1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-07-29

Last Push

13.9K

Stars

Language

441.0K

Lines of Code

2.5K

Files

623

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 469 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 140 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 19 finding(s).

PR Review Velocity Impact 7.4/100 · LOW

Which changes need focused human review? 623 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 0MEDIUM 25LOW 597

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 623 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block387 hits · 376 pts

Severity	File	Line	Snippet	Context
LOW	quickstart-tracing.yml	1	###########################################################################	COMMENT
LOW	ui/container/container_test.go	121	node.NewInputFieldFromJSON("objy.numby", 1.5, node.DefaultGroup),	COMMENT
LOW	ui/container/container.go	41	type Container struct {	COMMENT
LOW	ui/node/attributes.go	61	// swagger:ignore	COMMENT
LOW	ui/node/attributes.go	101		COMMENT
LOW	ui/node/attributes.go	121	// The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or lo	COMMENT
LOW	ui/node/attributes.go	141	// Represents a single selectable value for an input whose JSON schema	COMMENT
LOW	ui/node/attributes.go	161	//	COMMENT
LOW	ui/node/attributes.go	181	// NodeType represents this node's types. It is a mirror of `node.type` and	COMMENT
LOW	ui/node/attributes.go	201	Title *text.Message `json:"title"`	COMMENT
LOW	ui/node/attributes.go	221	// required: true	COMMENT
LOW	ui/node/attributes.go	241	//	COMMENT
LOW	ui/node/attributes.go	261	//	COMMENT
LOW	ui/node/attributes.go	281	// required: true	COMMENT
LOW	ui/node/node.go	61	}	COMMENT
LOW	ui/node/node.go	81	Group UiNodeGroup `json:"group"`	COMMENT
LOW	ui/node/node.go	101	// required: true	COMMENT
LOW	selfservice/errorx/handler.go	61	//lint:ignore U1000 Used to generate Swagger and OpenAPI definitions	COMMENT
LOW	selfservice/errorx/handler.go	81	//	COMMENT
LOW	selfservice/strategy/password/op_login_test.go	801	// In Hydra v2.2.0 final the mismatch is handled gracefully instead of with an	COMMENT
LOW	selfservice/strategy/password/registration.go	41	//	COMMENT
LOW	selfservice/strategy/password/registration.go	201	return err	COMMENT
LOW	selfservice/strategy/password/types.go	21	//	COMMENT
LOW	selfservice/strategy/password/op_registration_test.go	861	ct = []callTrace{}	COMMENT
LOW	selfservice/strategy/password/settings.go	41	//	COMMENT
LOW	selfservice/strategy/password/login_race_test.go	21	// Provider.Set -> replaceKoanf, swapping p.Koanf) operate on the same	COMMENT
LOW	selfservice/strategy/passkey/passkey_registration.go	41	// Register a WebAuthn Security Key	COMMENT
LOW	selfservice/strategy/code/code_registration.go	21	// ID represents the tokens's unique ID.	COMMENT
LOW	selfservice/strategy/code/code_registration.go	81	// swagger:ignore	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	41	// Update Login flow using the code method	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	441	return nil, nil, err	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	481		COMMENT
LOW	selfservice/strategy/code/strategy_recovery.go	81	Append(node.NewInputField("method", s.RecoveryStrategyID(), node.CodeGroup, node.InputAttributeTypeSubmit).	COMMENT
LOW	selfservice/strategy/code/strategy_recovery.go	101	// If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code	COMMENT
LOW	selfservice/strategy/code/strategy_recovery.go	121	// required: true	COMMENT
LOW	selfservice/strategy/code/code_login.go	21	type LoginCode struct {	COMMENT
LOW	selfservice/strategy/code/strategy_recovery_admin.go	61	// Identity to Recover	COMMENT
LOW	selfservice/strategy/code/strategy_recovery_admin.go	81	// Flow Type	COMMENT
LOW	selfservice/strategy/code/strategy_recovery_admin.go	101	//	COMMENT
LOW	selfservice/strategy/code/strategy_recovery_admin.go	121	// This endpoint creates a recovery code which should be given to the user in order for them to recover	COMMENT
LOW	selfservice/strategy/code/strategy_registration.go	41	Traits json.RawMessage `json:"traits" form:"traits"`	COMMENT
LOW	selfservice/strategy/code/strategy_verification.go	101	// If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code	COMMENT
LOW	selfservice/strategy/oidc/provider_uaepass.go	21	)	COMMENT
LOW	selfservice/strategy/oidc/provider.go	121	}	COMMENT
LOW	selfservice/strategy/oidc/strategy_test_login.go	201	// after a test login flow callback completes. The host comes from	COMMENT
LOW	selfservice/strategy/oidc/strategy_settings.go	241	// removed, the identity is no longer able to sign in.	COMMENT
LOW	selfservice/strategy/oidc/strategy_settings.go	261	// required: true	COMMENT
LOW	selfservice/strategy/oidc/strategy_settings.go	281	//	COMMENT
LOW	selfservice/strategy/oidc/strategy_test_login_test.go	261	assert.Contains(t, loc, "/session/test-oidc")	COMMENT
LOW	selfservice/strategy/oidc/strategy_login.go	61	//	COMMENT
LOW	selfservice/strategy/oidc/strategy_login.go	81	// If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate	COMMENT
LOW	…e/strategy/oidc/strategy_settings_organization_test.go	21	"github.com/ory/kratos/pkg/testhelpers"	COMMENT
LOW	…e/strategy/oidc/strategy_settings_organization_test.go	41	// Playwright e2e suite (test/e2epw). It cannot run inside this OSS package	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	41	ID string `json:"id"`	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	81	// Should only be used when the OAuth2 / OpenID Connect server is not supporting OpenID Connect Discovery and when	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	121	// profile information) to hydrate the identity's data.	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	141	// using the generic provider. Can be either `userinfo` (calls the userinfo	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	161	// NetID FedCM token for an ID token.	COMMENT
LOW	selfservice/strategy/oidc/provider_config.go	181	AAL2ACRValues []string `json:"aal2_acr_values,omitempty"`	COMMENT
LOW	selfservice/strategy/oidc/strategy_registration.go	81	// The provider to register with	COMMENT
327 more matches not shown…

Fake / Example Data139 hits · 151 pts

Severity	File	Line	Snippet	Context
LOW	CHANGELOG.md	2530	`Signing in will link your account to "test@test.com" at provider "". If you do not wish to link that account, please	CODE
LOW	CHANGELOG.md	2538	`Signing in will link your account to "test@test.com" at provider "google". If you do not wish to link that account, p	CODE
LOW	cmd/identities/delete.go	34	Example: `To delete the identity with the recovery email address "foo@bar.com", run:	CODE
LOW	cmd/identities/delete.go	36	{{ .CommandPath }} $({{ .Root.Name }} list identities --format json \| jq -r 'map(select(.recovery_addresses[].value ==	CODE
LOW	selfservice/hook/require_verified_address_test.go	142	Traits: identity.Traits(`{"email":"user@example.com"}`),	CODE
LOW	selfservice/hook/require_verified_address_test.go	146	Value: "user@example.com",	CODE
LOW	selfservice/hook/require_verified_address_test.go	183	assert.Equal(t, continueWith.Flow.VerifiableAddress, "user@example.com")	CODE
LOW⚡	selfservice/hook/web_hook_integration_test.go	747	Traits: []byte(`{"email":"some@example.org"}`),	CODE
LOW⚡	selfservice/hook/web_hook_integration_test.go	749	Value: "some@example.org",	CODE
LOW⚡	selfservice/hook/web_hook_integration_test.go	755	Value: "some@example.org",	CODE
LOW	…ase=update_identity_fields-case=unset_external_id.json	21	"email": "some@example.org"	CODE
LOW	…ase=update_identity_fields-case=unset_external_id.json	26	"value": "some@example.org",	CODE
LOW	…ase=update_identity_fields-case=unset_external_id.json	37	"value": "some@example.org",	CODE
LOW	…elds-case=identity_has_updated_verified_addresses.json	38	"value": "some@example.org",	CODE
LOW	…ds-case=update_identity_fields-case=body_is_empty.json	22	"email": "some@example.org"	CODE
LOW	…ds-case=update_identity_fields-case=body_is_empty.json	27	"value": "some@example.org",	CODE
LOW	…ds-case=update_identity_fields-case=body_is_empty.json	38	"value": "some@example.org",	CODE
LOW	…y_fields-case=identity_has_updated_admin_metadata.json	22	"email": "some@example.org"	CODE
LOW	…y_fields-case=identity_has_updated_admin_metadata.json	27	"value": "some@example.org",	CODE
LOW	…y_fields-case=identity_has_updated_admin_metadata.json	38	"value": "some@example.org",	CODE
LOW	…elds-case=identity_has_updated_recovery_addresses.json	27	"value": "some@example.org",	CODE
LOW	…_identity_fields-case=identity_has_updated_traits.json	27	"value": "some@example.org",	CODE
LOW	…_identity_fields-case=identity_has_updated_traits.json	38	"value": "some@example.org",	CODE
LOW	…dentity_fields-case=identity_is_present_but_empty.json	22	"email": "some@example.org"	CODE
LOW	…dentity_fields-case=identity_is_present_but_empty.json	27	"value": "some@example.org",	CODE
LOW	…dentity_fields-case=identity_is_present_but_empty.json	38	"value": "some@example.org",	CODE
LOW	…tity_fields-case=identity_has_updated_external_id.json	22	"email": "some@example.org"	CODE
LOW	…tity_fields-case=identity_has_updated_external_id.json	27	"value": "some@example.org",	CODE
LOW	…tity_fields-case=identity_has_updated_external_id.json	38	"value": "some@example.org",	CODE
LOW	…_fields-case=identity_has_updated_public_metadata.json	22	"email": "some@example.org"	CODE
LOW	…_fields-case=identity_has_updated_public_metadata.json	27	"value": "some@example.org",	CODE
LOW	…_fields-case=identity_has_updated_public_metadata.json	38	"value": "some@example.org",	CODE
LOW	…e_identity_fields-case=identity_has_updated_state.json	22	"email": "some@example.org"	CODE
LOW	…e_identity_fields-case=identity_has_updated_state.json	27	"value": "some@example.org",	CODE
LOW	…e_identity_fields-case=identity_has_updated_state.json	38	"value": "some@example.org",	CODE
LOW	…tity_fields-case=identity_is_present_but_empty#01.json	21	"email": "some@example.org"	CODE
LOW	…tity_fields-case=identity_is_present_but_empty#01.json	26	"value": "some@example.org",	CODE
LOW	…tity_fields-case=identity_is_present_but_empty#01.json	37	"value": "some@example.org",	CODE
LOW	selfservice/strategy/password/login_test.go	1466	require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfi	CODE
LOW	selfservice/strategy/password/login_test.go	1473	require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfi	CODE
LOW	selfservice/strategy/passkey/passkey_login_test.go	626	require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfi	CODE
LOW	selfservice/strategy/passkey/passkey_login_test.go	633	require.ErrorIs(t, fh.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")), idfi	CODE
LOW	…refresh-case=refresh_passwordless_credentials-spa.json	21	"value": "foo@bar.com"	CODE
LOW	…esh-case=refresh_passwordless_credentials-browser.json	21	"value": "foo@bar.com"	CODE
LOW	selfservice/strategy/code/strategy_login_test.go	1666	require.ErrorIs(t, fhAAL1.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")),	CODE
LOW	selfservice/strategy/code/strategy_login_test.go	1675	require.NoError(t, fhAAL1.PopulateLoginMethodIdentifierFirstCredentials(r, f, login.WithIdentifier("foo@bar.com")))	CODE
LOW	selfservice/strategy/code/strategy_recovery_test.go	552	v.Set("email", "some-email@example.org")	CODE
LOW	selfservice/strategy/code/strategy_recovery_test.go	1390	v.Set("email", "some-email@example.org")	CODE
LOW	selfservice/strategy/code/strategy_recovery_test.go	2327	v.Set("recovery_address", "some-email@example.org")	CODE
LOW	selfservice/strategy/code/strategy_recovery_test.go	3928	v.Set("recovery_address", "some-address@example.org")	CODE
LOW	…service/strategy/code/strategy_recovery_nonrfc_test.go	48	require.NoError(t, decodeRecoverySubmission(t, "user@example.org"))	CODE
LOW	selfservice/strategy/code/strategy_mfa_test.go	24	{Via: "email", Value: "user@example.com"},	CODE
LOW	selfservice/strategy/code/strategy_mfa_test.go	29	{Via: identity.CodeChannel("email"), To: "user@example.com"},	CODE
LOW⚡	selfservice/strategy/code/strategy_mfa_test.go	71	Config: []byte(`{"addresses":[{"channel":"email","address":"user@example.com"},{"channel":"sms","address":"+123456	CODE
LOW⚡	selfservice/strategy/code/strategy_mfa_test.go	77	{Via: identity.CodeChannel("email"), To: "user@example.com"},	CODE
LOW⚡	selfservice/strategy/code/strategy_mfa_test.go	87	{Via: "email", Value: "user@example.com"},	CODE
LOW⚡	selfservice/strategy/code/strategy_mfa_test.go	93	{Via: identity.CodeChannel("email"), To: "user@example.com"},	CODE
LOW⚡	selfservice/strategy/code/strategy_mfa_test.go	103	{Via: "email", Value: "user@example.com"},	CODE
LOW	selfservice/strategy/code/strategy_mfa_test.go	135	{Via: "email", Value: "user@example.com"},	CODE
LOW	selfservice/strategy/code/strategy_mfa_test.go	141	{Via: identity.CodeChannel("email"), To: "user@example.com"},	CODE
79 more matches not shown…

Structural Annotation Overuse24 hits · 47 pts

Severity	File	Line	Snippet	Context
LOW	selfservice/strategy/code/strategy_login.go	416	// Step 1: Get the identity	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	526	// Step 2: Delete any previous login codes for this flow ID	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	627	// Step 2: The code was correct	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	638	// Step 3: Verify the address	COMMENT
LOW	selfservice/strategy/code/strategy_recovery.go	350	// NOTE: This function handles two cases:	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	222	// Step 1: validate the identity's traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	228	// Step 2: Delete any previous registration codes for this flow ID	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	233	// Step 3: Get the identity email and send the code	COMMENT
LOW	selfservice/strategy/code/strategy_registration.go	258	// Step 4: Generate the UI for the `code` input form	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	293	// Step 1: Re-validate the identity's traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	301	// Step 2: Check if the flow traits match the identity traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	333	// Step 3: Attempt to use the code	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	342	// Step 4: Verify the address	COMMENT
LOW	identity/test/pool.go	423	// Step 1: Insert legacy identity with non-normalized phone (pre-migration state)	COMMENT
LOW⚡	identity/test/pool.go	437	// Step 2: Simulate migration — normalize the identifier in DB (what the CLI tool does)	COMMENT
LOW⚡	identity/test/pool.go	443	// Step 3: Verify lookups work with both formats after migration	COMMENT
LOW	identity/test/pool.go	843	// Step 1: Create two identities with external_ids.	COMMENT
LOW	identity/test/pool.go	854	// Step 2: Create new identities with different traits but same external_ids.	COMMENT
LOW⚡	test/e2e/run.sh	61	# Step 1: Kill process supervisors FIRST (they respawn children)	COMMENT
LOW⚡	test/e2e/run.sh	67	# Step 2: Kill Kratos and webhook (were managed by modd)	COMMENT
LOW⚡	test/e2e/run.sh	75	# Step 3: Kill Node.js services	COMMENT
LOW⚡	test/e2e/run.sh	83	# Step 4: Kill Hydra processes	COMMENT
LOW⚡	test/e2e/run.sh	90	# Step 5: Kill any remaining processes on known ports	COMMENT
LOW⚡	test/e2e/run.sh	100	# Step 6: Stop and remove Docker containers	COMMENT

Verbosity Indicators23 hits · 46 pts

Severity	File	Line	Snippet	Context
LOW	selfservice/strategy/code/strategy_login.go	416	// Step 1: Get the identity	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	526	// Step 2: Delete any previous login codes for this flow ID	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	627	// Step 2: The code was correct	COMMENT
LOW	selfservice/strategy/code/strategy_login.go	638	// Step 3: Verify the address	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	222	// Step 1: validate the identity's traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	228	// Step 2: Delete any previous registration codes for this flow ID	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	233	// Step 3: Get the identity email and send the code	COMMENT
LOW	selfservice/strategy/code/strategy_registration.go	258	// Step 4: Generate the UI for the `code` input form	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	293	// Step 1: Re-validate the identity's traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	301	// Step 2: Check if the flow traits match the identity traits	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	333	// Step 3: Attempt to use the code	COMMENT
LOW⚡	selfservice/strategy/code/strategy_registration.go	342	// Step 4: Verify the address	COMMENT
LOW	identity/test/pool.go	423	// Step 1: Insert legacy identity with non-normalized phone (pre-migration state)	COMMENT
LOW⚡	identity/test/pool.go	437	// Step 2: Simulate migration — normalize the identifier in DB (what the CLI tool does)	COMMENT
LOW⚡	identity/test/pool.go	443	// Step 3: Verify lookups work with both formats after migration	COMMENT
LOW	identity/test/pool.go	843	// Step 1: Create two identities with external_ids.	COMMENT
LOW	identity/test/pool.go	854	// Step 2: Create new identities with different traits but same external_ids.	COMMENT
LOW⚡	test/e2e/run.sh	61	# Step 1: Kill process supervisors FIRST (they respawn children)	COMMENT
LOW⚡	test/e2e/run.sh	67	# Step 2: Kill Kratos and webhook (were managed by modd)	COMMENT
LOW⚡	test/e2e/run.sh	75	# Step 3: Kill Node.js services	COMMENT
LOW⚡	test/e2e/run.sh	83	# Step 4: Kill Hydra processes	COMMENT
LOW⚡	test/e2e/run.sh	90	# Step 5: Kill any remaining processes on known ports	COMMENT
LOW⚡	test/e2e/run.sh	100	# Step 6: Stop and remove Docker containers	COMMENT

Decorative Section Separators14 hits · 42 pts

Severity	File	Line	Snippet	Context
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	178	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	180	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	270	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	272	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	357	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	359	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	417	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	419	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	486	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	488	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	520	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	522	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	620	// ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…t/tests/desktop/regression/phone-normalization.spec.ts	622	// ────────────────────────────────────────────────────────────────────	COMMENT

Redundant / Tautological Comments19 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW	test/e2e/run.sh	164	# Check if any ports that we need are open already	COMMENT
LOW	.github/auto_assign.yml	15	# Set 0 to add all the reviewers (default: 0)	COMMENT
LOW	.github/workflows/cve-scan.yaml	36	# Output values for debugging	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	135	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	144	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	159	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	177	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	182	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	191	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	224	# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to fal	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	231	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	236	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	241	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	252	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	261	# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	278	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	286	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW⚡	oryx/configx/stub/benchmark/benchmark.yaml	295	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT
LOW	oryx/configx/stub/benchmark/benchmark.yaml	311	# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.	COMMENT

Self-Referential Comments5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	selfservice/strategy/code/strategy_recovery_admin.go	119	// # Create a Recovery Code	COMMENT
MEDIUM	selfservice/strategy/link/strategy_recovery.go	127	// # Create a Recovery Link	COMMENT
MEDIUM	selfservice/flow/logout/handler.go	113	// # Create a Logout URL for Browsers	COMMENT
MEDIUM	selfservice/flow/login/test_handler.go	74	// # Create a test OIDC login flow	COMMENT
MEDIUM	identity/handler.go	739	// # Create an Identity	COMMENT

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	selfservice/strategy/oidc/strategy_login.go	356	// This is kinda hacky but the only way to ensure seamless login/registration flows when using OIDC.	COMMENT
MEDIUM	selfservice/strategy/oidc/strategy_registration.go	338	// This is kinda hacky but the only way to ensure seamless login/registration flows when using OIDC.	COMMENT
MEDIUM	selfservice/flow/request.go	54	// API Based flows to not require anti-CSRF tokens because we can not leverage a session, making this	COMMENT
MEDIUM	oryx/landlockx/paths.go	15	// robust than enumerating every sibling: SQLite manages -journal in	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ess/integration/profiles/oidc/settings/success.spec.ts	239	config.selfservice.methods.oidc.config.providers.filter(	CODE

Slop Phrases2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	quickstart-tracing.yml	2	####### FOR DEMONSTRATION PURPOSES ONLY #######	COMMENT
MEDIUM	quickstart-tracing.yml	8	# This set up is only for demonstration purposes. The login #	COMMENT

Hyper-Verbose Identifiers5 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	…ests/desktop/identifier_first/passkeys.options.spec.ts	11	async function toggleAutomaticPresenceSimulation(	CODE
LOW	…/tests/desktop/identifier_first/passkeys.login.spec.ts	12	async function toggleAutomaticPresenceSimulation(	CODE
LOW	test/e2e/playwright/actions/identity.ts	21	export async function createIdentityWithPhoneNumber(	CODE
LOW	test/e2e/playwright/actions/identity.ts	53	export async function createIdentityWithPhoneAndPassword(	CODE
LOW	test/e2e/playwright/actions/identity.ts	78	export async function createIdentityWithPassword(request: APIRequestContext) {	CODE

ory/kratos

Open-Source Code Quality, Security and Technical Debt Review