps/monitor/urls.py6CODE
LOWspug_api/apps/host/urls.py6CODE
LOWspug_api/apps/app/urls.py6CODE
LOWspug_api/apps/file/urls.py6CODE
LOWspug_api/apps/config/urls.py6CODE
LOWspug_api/apps/config/views.py9CODE
LOWspug_api/apps/deploy/urls.py6CODE
LOWspug_api/apps/alarm/urls.py6CODE
LOWspug_api/apps/account/urls.py6CODE
LOWspug_api/apps/account/urls.py7CODE
LOWspug_api/apps/account/views.py6CODE
LOWspug_api/apps/account/views.py20CODE
LOWspug_api/apps/setting/urls.py6CODE
LOWspug_api/apps/setting/views.py19CODE
Over-Commented Block19 hits · 19 pts
SeverityFileLineSnippetContext
LOWspug_api/spug/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/consumer/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/home/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/notify/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/pipeline/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/credential/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/repository/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/schedule/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/monitor/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/apis/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/host/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/app/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/file/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/config/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/deploy/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/exec/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/alarm/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/account/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
LOWspug_api/apps/setting/__init__.py1# Copyright: (c) OpenSpug Organization. https://github.com/openspug/spugCOMMENT
Cross-Language Confusion2 hits · 8 pts
SeverityFileLineSnippetContext
HIGHspug_api/libs/utils.py96 'SPUG_PY=$(command -v python3 || command -v python)\n'CODE
HIGHspug_api/libs/ssh.py215 command += '[ -n "$ZSH_VERSION" ] && set +o zle && set -o no_nomatch && HISTFILE=""\n'STRING
Hyper-Verbose Identifiers3 hits · 2 pts
SeverityFileLineSnippetContext
LOWspug_api/libs/ssh.py159 def _win_exec_command_with_stream(self, command, environment=None):STRING
LOWspug_api/apps/host/utils.py33def check_instance_charge_type(value, supplier):CODE
LOWspug_api/apps/host/utils.py47def check_internet_charge_type(value, supplier):CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWspug_api/libs/locale.py310# Display values of model field choices, returned to the client through theCOMMENT
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOWspug_api/libs/spug.py41 def handle_request(url, data, mode=None):CODE