3.4

Adjusted Signal

3.4

Raw Pattern Score

100%

Time Factor

2026-07-29

Last Push

17.6K

Stars

Language

306.7K

Lines of Code

1.8K

Files

948

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 464 finding(s).

Hallucinated Dependency & Supply Chain Risk 7.9/100 · LOW

Are imports declared and package/API names verified? 484 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1 finding(s).

PR Review Velocity Impact 16.0/100 · LOW

Which changes need focused human review? 948 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 13MEDIUM 28LOW 907

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 948 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data480 hits · 480 pts

Severity	File	Line	Snippet	Context
LOW	cmd/cmd_update_client_test.go	54	Contacts: sqlxx.StringSliceJSONFormat{"admin@example.com"},	CODE
LOW	cmd/cmd_delete_client.go	22	To delete OAuth 2.0 Clients with the owner of "foo@bar.com", run:	CODE
LOW	cmd/cmd_delete_client.go	24	{{ .CommandPath }} $({{ .Root.Name }} list oauth2-clients --format json \| jq -r 'map(select(.contacts[] == "foo@bar.com	CODE
LOW	cypress/integration/oauth2/introspect.js	40	expect(body.body.sub).to.be.equal("foo@bar.com")	CODE
LOW	cypress/integration/oauth2/introspect.js	67	expect(body.body.sub).to.be.equal("foo@bar.com")	CODE
LOW	cypress/integration/oauth2/authorize_error.js	148	cy.get("#email").type("foo@bar.com", { delay: 1 })	CODE
LOW	cypress/integration/oauth2/jwt.js	53	expect(body.sub).to.eq("foo@bar.com")	CODE
LOW	cypress/integration/openid/userinfo.js	33	expect(sub).to.eq("foo@bar.com")	CODE
LOW	cypress/integration/openid/authorize_code.js	39	expect(sub).to.eq("foo@bar.com")	CODE
LOW	cypress/support/commands.js	47	username = "foo@bar.com",	CODE
LOW	cypress/support/commands.js	134	username = "foo@bar.com",	CODE
LOW	cypress/support/commands.js	248	username = "foo@bar.com",	CODE
LOW	test/conformance/config.json	20	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	52	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	85	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	118	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	151	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	184	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	220	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	329	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	360	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	402	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	434	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	468	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	526	["text", "id", "email", "foo@bar.com"],	CODE
LOW	test/conformance/config.json	559	["text", "id", "email", "foo@bar.com"],	CODE
LOW	oauth2/oauth2_auth_code_test.go	139	IdToken: map[string]interface{}{"bar": "baz", "email": "foo@bar.com"},	CODE
LOW	oauth2/oauth2_auth_code_test.go	449	IdToken: map[string]interface{}{"email": "foo@bar.com", "bar": "baz"},	CODE
LOW	oauth2/.snapshots/TestUnmarshalSession-v1.11.9.json	6	"sub": "foo@bar.com",	CODE
LOW	oauth2/.snapshots/TestUnmarshalSession-v1.11.9.json	35	"subject": "foo@bar.com"	CODE
LOW	oauth2/.snapshots/TestUnmarshalSession-v1.11.8.json	6	"sub": "foo@bar.com",	CODE
LOW	oauth2/.snapshots/TestUnmarshalSession-v1.11.8.json	35	"subject": "foo@bar.com"	CODE
LOW	spec/api.json	791	"example": "help@example.org",	CODE
LOW	spec/swagger.json	3054	"example": "help@example.org"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-Req-login_hint.txt	130	"login_hint": "foo@bar.com",	CODE
LOW	internal/certification/CI.F.T.T.s/OP-Req-login_hint.txt	157	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-UserInfo-Body.txt	154	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-UserInfo-Body.txt	187	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-UserInfo-Body.txt	199	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-UserInfo-Body.txt	202	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-Req-acr_values.txt	156	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-Req-acr_values.txt	190	"sub": "foo@bar.com"	CODE
LOW	…rnal/certification/CI.F.T.T.s/OP-Req-max_age=10000.txt	154	"sub": "foo@bar.com"	CODE
LOW	…rnal/certification/CI.F.T.T.s/OP-Req-max_age=10000.txt	187	"sub": "foo@bar.com"	CODE
LOW	…rnal/certification/CI.F.T.T.s/OP-Req-max_age=10000.txt	222	"sub": "foo@bar.com"	CODE
LOW	…rnal/certification/CI.F.T.T.s/OP-Req-max_age=10000.txt	255	"sub": "foo@bar.com"	CODE
LOW	…ternal/certification/CI.F.T.T.s/OP-UserInfo-Header.txt	154	"sub": "foo@bar.com"	CODE
LOW	…ternal/certification/CI.F.T.T.s/OP-UserInfo-Header.txt	187	"sub": "foo@bar.com"	CODE
LOW	…ternal/certification/CI.F.T.T.s/OP-UserInfo-Header.txt	199	"sub": "foo@bar.com"	CODE
LOW	…ternal/certification/CI.F.T.T.s/OP-UserInfo-Header.txt	202	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-prompt-login.txt	154	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-prompt-login.txt	187	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-prompt-login.txt	225	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-prompt-login.txt	258	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-OAuth-2nd.txt	155	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-OAuth-2nd.txt	188	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-Req-ui_locales.txt	156	"sub": "foo@bar.com"	CODE
LOW	internal/certification/CI.F.T.T.s/OP-display-popup.txt	156	"sub": "foo@bar.com"	CODE
LOW	…/certification/CI.F.T.T.s/OP-Registration-logo_uri.txt	157	"sub": "foo@bar.com"	CODE
LOW	…rnal/certification/CI.F.T.T.s/OP-Registration-jwks.txt	221	"sub": "foo@bar.com"	CODE
420 more matches not shown…

Over-Commented Block400 hits · 340 pts

Severity	File	Line	Snippet	Context
LOW	quickstart-prometheus.yml	1	###########################################################################	COMMENT
LOW	quickstart-tracing.yml	1	###########################################################################	COMMENT
LOW	quickstart-tracing.yml	21	# - TRACING_PROVIDER=zipkin	COMMENT
LOW	quickstart-tracing.yml	41	### Opentelemetry ###	COMMENT
LOW	quickstart-tracing.yml	61	# - DD_APM_NON_LOCAL_TRAFFIC=true	COMMENT
LOW	quickstart-debug.yml	1	###########################################################################	COMMENT
LOW	quickstart-postgres.yml	1	###########################################################################	COMMENT
LOW	quickstart.yml	1	###########################################################################	COMMENT
LOW	quickstart-mysql.yml	1	###########################################################################	COMMENT
LOW	quickstart-cors.yml	1	###########################################################################	COMMENT
LOW	quickstart-cockroach.yml	1	###########################################################################	COMMENT
LOW	quickstart-jwt.yml	1	###########################################################################	COMMENT
LOW	quickstart-hsm.yml	1	###########################################################################	COMMENT
LOW	cypress/plugins/index.js	1	// Copyright © 2022 Ory Corp	COMMENT
LOW	cypress/support/index.js	1	// Copyright © 2022 Ory Corp	COMMENT
LOW	cypress/support/commands.js	1	// Copyright © 2022 Ory Corp	COMMENT
LOW	test/e2e/docker-compose.jwt.yml	1	###########################################################################	COMMENT
LOW	fosite/generate.go	1	// Copyright © 2025 Ory Corp	COMMENT
LOW	fosite/generate.go	21	//go:generate go tool mockgen -package internal -destination internal/client_manager.go github.com/ory/hydra/v2/fosite C	COMMENT
LOW	fosite/generate.go	41	//go:generate go tool mockgen -package internal -destination internal/refresh_token_strategy_provider.go github.com/ory/	COMMENT
LOW	fosite/handler.go	1	// Copyright © 2025 Ory Corp	COMMENT
LOW	fosite/handler.go	41	CanHandleTokenEndpointRequest(ctx context.Context, requester AccessRequester) bool	COMMENT
LOW	fosite/handler.go	61		COMMENT
LOW	fosite/authorize_helper.go	41	// If multiple redirection URIs have been registered, if only part of	COMMENT
LOW	fosite/authorize_helper.go	81	return nil, errorsx.WithStack(ErrInvalidRequest.WithHint("The 'redirect_uri' parameter does not match any of the OAuth	COMMENT
LOW	fosite/access_request_handler.go	21	// - https://tools.ietf.org/html/rfc6749#section-2.3.1	COMMENT
LOW	fosite/revoke_handler.go	21	// validates various parameters as specified in:	COMMENT
LOW	fosite/HISTORY.md	361	// ErrInvalidatedAuthorizeCode is an error indicating that an authorization code has been	COMMENT
LOW	fosite/oauth2.go	41		COMMENT
LOW	fosite/oauth2.go	61	NewAuthorizeRequest(ctx context.Context, req *http.Request) (AuthorizeRequester, error)	COMMENT
LOW	fosite/oauth2.go	81	// * https://tools.ietf.org/html/rfc6749#section-3.1.2	COMMENT
LOW	fosite/oauth2.go	101	// authorization server during the client registration process or when	COMMENT
LOW	fosite/oauth2.go	121		COMMENT
LOW	fosite/oauth2.go	141	// MUST NOT be included more than once.	COMMENT
LOW	fosite/oauth2.go	161		COMMENT
LOW	fosite/authorize_error_test.go	21	// - https://tools.ietf.org/html/rfc6749#section-4.1.2.1	COMMENT
LOW	fosite/introspection_response_writer.go	21	// (Unauthorized) as described in Section 5.2 of OAuth 2.0 [RFC6749].	COMMENT
LOW	fosite/introspection_response_writer.go	61	// * active	COMMENT
LOW	fosite/introspection_response_writer.go	81	//	COMMENT
LOW	fosite/introspection_response_writer.go	101	// OPTIONAL. Integer timestamp, measured in the number of seconds	COMMENT
LOW	fosite/introspection_response_writer.go	121	// [RFC7519].	COMMENT
LOW	fosite/introspection_response_writer.go	141	//	COMMENT
LOW	fosite/introspection_response_writer.go	161	// }	COMMENT
LOW	fosite/transactional.go	1	// Copyright © 2025 Ory Corp	COMMENT
LOW	fosite/introspection_request_handler.go	21	//	COMMENT
LOW	fosite/introspection_request_handler.go	41	// help the authorization server optimize the token lookup. If the	COMMENT
LOW	fosite/introspection_request_handler.go	61	// To prevent token scanning attacks, the endpoint MUST also require	COMMENT
LOW	fosite/introspection_request_handler.go	81	//	COMMENT
LOW	fosite/token/jwt/token.go	161	// Parse, validate, and return a token.	COMMENT
LOW	fosite/handler/oauth2/revocation_storage.go	1	// Copyright © 2025 Ory Corp	COMMENT
LOW	fosite/handler/oauth2/storage.go	21	// GetAuthorizeCodeSession hydrates the session for an authorization code and returns	COMMENT
LOW	fosite/handler/pkce/handler.go	181	} else if nc == 0 {	COMMENT
LOW	fosite/handler/openid/flow_hybrid.go	41		COMMENT
LOW	fosite/handler/openid/flow_implicit.go	41	return errorsx.WithStack(fosite.ErrInvalidGrant.WithHint("The OAuth 2.0 Client is not allowed to use the authorization	COMMENT
LOW	fosite/handler/openid/validator.go	41	}	COMMENT
LOW	fosite/handler/openid/flow_implicit_test.go	121	Scopes: []string{"openid", "fosite"},	COMMENT
LOW	fosite/handler/openid/flow_refresh_token_test.go	121	},	COMMENT
LOW	fosite/compose/compose.go	21	// AccessTokenLifespan: time.Minute * 30,	COMMENT
LOW	fosite/docs/how-tos/client_credentials_grant.md	61	// for Token Endpont, for example:	COMMENT
LOW	health/doc.go	1	// Copyright © 2022 Ory Corp	COMMENT
340 more matches not shown…

Slop Phrases24 hits · 72 pts

Severity	File	Line	Snippet	Context
MEDIUM	quickstart-prometheus.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-prometheus.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-tracing.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-tracing.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-debug.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-debug.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-postgres.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-postgres.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-mysql.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-mysql.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-cors.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-cors.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-cockroach.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-cockroach.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-jwt.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-jwt.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	quickstart-hsm.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-hsm.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	test/e2e/docker-compose.jwt.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	test/e2e/docker-compose.jwt.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT
MEDIUM	…ernal/httpclient/model_accept_o_auth2_login_request.go	32	// ForceSubjectIdentifier forces the \"pairwise\" user ID of the end-user that authenticated. The \"pairwise\" user ID	COMMENT
MEDIUM	contrib/quickstart/gitlab/config/gitlab.rb	460	# optionally, you can add the following two lines to "white label" the display name	COMMENT

Synthetic Comment Markers9 hits · 68 pts

Severity	File	Line	Snippet	Context
HIGH	internal/httpclient/model_o_auth2_login_request.go	31	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	internal/httpclient/model_device_user_auth_request.go	32	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	internal/httpclient/model_verify_user_code_request.go	27	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	internal/httpclient/model_o_auth2_consent_request.go	42	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	flow/flow.go	133	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	flow/consent_types.go	442	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	flow/consent_types.go	456	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	flow/consent_types.go	477	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT
HIGH	flow/consent_types.go	554	// RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.	COMMENT

Redundant / Tautological Comments25 hits · 45 pts

Severity	File	Line	Snippet	Context
LOW	test/e2e/circle-ci.bash	16	# Check if any ports that we need are open already	COMMENT
LOW	fosite/.github/auto_assign.yml	15	# Set 0 to add all the reviewers (default: 0)	COMMENT
LOW	internal/config/config.yaml	386	# Set this to true if you want to share error debugging information with your OAuth 2.0 clients.	COMMENT
LOW	internal/config/config.yaml	398	# Set this to true if you want PKCE to be enforced for all clients.	COMMENT
LOW	internal/config/config.yaml	400	# Set this to true if you want PKCE to be enforced for public clients.	COMMENT
LOW	internal/config/config.yaml	448	# Set this to the tracing backend you wish to use. Currently supports jaeger. If omitted or empty, tracing will	COMMENT
LOW	contrib/quickstart/gitlab/config/gitlab.rb	580	#### Set path to an initial license to be used while bootstrapping GitLab.	COMMENT
LOW	.github/auto_assign.yml	15	# Set 0 to add all the reviewers (default: 0)	COMMENT
LOW	.github/workflows/cve-scan.yaml	36	# Output values for debugging	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	135	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	144	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	159	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	177	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	182	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	191	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	224	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	231	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	236	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	241	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	252	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	261	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	278	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	286	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	295	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	311	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT

Magic Placeholder Names4 hits · 25 pts

Severity	File	Line	Snippet	Context
HIGH	quickstart-tracing.yml	59	# - DD_API_KEY=<YOUR_API_KEY> # Replace it with your DataDog API key	COMMENT
HIGH	quickstart-tracing.yml	59	# - DD_API_KEY=<YOUR_API_KEY> # Replace it with your DataDog API key	COMMENT
HIGH	UPGRADE.md	831	2. Run `$ export DATABASE_URL=<your-database-url>`.	CODE
HIGH	UPGRADE.md	917	$ export DATABASE_URL=<your-database-url>	CODE

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	fosite/access_request_handler.go	33	// to directly utilize the HTTP Basic authentication scheme (or other	COMMENT
MEDIUM	oryx/landlockx/paths.go	15	// robust than enumerating every sibling: SQLite manages -journal in	COMMENT
MEDIUM	client/handler.go	236	// To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.	COMMENT
MEDIUM	client/handler.go	413	// To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.	COMMENT

Verbosity Indicators1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	client/handler.go	457	// an empty secret if the secret hasn't changed. As such we need to check if the patch has	COMMENT

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	oauth2/handler.go	194	function setAndRegisterTimeout(fct, duration) {	CODE

ory/hydra

Open-Source Code Quality, Security and Technical Debt Review