3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

30.7K

Stars

Language

668.7K

Lines of Code

4.2K

Files

1.7K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1662 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 65 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1 finding(s).

PR Review Velocity Impact 13.4/100 · LOW

Which changes need focused human review? 1727 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 10MEDIUM 68LOW 1647

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1727 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1519 hits · 1519 pts

Severity	File	Line	Snippet	Context
LOW	cmd/tofu/version.go	21	// logGodebugUsage produces extra DEBUG log lines if the Go runtime's metrics	COMMENT
LOW	cmd/tofu/provider_source_test.go	161	}	COMMENT
LOW	cmd/tofu/provider_source.go	101	// implicitProviderSource builds a default provider source to use if there's	COMMENT
LOW	cmd/tofu/provider_source.go	121	// (original working directory), not the directory specified with -chdir.	COMMENT
LOW	cmd/tofu/provider_source.go	141	// We'll make sure the directory actually exists before we add it,	COMMENT
LOW	cmd/tofu/provider_source.go	181	// This "userdirs" library implements an appropriate user-specific and	COMMENT
LOW	cmd/tofu/testing.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	cmd/tofu/registries_disco.go	21	// newServiceDiscovery returns a newly-created [disco.Disco] object that is	COMMENT
LOW	tools/loggraphdiff/loggraphdiff.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	tools/loggraphdiff/loggraphdiff.go	21	// module.child.output.a_output - *terraform.NodeApplyableOutput	COMMENT
LOW	tools/find-dep-upgrades/main.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	tools/find-dep-upgrades/main.go	61	// so we'll use that here even though the complexity of that package's	COMMENT
LOW	tools/find-dep-upgrades/main.go	241	}	COMMENT
LOW	tools/selected-go-version/selected-go-version.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	tools/selected-go-version/selected-go-version.go	41	}	COMMENT
LOW	tools/protobuf-compile/protobuf-compile.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	tools/find-pkg-importer/main.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/encryption/plan.go	21	//	COMMENT
LOW	internal/encryption/state.go	21	//	COMMENT
LOW	internal/encryption/state.go	41	//	COMMENT
LOW	internal/encryption/base.go	41	}	COMMENT
LOW	internal/encryption/base.go	61	//	COMMENT
LOW	internal/encryption/keyprovider/config.go	21		COMMENT
LOW	internal/encryption/keyprovider/descriptor.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/encryption/keyprovider/meta.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/encryption/keyprovider/keyprovider.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	…rnal/encryption/keyprovider/openbao/compliance_test.go	21	// By default the tests in here behave like unit tests, running against a	COMMENT
LOW	internal/encryption/method/config.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/encryption/method/method.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/tracing/context_probe.go	21	// primary motivation, but could potentially be used for other	COMMENT
LOW	internal/tracing/context_probe.go	81	// FunctionsReported returns an interable sequence of all of the functions	COMMENT
LOW	internal/tracing/utils.go	121	}	COMMENT
LOW	internal/tracing/data.go	21	// differs when the span is not recording.	COMMENT
LOW	internal/tracing/init.go	41	This mechanism might be removed altogether if a different strategy seems	COMMENT
LOW	internal/tracing/init.go	61	// trace state to use.	COMMENT
LOW	internal/tracing/init.go	81	// https://opentelemetry.io/docs/specs/otel/protocol/exporter/#configuration-options	COMMENT
LOW	internal/tracing/traceattrs/opentofu.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/tracing/traceattrs/opentofu.go	21	// creating import cycles.	COMMENT
LOW	internal/tracing/traceattrs/opentofu.go	41	// [OpenTofuProviderAddress] to indicate which provider the version number is	COMMENT
LOW	internal/tracing/traceattrs/opentofu.go	61	func OpenTofuModuleCallName(name string) attribute.KeyValue {	COMMENT
LOW	internal/tracing/traceattrs/generic.go	21	// it's easier to keep our version selections consistent.	COMMENT
LOW	internal/tracing/traceattrs/semconv.go	21	// semconv version imported by the "go.opentelemetry.io/otel/sdk/resource",	COMMENT
LOW	internal/tracing/traceattrs/semconv.go	81	//	COMMENT
LOW	internal/addrs/provider.go	21	// not have an explicit hostname.	COMMENT
LOW	internal/addrs/provider.go	41	// The this namespace is literally named "builtin", in the hope that users	COMMENT
LOW	internal/addrs/provider.go	61	//	COMMENT
LOW	internal/addrs/provider.go	121	// because existing code expects legacy provider names to pass through	COMMENT
LOW	internal/addrs/provider.go	161	func MustParseProviderSourceString(str string) Provider {	COMMENT
LOW	internal/addrs/provider.go	181	// rather than some similar rules defined locally, because the hostname part	COMMENT
LOW	internal/addrs/check_rule_diagnostic.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/addrs/check_rule_diagnostic.go	21	// contain a CheckRule.	COMMENT
LOW	internal/addrs/move_endpoint.go	21	// addresses in a "moved" statement in the configuration, but it's also	COMMENT
LOW	internal/addrs/move_endpoint.go	81	// For our purposes here we'll just do a unify without a base module	COMMENT
LOW	internal/addrs/move_endpoint.go	161	//	COMMENT
LOW	internal/addrs/unique_key.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/addrs/module_source_test.go	321		COMMENT
LOW	internal/addrs/module_source_test.go	501	// of "normalized" addresses as separate from the original user input,	COMMENT
LOW	internal/addrs/resource_instance_object.go	1	// Copyright (c) The OpenTofu Authors	COMMENT
LOW	internal/addrs/resource_instance_object.go	181	}	COMMENT
LOW	internal/addrs/resource_instance_object.go	201	}	COMMENT
1459 more matches not shown…

Self-Referential Comments34 hits · 98 pts

Severity	File	Line	Snippet	Context
MEDIUM	website/docker-compose.build-non-main.yml	6	# This file is meant to be used only in running the `website` GH workflow on non-main branches and PRs that are targetin	COMMENT
MEDIUM	internal/depsfile/locks_file.go	148	Bytes: []byte("# This file is maintained automatically by \"tofu init\".\n"),	CODE
MEDIUM	internal/depsfile/locks_file_test.go	250	wantContent := `# This file is maintained automatically by "tofu init".	CODE
MEDIUM	internal/backend/remote-state/azure/meta-test/main.tf	3	# Create an application and service account	COMMENT
MEDIUM	internal/command/providers_lock_test.go	46	expected := `# This file is maintained automatically by "tofu init".	CODE
MEDIUM	internal/command/providers_lock_test.go	62	expected := `# This file is maintained automatically by "tofu init".	CODE
MEDIUM	internal/command/init_test.go	2222	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	internal/command/init_test.go	2256	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	internal/command/init_test.go	2269	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	internal/command/init_test.go	2282	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	internal/command/init_test.go	2296	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	…and/testdata/providers-lock/append/.terraform.lock.hcl	1	# This file is maintained automatically by "terraform init".	COMMENT
MEDIUM	…roviders-mirror-with-bad-lock-file/.terraform.lock.hcl	1	# This file is maintained automatically by "tofu init".	COMMENT
MEDIUM	…fu-providers-mirror-with-lock-file/.terraform.lock.hcl	1	# This file is maintained automatically by "terraform init".	COMMENT
MEDIUM	…ests/tests/moved_with_refresh_only/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…sts/tests/basic_json_string_update/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…ence-tests/tests/moved_with_update/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…nce-tests/tests/replace_within_set/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…uivalence-tests/tests/drift_simple/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…ts/tests/drift_relevant_attributes/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…uivalence-tests/tests/moved_simple/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…ests/basic_multiline_string_update/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…nce-tests/tests/replace_within_map/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…-tests/tests/replace_within_object/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…lence-tests/tests/moved_with_drift/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…ts/fully_populated_complex_destroy/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…ce-tests/tests/replace_within_list/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…e-tests/tests/null_provider_delete/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…-tests/tests/local_provider_update/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…-tests/tests/local_provider_delete/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…nce-tests/tests/drift_refresh_only/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	…sts/fully_populated_complex_update/.terraform.lock.hcl	1	# This file is maintained automatically by "opentf init".	COMMENT
MEDIUM	.github/workflows/nightly.yml	66	# Create a staging directory for upload	COMMENT
MEDIUM	.github/scripts/compare-release-version.sh	19	# Create a clean semver tag without the v prefix	COMMENT

AI Slop Vocabulary31 hits · 90 pts

Severity	File	Line	Snippet	Context
MEDIUM	…rnal/getproviders/package_location_oci_blob_archive.go	242	// anyway to be robust since go-getter returns this information regardless.	COMMENT
MEDIUM	internal/getmodules/oci_getter.go	444	// but we'll return an error here anyway just to be robust.	COMMENT
MEDIUM	internal/repl/session.go	197	// but we'll be robust here and just pass through the GoString	COMMENT
MEDIUM	internal/legacy/tofu/state_filter.go	103	// is a bit more robust.	COMMENT
MEDIUM	internal/tofu/eval_variable.go	41	// but we'll check it here too to be robust.	COMMENT
MEDIUM	internal/tofu/eval_variable_test.go	110	// metadata is stripped from empty default collections. Essentially, you	COMMENT
MEDIUM	internal/tofu/context.go	363	return // should not happen, but we'll be robust	CODE
MEDIUM	internal/tofu/context.go	367	continue // should not happen, but we'll be robust	CODE
MEDIUM	internal/lang/functions.go	96	// robust.	COMMENT
MEDIUM	internal/lang/blocktoattr/fixup.go	36	// in the presence of poorly-configured test mocks, so we'll be robust	COMMENT
MEDIUM	internal/lang/globalref/analyzer_meta_references.go	366	// for all of the relative traversal types, but we'll be robust in	COMMENT
MEDIUM	internal/lang/exprs/example_test.go	172	// NOTE: This is not a robust implementation of "upper", just	COMMENT
MEDIUM	internal/lang/funcs/datetime.go	195	// be robust here.	COMMENT
MEDIUM	…lang/eval/internal/tofu2024/compile_input_variables.go	64	// need to find a more nuanced definition of what it means for	COMMENT
MEDIUM	internal/configs/static_scope.go	315	// handle this here just to be robust.	COMMENT
MEDIUM	internal/configs/configschema/validate_traversal.go	71	// but we'll handle this with a generic error anyway to be robust.	COMMENT
MEDIUM	internal/configs/configschema/empty_value.go	61	// but we'll be robust and return a result nonetheless.	COMMENT
MEDIUM	internal/configs/configload/loader_snapshot.go	266	// This function doesn't try to be incredibly robust in supporting	COMMENT
MEDIUM	internal/states/state_test.go	410	// happen" case but we'll test to make sure we're robust to	COMMENT
MEDIUM	internal/states/statemgr/filesystem.go	194	// TODO: this should use a more robust method of writing state, by first	COMMENT
MEDIUM	internal/states/statemgr/persistent.go	84	// Some implementations may optionally utilize config schema to persist	COMMENT
MEDIUM	internal/registry/package_extract.go	34	// decompressors should all be robust to malicious input anyway.	COMMENT
MEDIUM	internal/command/meta_providers.go	139	// unit tests might not always populate Meta fully and so we'll be robust	COMMENT
MEDIUM	internal/command/cliconfig/cliconfig.go	451	// improve on this later using the more-robust merging behavior	COMMENT
MEDIUM	internal/command/views/hook_ui.go	114	// bug in the caller but we'll ignore it in order to be robust.	COMMENT
MEDIUM	internal/command/clistate/local_state.go	68	// TODO: this should use a more robust method of writing state, by first	COMMENT
MEDIUM	internal/command/arguments/view.go	51	// more nuanced set of data to be presented to the view constructors.	COMMENT
MEDIUM	…tdata/move-statement-implied/move-statement-implied.tf	1	# This fixture is useful only in conjunction with a previous run state that	COMMENT
MEDIUM	…move-statement-implied/child/move-statement-implied.tf	1	# This fixture is useful only in conjunction with a previous run state that	COMMENT
MEDIUM	internal/moduletest/status.go	35	// Essentially, if a test suite has a bunch of failures and passes the overall	COMMENT
LOW	scripts/changelog-links.sh	12	# released items are presented as clickable links, but we can just use the	COMMENT

Verbosity Indicators31 hits · 65 pts

Severity	File	Line	Snippet	Context
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	3	## Step 1: Leave the original encryption method unchanged:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	8	# Step 2: Add the unencrypted method here:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	12	## Step 3: Disable or remove the "enforced" option:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	15	## Step 4: Move the original encryption method into the "fallback" block:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	20	## Step 5: Reference the unencrypted method as your primary "encryption" method.	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	24	## Step 6: Run "tofu apply".	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	26	## Step 7: Remove the "state" block once the migration is complete.	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	28	## Step 8: Repeat steps 3-7 for plan{} if needed.	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	9	## Step 1: Add the unencrypted method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	12	## Step 2: Add the desired key provider:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	17	## Step 3: Add the desired encryption method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	23	## Step 4: Link the desired encryption method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	26	## Step 5: Add the "fallback" block referencing the	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	32	## Step 6: Run "tofu apply".	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	34	## Step 7: Remove the "fallback" block above and	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	39	## Step 8: Repeat steps 4-8 for plan{} if needed.	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	9	## Step 1: Add the desired key provider:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	13	## Step 2: Set up your encryption method:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	19	## Step 3: Link the desired encryption method:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	22	## Step 4: Run "tofu apply".	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	24	## Step 5: Consider adding the "enforced" option:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	28	## Step 6: Repeat steps 3-5 for plan{} if needed.	COMMENT
LOW⚡	internal/providercache/installer.go	216	// Step 1: Which providers might we need to fetch a new version of?	COMMENT
LOW⚡	internal/providercache/installer.go	224	// Step 2: Query the provider source for each of the providers we selected	COMMENT
LOW⚡	internal/providercache/installer.go	234	// Step 3: For each provider version we've decided we need to install,	COMMENT
LOW	internal/dag/walk.go	453	// Dependencies satisfied! We need to check if any errored	COMMENT
LOW	internal/tofu/context_apply_test.go	2917	// Step 1: create the resources and instances	COMMENT
LOW	internal/tofu/context_apply_test.go	2952	// Step 2: update with an empty config, to destroy everything	COMMENT
LOW	internal/tofu/transform_targets.go	115	// Step 1: Find all excluded targetable nodes, and their descendants	COMMENT
LOW	internal/tofu/transform_targets.go	149	// Step 2: Of the targetable nodes that were not excluded, build the graph similarly to -target	COMMENT
LOW	internal/tofu/transform_targets.go	168	// Step 3: Add outputs	COMMENT

Structural Annotation Overuse31 hits · 65 pts

Severity	File	Line	Snippet	Context
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	3	## Step 1: Leave the original encryption method unchanged:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	8	# Step 2: Add the unencrypted method here:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	12	## Step 3: Disable or remove the "enforced" option:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	15	## Step 4: Move the original encryption method into the "fallback" block:	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	20	## Step 5: Reference the unencrypted method as your primary "encryption" method.	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	24	## Step 6: Run "tofu apply".	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	26	## Step 7: Remove the "state" block once the migration is complete.	COMMENT
LOW⚡	…e/state/examples/encryption/fallback_to_unencrypted.tf	28	## Step 8: Repeat steps 3-7 for plan{} if needed.	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	9	## Step 1: Add the unencrypted method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	12	## Step 2: Add the desired key provider:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	17	## Step 3: Add the desired encryption method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	23	## Step 4: Link the desired encryption method:	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	26	## Step 5: Add the "fallback" block referencing the	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	32	## Step 6: Run "tofu apply".	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	34	## Step 7: Remove the "fallback" block above and	COMMENT
LOW⚡	…state/examples/encryption/fallback_from_unencrypted.tf	39	## Step 8: Repeat steps 4-8 for plan{} if needed.	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	9	## Step 1: Add the desired key provider:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	13	## Step 2: Set up your encryption method:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	19	## Step 3: Link the desired encryption method:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	22	## Step 4: Run "tofu apply".	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	24	## Step 5: Consider adding the "enforced" option:	COMMENT
LOW⚡	…site/docs/language/state/examples/encryption/sample.tf	28	## Step 6: Repeat steps 3-5 for plan{} if needed.	COMMENT
LOW⚡	internal/providercache/installer.go	216	// Step 1: Which providers might we need to fetch a new version of?	COMMENT
LOW⚡	internal/providercache/installer.go	224	// Step 2: Query the provider source for each of the providers we selected	COMMENT
LOW⚡	internal/providercache/installer.go	234	// Step 3: For each provider version we've decided we need to install,	COMMENT
LOW	internal/tofu/context_apply_test.go	2917	// Step 1: create the resources and instances	COMMENT
LOW	internal/tofu/context_apply_test.go	2952	// Step 2: update with an empty config, to destroy everything	COMMENT
LOW	internal/tofu/transform_targets.go	115	// Step 1: Find all excluded targetable nodes, and their descendants	COMMENT
LOW	internal/tofu/transform_targets.go	149	// Step 2: Of the targetable nodes that were not excluded, build the graph similarly to -target	COMMENT
LOW	internal/tofu/transform_targets.go	168	// Step 3: Add outputs	COMMENT
LOW	…l/lang/eval/internal/tofu2024/module_instance_scope.go	207	// NOTE: This function only handles top-level symbol names which are	COMMENT

Fake / Example Data63 hits · 63 pts

Severity	File	Line	Snippet	Context
LOW	internal/backend/remote/testdata/plan-long-line/main.tf	3	long_line = "[{'_id':'5c5ab0ed7de45e993ffb9eeb','index':0,'guid':'e734d772-6b5a-4cb0-805c-91cd5e560e20','isActive':f	CODE
LOW	internal/cloud/state_test.go	331	Token: "placeholder",	CODE
LOW	internal/cloud/testing.go	321	Token: "fake-token",	CODE
LOW	internal/cloud/testdata/plan-long-line/main.tf	3	long_line = "[{'_id':'5c5ab0ed7de45e993ffb9eeb','index':0,'guid':'e734d772-6b5a-4cb0-805c-91cd5e560e20','isActive':f	CODE
LOW	internal/states/statemgr/statemgr_fake.go	95	return "placeholder", nil	CODE
LOW	internal/states/statemgr/statemgr_fake.go	109	if id != "placeholder" {	CODE
LOW	internal/states/statemgr/statemgr_fake.go	154	return "placeholder", nil	CODE
LOW	internal/command/show_test.go	1301	idVal = cty.StringVal("placeholder")	CODE
LOW	internal/command/show_test.go	1337	idVal = cty.StringVal("placeholder")	CODE
LOW	internal/command/testdata/login-oauth-server/main.go	69	client = "placeholder"	CODE
LOW	…mmand/testdata/test/function_call_in_variables/main.tf	18	value = "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	15	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	28	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	48	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	52	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	73	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	77	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	96	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	100	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	122	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/drift/output.json	135	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/moved/output.json	15	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/moved/output.json	36	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/moved/output.json	40	"id": "placeholder"	CODE
LOW	internal/command/testdata/show-json/moved/output.json	62	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	15	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	28	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	49	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	53	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	74	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	78	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	98	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	102	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	124	"id": "placeholder"	CODE
LOW	…nal/command/testdata/show-json/moved-drift/output.json	137	"id": "placeholder"	CODE
LOW	…testdata/show-json/conditions/output-refresh-only.json	17	"value": "placeholder"	CODE
LOW	…testdata/show-json/conditions/output-refresh-only.json	28	"after": "placeholder",	CODE
LOW	…testdata/show-json/conditions/output-refresh-only.json	42	"value": "placeholder"	CODE
LOW	…testdata/show-json/conditions/output-refresh-only.json	56	"id": "placeholder",	CODE
LOW	…testdata/show-json/conditions/output-refresh-only.json	72	"id": "placeholder",	CODE
LOW	…al/command/testdata/show-json/basic-update/output.json	27	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-update/output.json	47	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-update/output.json	51	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-update/output.json	92	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	27	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	47	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	51	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	71	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	113	"id": "placeholder"	CODE
LOW	…al/command/testdata/show-json/basic-delete/output.json	126	"id": "placeholder"	CODE
LOW	…d/testdata/show-json/multi-resource-update/output.json	29	"id": "placeholder"	CODE
LOW	…d/testdata/show-json/multi-resource-update/output.json	64	"id": "placeholder"	CODE
LOW	…d/testdata/show-json/multi-resource-update/output.json	68	"id": "placeholder"	CODE
LOW	…d/testdata/show-json/multi-resource-update/output.json	133	"id": "placeholder"	CODE
LOW	…ommand/testdata/show-json/requires-replace/output.json	35	"id": "placeholder"	CODE
LOW	…ommand/testdata/show-json/requires-replace/output.json	64	"id": "placeholder"	CODE
LOW	internal/command/e2etest/static_plan_test.go	85	run("show", stateVar, modVar, statePath).Success().Contains(`out = "placeholder"`)	CODE
LOW	internal/command/e2etest/static_plan_test.go	93	run("output", stateVar, modVar).Success().Contains(`out = "placeholder"`)	CODE
LOW	internal/command/e2etest/static_plan_test.go	115	run("state", "pull", stateVar, modVar).Success().Contains(`"outputs":{"out":{"value":"placeholder","type":"string"}}`	CODE
LOW	…2etest/testdata/static_plan_typed_variables/mod/mod.tf	2	value = "placeholder"	CODE
3 more matches not shown…

Synthetic Comment Markers7 hits · 42 pts

Severity	File	Line	Snippet	Context
HIGH	internal/configs/parser.go	86	// have been loaded through this parser, with source filenames (as requested	COMMENT
HIGH	internal/command/jsonformat/plan.go	452	fmt.Fprintf(&buf, "[bold] # %s[reset] will be [bold][red]replaced[reset], as requested", dispAddr)	CODE
HIGH	internal/command/jsonformat/plan.go	543	fmt.Fprintf(&buf, "[bold] # %s[reset] will be [bold][red]replaced[reset], as requested", dispAddr)	CODE
HIGH	internal/command/jsonformat/plan_test.go	6364	ExpectedOutput: ` # test_instance.example will be replaced, as requested	CODE
HIGH	internal/command/jsonformat/plan_test.go	6375	ExpectedOutput: ` # test_instance.example will be replaced, as requested	CODE
HIGH	internal/command/views/view.go	49	// ModuleDeprecationWarnLvl is used to filter out deprecation warnings for outputs and variables as requested by the us	COMMENT
HIGH	internal/command/arguments/view.go	41	// ModuleDeprecationWarnLvl is used to filter out deprecation warnings for outputs and variables as requested by the us	COMMENT

AI Response Leakage3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	internal/tofu/context_plan2_test.go	3708	// I've added all the required test cases that are needed to verify the fix for the issue.	COMMENT
HIGH	rfc/20240725-exclude-resources.md	26	# In this example there are 4 null_resources, with the following dependency graph:	COMMENT
HIGH	rfc/20240513-static-evaluation-providers.md	209	# NOTE: In this example for_each is set to exactly the same expression as	COMMENT

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	internal/lang/eval/internal/tofu2024/module_instance.go	236	if !providerInst.Addr.Config.Config.Provider.Equals(rsrc.Provider) {	CODE
CRITICAL	internal/command/jsonplan/values.go	212	r.Addr.Resource.Resource.Mode.String(),	CODE

Slop Phrases4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/tofu/context_plugins_test.go	26	// so the caller can feel free to modify the returned value to further	COMMENT
MEDIUM	internal/tofu/context_plugins_test.go	59	// callers can feel free to modify it once returned.	COMMENT
MEDIUM	internal/command/testdata/fmt/general_out.tf	3	# here, but you can also add other _in.tf/_out.tf pairs in the	COMMENT
MEDIUM	internal/command/testdata/fmt/general_in.tf	3	# here, but you can also add other _in.tf/_out.tf pairs in the	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…docs/cli/commands/test/examples/module/main.tftest.hcl	7	# Check if the webserver returned an HTTP 200 status code:	COMMENT

Hyper-Verbose Identifiers1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	internal/command/jsonformat/differ/attribute.go	77	// function computeChangeForDynamicValues(), but external callers will	COMMENT

opentofu/opentofu

Open-Source Code Quality, Security and Technical Debt Review