Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 32 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 3 finding(s).

PR Review Velocity Impact 1.6/100 · LOW

Which changes need focused human review? 32 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern Findings

The scanner identified 32 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block24 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	examples/Scripts/BooleanOperations.html	221		COMMENT
LOW	examples/Scripts/BooleanOperations.html	241	// if (hi) {	COMMENT
LOW	examples/Scripts/BooleanOperations.html	261	// // markPoint(a.point, " ") });	COMMENT
LOW	examples/Games/Paperoids.html	1	<!DOCTYPE html>	COMMENT
LOW	.github/deploy-prebuilt.sh	1	#!/bin/bash	COMMENT
LOW	src/export.js	41	// https://github.com/umdjs/umd	COMMENT
LOW	src/init.js	21	// Node.js	COMMENT
LOW	src/load.js	21	var scripts = document.getElementsByTagName('script'),	COMMENT
LOW	src/core/PaperScript.js	701	// undefined arguments, so that their name exists, rather than	COMMENT
LOW	src/core/PaperScript.js	861	// Support both text/paperscript and text/x-paperscript:	COMMENT
LOW	src/path/PathItem.Offset.js	421	// The axes of the pen's ellipse:	COMMENT
LOW	src/path/PathItem.Offset.js	561	}	COMMENT
LOW	src/path/Path.js	1141	// Divide the curve with the index at the given curve-time.	COMMENT
LOW	src/path/Path.js	1481	paddingRight = min(1, length - to - 1);	COMMENT
LOW	src/path/Path.js	1501	// a = 0 (L), 1 (I), 2 (R)	COMMENT
LOW	src/path/Curve.js	1541	// 'quadratic' (d1 == d2 == 0)	COMMENT
LOW	src/path/Curve.js	2381	dist2 = dq2 - (dq0 + 2 * dq3) / 3,	COMMENT
LOW	src/style/Style.js	181		COMMENT
LOW	src/item/HitResult.js	121	tolerance: paper.settings.hitTolerance,	COMMENT
LOW	src/item/Item.js	1001	// We can only cache the bounds if the path uses stroke-scaling, or if	COMMENT
LOW	src/item/Item.js	2361	// checking for emptiness would load them:	COMMENT
LOW	src/item/Item.js	3181	if (owner) {	COMMENT
LOW	src/item/Item.js	5021	// and strokeColor also need to be drawn on a temporary canvas	COMMENT
LOW	src/tool/Tool.js	361	called = false,	COMMENT

TODO Padding3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	src/svg/SvgImport.js	686	// TODO: implement preserveAspectRatio attribute	COMMENT
LOW	src/item/Item.js	3923	// TODO: Add test for item shearing, as it might be behaving oddly.	COMMENT
LOW	src/item/Item.js	5497	// TODO: implement Item#removeOnFrame	COMMENT

Hyper-Verbose Identifiers3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	test/tests/Hosted.test.js	325	function createHostedProjectWithoutBoxes() {	CODE
LOW	src/path/Curve.js	2454	function getCurveLineIntersections(v, px, py, vx, vy) {	CODE
LOW	src/path/Curve.js	2491	function addCurveLineIntersections(v1, v2, c1, c2, locations, include,	CODE

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/deploy-prebuilt.sh	38	# Create a new orphaned prebuilt/dist branch and switch to it.	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	src/svg/SvgImport.js	814	function getData(node) {	CODE

paperjs/paper.js

Open-Source Code Quality, Security and Technical Debt Review

Risk Review · Payload v1

What These Metrics Mean

Pattern-Signal History

Severity Breakdown

Directory Score Breakdown

Pattern Findings