2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

23.7K

Stars

C++

Language

295.3K

Lines of Code

1.9K

Files

559

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 489 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 34 finding(s).

Agent Over-Engineering Ratio 2.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 58 finding(s).

PR Review Velocity Impact 10.5/100 · LOW

Which changes need focused human review? 559 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 13MEDIUM 16LOW 530

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 559 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block439 hits · 439 pts

Severity	File	Line	Snippet	Context
LOW	osquery/tables/networking/curl_certificate.cpp	21	#include <openssl/x509.h>	COMMENT
LOW	osquery/tables/networking/posix/interfaces.cpp	21	#include <linux/ethtool.h>	COMMENT
LOW	osquery/tables/yara/yara_events.cpp	21	#include <osquery/events/darwin/fsevents.h>	COMMENT
LOW	osquery/tables/yara/yara.cpp	21		COMMENT
LOW	osquery/tables/yara/yara.cpp	501	}	COMMENT
LOW	osquery/tables/system/hash.cpp	21		COMMENT
LOW	osquery/tables/system/ssh_keys.cpp	21	#include <osquery/worker/logging/glog/glog_logger.h>	COMMENT
LOW	osquery/tables/system/posix/ulimit_info.cpp	41	#endif	COMMENT
LOW	osquery/tables/system/posix/homebrew_packages.cpp	181	}	COMMENT
LOW	osquery/tables/system/posix/augeas.cpp	201	// Strategy for handling augeas	COMMENT
LOW	osquery/tables/system/tests/system_tables_tests.cpp	21	#include <osquery/core/tables.h>	COMMENT
LOW	osquery/tables/system/linux/processes.cpp	21	#include <boost/algorithm/string/split.hpp>	COMMENT
LOW	osquery/tables/system/linux/secureboot.cpp	21	// Linux has 2 places efivars can be accessed:	COMMENT
LOW	osquery/tables/system/linux/md_tables.cpp	201	#endif	COMMENT
LOW	osquery/tables/system/linux/rpm_packages.cpp	21	#include <unistd.h>	COMMENT
LOW	osquery/tables/system/linux/rpm_packages.cpp	81	}	COMMENT
LOW	osquery/tables/system/linux/rpm_packages.cpp	101	// re-inits its own session; owner_pid_ sees the new pid and resets.	COMMENT
LOW	osquery/tables/system/linux/model_specific_register.cpp	21	#define MSR_FILENAME_BUFFER_SIZE 32	COMMENT
LOW	osquery/tables/system/linux/secureboot_certificates.cpp	21	#include <cstdint>	COMMENT
LOW	osquery/tables/system/linux/apt_sources.cpp	1	/**	COMMENT
LOW	osquery/tables/system/linux/gpu_info.cpp	21	#include <osquery/core/core.h>	COMMENT
LOW	osquery/tables/system/darwin/startup_items.mm	21	#include <osquery/core/tables.h>	COMMENT
LOW	osquery/tables/system/darwin/sysctl_utils.cpp	21	namespace osquery {	COMMENT
LOW	osquery/tables/system/darwin/smbios_tables.cpp	21	#include <boost/algorithm/string.hpp>	COMMENT
LOW	osquery/tables/system/darwin/signature.mm	21	#include <osquery/logger/logger.h>	COMMENT
LOW	osquery/tables/system/darwin/certificates.mm	121		COMMENT
LOW	osquery/tables/system/darwin/gpu_info.mm	221	info.model_id = stringFromIOKitProperty(name_matched);	COMMENT
LOW	osquery/tables/system/darwin/firewall.h	21		COMMENT
LOW	osquery/tables/system/darwin/firewall.h	41	// - 'logging_option': Quote from https://support.apple.com/en-jo/121011: "The	COMMENT
LOW	osquery/tables/system/windows/processes.cpp	21	#include <iomanip>	COMMENT
LOW	osquery/tables/system/windows/objects.cpp	21	namespace osquery {	COMMENT
LOW	osquery/tables/system/windows/objects.cpp	41	// rest of osquery	COMMENT
LOW	osquery/tables/system/windows/objects.cpp	61		COMMENT
LOW	osquery/tables/system/windows/objects.cpp	141	// services session id. this means we expect the object name to be a	COMMENT
LOW	osquery/tables/system/windows/windows_crashes.cpp	21	#include <DbgEng.h>	COMMENT
LOW	osquery/tables/system/windows/programs.cpp	141		COMMENT
LOW	osquery/tables/system/windows/registry.cpp	21	#include <boost/algorithm/string.hpp>	COMMENT
LOW	osquery/tables/system/windows/windows_search.cpp	21	#include <sstream>	COMMENT
LOW	osquery/tables/system/windows/process_open_handles.cpp	921	if (!FLAGS_allow_handle_threads) {	COMMENT
LOW	osquery/tables/applications/ai_agent_skills.cpp	81	// this many leading bytes are ever read: enough for any real frontmatter	COMMENT
LOW	osquery/tables/applications/ai_agent_skills.cpp	261	assignIfPresent(metadata, "version", skill.version);	COMMENT
LOW	osquery/tables/applications/jetbrains_plugins.cpp	181		COMMENT
LOW	osquery/tables/applications/jetbrains_plugins.cpp	281	// completion-ranking.jar is before `gson-2.8.0.jar` or `junit-m5.jar`	COMMENT
LOW	osquery/tables/applications/posix/docker.cpp	21		COMMENT
LOW	osquery/tables/applications/darwin/browser_plugins.cpp	41		COMMENT
LOW	osquery/tables/events/linux/process_file_events.cpp	641	// The rename/renameat/renameat2 syscalls all receive either four	COMMENT
LOW	osquery/tables/events/windows/ntfs_journal_events.cpp	41	// when we encounter them? Does NTFS recycle FRNs? Does it matter in terms of	COMMENT
LOW	osquery/tables/utility/osquery.cpp	1	/**	COMMENT
LOW	…ental/experiments/linuxevents/libraries/CMakeLists.txt	1	# Copyright (c) 2014-present, The osquery authors	COMMENT
LOW	osquery/core/flags.h	201	*/	COMMENT
LOW	osquery/core/system.cpp	21	#include <uuid/uuid.h>	COMMENT
LOW	osquery/core/system.cpp	41		COMMENT
LOW	osquery/core/init.cpp	21	#include <WbemIdl.h>	COMMENT
LOW	osquery/core/init.cpp	41	#include <osquery/events/events.h>	COMMENT
LOW	osquery/core/watcher.cpp	21		COMMENT
LOW	osquery/core/windows/ntapi.h	21	#define STATUS_UNSUCCESSFUL 0xC0000001L	COMMENT
LOW	osquery/core/windows/ntapi.h	41	#define STATUS_INTEGER_OVERFLOW 0xC0000095L	COMMENT
LOW	osquery/core/windows/ntapi.h	61	#ifndef ObjectNameInformation	COMMENT
LOW	osquery/logger/logger.cpp	21	#include <boost/noncopyable.hpp>	COMMENT
LOW	osquery/config/config.cpp	21	#include <osquery/config/config.h>	COMMENT
379 more matches not shown…

Empty Error Handlers13 hits · 65 pts

Severity	File	Line	Snippet	Context
HIGH	tools/tests/test_osqueryd.py	157	except:	CODE
HIGH	tools/tests/test_osqueryd.py	164	except:	CODE
HIGH	tools/tests/test_osqueryd.py	61	except:	CODE
HIGH	tools/tests/utils.py	56	except Exception:	CODE
HIGH	tools/tests/test_base.py	288	except:	CODE
HIGH	tools/tests/test_base.py	538	except:	CODE
HIGH	tools/tests/test_base.py	750	except KeyboardInterrupt:	CODE
HIGH	tools/tests/test_base.py	315	except:	CODE
HIGH	tools/tests/test_base.py	506	except Exception as e:	CODE
HIGH	tools/tests/test_base.py	309	except:	CODE
HIGH	tools/tests/test_base.py	455	except Exception as e:	CODE
HIGH	tools/codegen/gentable.py	312	except:	CODE
HIGH	tools/codegen/amalgamate.py	69	except OSError:	CODE

Unused Imports32 hits · 32 pts

Severity	File	Line	Context
LOW	…ci/scripts/cve/validate_manifest_libraries_versions.py	10	CODE
LOW	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	21	CODE
LOW	tools/tests/winexpect.py	18	CODE
LOW	tools/tests/winexpect.py	25	CODE
LOW	tools/tests/winexpect.py	28	CODE
LOW	tools/tests/test_http_server.py	26	CODE
LOW	tools/tests/test_extensions.py	10	CODE
LOW	tools/tests/test_extensions.py	11	CODE
LOW	tools/tests/test_extensions.py	12	CODE
LOW	tools/tests/test_extensions.py	13	CODE
LOW	tools/tests/test_extensions.py	14	CODE
LOW	tools/tests/test_extensions.py	15	CODE
LOW	tools/tests/test_extensions.py	17	CODE
LOW	tools/tests/test_osqueryd.py	13	CODE
LOW	tools/tests/test_osqueryd.py	14	CODE
LOW	tools/tests/test_osqueryd.py	16	CODE
LOW	tools/tests/test_additional.py	10	CODE
LOW	tools/tests/test_additional.py	11	CODE
LOW	tools/tests/test_additional.py	12	CODE
LOW	tools/tests/test_base.py	104	CODE
LOW	tools/tests/test_osqueryi.py	11	CODE
LOW	tools/tests/test_osqueryi.py	12	CODE
LOW	tools/tests/test_osqueryi.py	14	CODE
LOW	tools/tests/test_example_queries.py	10	CODE
LOW	tools/tests/test_example_queries.py	12	CODE
LOW	tools/tests/test_example_queries.py	13	CODE
LOW	tools/tests/test_example_queries.py	14	CODE
LOW	tools/codegen/genapi.py	19	CODE
LOW	tools/codegen/genapi.py	20	CODE
LOW	tools/codegen/genwebsitejson.py	29	CODE
LOW	tools/codegen/genwebsitejson.py	32	CODE
LOW	tools/deployment/getfiles.py	12	CODE

Excessive Try-Catch Wrapping21 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	tools/cmake/downloader.py	23	except Exception as e:	CODE
MEDIUM	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	37	print("Error: " + message, file=sys.stderr)	CODE
LOW	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	93	except Exception as e:	CODE
MEDIUM	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	95	print(f"Error searching CVE for library {library_name}: {e}. Retrying")	CODE
LOW	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	412	except Exception as e:	CODE
MEDIUM	tools/ci/scripts/cve/osquery/manifest_api.py	48	print("Error: " + message, file=sys.stderr)	CODE
LOW	tools/tests/winexpect.py	64	except Exception as e:	CODE
LOW	tools/tests/utils.py	56	except Exception:	CODE
LOW	tools/tests/utils.py	80	except Exception as e:	CODE
LOW	tools/tests/utils.py	119	except Exception as e:	CODE
MEDIUM	tools/tests/utils.py	222	print("Error: %s" % err.decode("utf-8"))	CODE
LOW	tools/tests/test_base.py	255	except Exception as e:	CODE
LOW	tools/tests/test_base.py	265	except Exception as e:	CODE
LOW	tools/tests/test_base.py	455	except Exception as e:	CODE
LOW	tools/tests/test_base.py	506	except Exception as e:	CODE
LOW	tools/tests/test_base.py	680	except Exception as e:	CODE
LOW	tools/tests/test_base.py	721	except Exception as e:	CODE
MEDIUM	tools/tests/test_base.py	245	def run(self):	CODE
MEDIUM	tools/tests/test_base.py	535	def __del__(self):	CODE
MEDIUM	tools/tests/test_base.py	716	def _execute(self, query):	CODE
LOW	tools/codegen/genapi.py	265	except Exception as e:	CODE

Hyper-Verbose Identifiers20 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	tools/tests/test_release.py	84	def test_linked_system_libraries(self):	CODE
LOW	tools/tests/test_extensions.py	28	def test_daemon_without_extensions(self):	CODE
LOW	tools/tests/test_extensions.py	239	def test_extensions_directory_autoload(self):	CODE
LOW	tools/tests/test_extensions.py	262	def test_extensions_autoload_watchdog(self):	CODE
LOW	tools/tests/test_extensions.py	306	def test_external_config_update(self):	CODE
LOW	tools/tests/test_osqueryd.py	23	def test_daemon_without_watchdog(self):	CODE
LOW	tools/tests/test_osqueryd.py	66	def test_daemon_with_watchdog(self):	CODE
LOW	tools/tests/test_osqueryd.py	121	def daemon_sigint_test_helper(self, pidfile_path):	CODE
LOW	tools/tests/test_http_server_carver.py	24	def test_carve_blocks_are_acknowledged_and_reassembled(self):	CODE
LOW	tools/tests/test_windows_service.py	284	def test_install_run_stop_uninstall_windows_service(self):	STRING
LOW	tools/tests/test_windows_service.py	325	def test_thrash_windows_service(self):	STRING
LOW	tools/tests/test_osqueryi.py	47	def test_config_check_success(self):	CODE
LOW	tools/tests/test_osqueryi.py	82	def test_config_check_failure_invalid_path(self):	CODE
LOW	tools/tests/test_osqueryi.py	95	def test_config_check_failure_valid_path(self):	CODE
LOW	tools/tests/test_osqueryi.py	108	def test_config_check_failure_missing_plugin(self):	CODE
LOW	tools/tests/test_osqueryi.py	123	def test_config_check_example(self):	CODE
LOW	tools/tests/test_example_queries.py	23	def test_cross_platform_queries(self):	CODE
LOW	tools/tests/test_example_queries.py	26	def test_platform_specific_queries(self):	CODE
LOW	tools/formatting/git-clang-format.py	260	def compute_diff_and_extract_lines(commit, files):	STRING
LOW	tools/formatting/git-clang-format.py	351	def run_clang_format_and_save_to_tree(changed_lines, binary='clang-format',	STRING

Deep Nesting13 hits · 13 pts

Severity	File	Line	Context
LOW	tools/analysis/profile.py	82	CODE
LOW	tools/analysis/profile.py	114	CODE
LOW	…s/ci/scripts/cve/third_party_libraries_cves_scanner.py	40	CODE
LOW	tools/ci/scripts/cve/osquery/manifest_api.py	51	CODE
LOW	tools/tests/test_release.py	84	CODE
LOW	tools/tests/test_http_server.py	211	CODE
LOW	tools/tests/utils.py	71	CODE
LOW	tools/tests/test_base.py	356	CODE
LOW	tools/codegen/gentable.py	487	CODE
LOW	tools/codegen/gentable.py	247	CODE
LOW	tools/codegen/templite.py	70	CODE
LOW	tools/codegen/amalgamate.py	21	CODE
LOW	tools/formatting/git-clang-format.py	57	CODE

Self-Referential Comments5 hits · 13 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/tests/test_http_server.py	24	# Create a simple TLS/HTTP server.	COMMENT
MEDIUM	tools/tests/test_base.py	403	# Create a temporary config.	COMMENT
MEDIUM	tools/codegen/gentable.py	252	# Create a list of column options from the kwargs passed to the column.	COMMENT
MEDIUM	tools/formatting/git-clang-format.py	7	# This file is distributed under the University of Illinois Open Source	COMMENT
MEDIUM	tools/formatting/git-clang-format.py	50	# This file is created within the .git directory.	STRING

AI Slop Vocabulary3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	osquery/tables/system/windows/drivers.cpp	255	// Then, leverage the Windows APIs to get whatever remains	COMMENT
MEDIUM	osquery/core/watcher.cpp	78	// % of (User + System) CPU time worker can utilize	COMMENT
LOW	.github/workflows/hosted_runners.yml	967	# This allows us to do fewer builds (just use the builds	COMMENT

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	libraries/cmake/source/boost/mpl_static_cast_fix.hpp	38	// ── Part 1: fix the boost::numeric enum valid ranges ─────────────────────────	COMMENT
MEDIUM	libraries/cmake/source/boost/mpl_static_cast_fix.hpp	73	// ── Part 2: fix BOOST_MPL_AUX_STATIC_CAST ────────────────────────────────────	COMMENT

Structural Annotation Overuse4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	docs/wiki/development/building.md	61	### Step 1: Install macOS prerequisites	COMMENT
LOW	docs/wiki/development/building.md	73	### Step 2: Download and build source on macOS	COMMENT
LOW	docs/wiki/development/building.md	137	### Step 1: Install Windows prerequisites	COMMENT
LOW	docs/wiki/development/building.md	161	### Step 2: Download and build source on Windows	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	tools/tests/test_http_server.py	455	# Check if client accepts gzip encoding	COMMENT
LOW	tools/tests/utils.py	94	# Check if it is an internal pack definition	COMMENT

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tools/ci/scripts/cve/osquery/github_api.py	64		CODE
LOW	tools/ci/scripts/cve/osquery/github_api.py	84		CODE

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tests/integration/tables/hash.cpp	31	path, "Lorem ipsum dolor sit amet, consectetur adipiscing elit.")	CODE
LOW	tests/integration/tables/hash.cpp	31	path, "Lorem ipsum dolor sit amet, consectetur adipiscing elit.")	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	osquery/tables/networking/windows/routes.cpp	154	// TODO: implement routes flags	COMMENT

osquery/osquery

Open-Source Code Quality, Security and Technical Debt Review