2.1

Adjusted Signal

2.1

Raw Pattern Score

100%

Time Factor

2026-10-26

Last Push

61.6K

Stars

Language

185.4K

Lines of Code

724

Files

274

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 225 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.5/100 · LOW

Are imports declared and package/API names verified? 49 finding(s).

Agent Over-Engineering Ratio 0.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 16 finding(s).

PR Review Velocity Impact 9.8/100 · LOW

Which changes need focused human review? 274 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 16MEDIUM 9LOW 248

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 274 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block189 hits · 164 pts

Severity	File	Line	Snippet	Context
LOW	ui/src/records/recordsList.js	561		COMMENT
LOW	ui/src/fields/autodate/onrecordduplicate.js	1	// {	COMMENT
LOW	ui/src/fields/file/onrecordduplicate.js	1	// {	COMMENT
LOW	tools/logger/batch_handler.go	21	var _ slog.Handler = (*BatchHandler)(nil)	COMMENT
LOW	tools/logger/batch_handler.go	41	BatchSize int	COMMENT
LOW	tools/picker/pick.go	21	// Fields value modifiers are also supported using the `:modifier(args)` format (see Modifiers).	COMMENT
LOW	tools/template/registry.go	1	// Package template is a thin wrapper around the standard html/template	COMMENT
LOW	tools/template/registry.go	61	//	COMMENT
LOW	tools/mailer/smtp.go	161		COMMENT
LOW	tools/mailer/smtp.go	181		COMMENT
LOW	tools/filesystem/filesystem.go	181	// Deprecated: Please use GetReader(fileKey) instead.	COMMENT
LOW	tools/filesystem/filesystem.go	361	}	COMMENT
LOW	tools/filesystem/filesystem.go	601	// note: expects key to be in a canonical form (eg. "accept-encoding" should be "Accept-Encoding").	COMMENT
LOW	tools/filesystem/internal/s3blob/s3blob.go	1	// Package s3blob provides a blob.Bucket S3 driver implementation.	COMMENT
LOW	tools/filesystem/internal/s3blob/s3/uploader.go	41		COMMENT
LOW	tools/filesystem/internal/s3blob/s3/list_objects.go	21	// For directory buckets, "/" is the only supported delimiter.	COMMENT
LOW	tools/filesystem/internal/s3blob/s3/s3.go	1	// Package s3 implements a lightweight client for interacting with the	COMMENT
LOW	tools/filesystem/internal/fileblob/attrs.go	1	package fileblob	COMMENT
LOW	tools/filesystem/internal/fileblob/fileblob.go	1	// Package fileblob provides a blob.Bucket driver implementation.	COMMENT
LOW	tools/filesystem/internal/fileblob/fileblob.go	21	//	COMMENT
LOW	tools/filesystem/internal/fileblob/fileblob.go	41	// `MetadataDontWrite` or its equivalent "metadata=skip" in the URL for the opener.	COMMENT
LOW	tools/filesystem/blob/bucket.go	1	// Package blob defines a lightweight abstration for interacting with	COMMENT
LOW	tools/filesystem/blob/bucket.go	61	// Delimiter sets the delimiter used to define a hierarchical namespace,	COMMENT
LOW	tools/filesystem/blob/bucket.go	81	// PageToken may be filled in with the NextPageToken from a previous	COMMENT
LOW	tools/filesystem/blob/bucket.go	201	var FirstPageToken = []byte("first page")	COMMENT
LOW	tools/filesystem/blob/bucket.go	301		COMMENT
LOW	tools/filesystem/blob/bucket.go	481	//	COMMENT
LOW	tools/filesystem/blob/bucket.go	501	// displayed inline or as an attachment.	COMMENT
LOW	tools/filesystem/blob/bucket.go	521	// When true, if ContentType is the empty string, it will stay the empty	COMMENT
LOW	tools/filesystem/blob/bucket.go	541	// NewWriter returns a Writer that writes to the blob stored at key.	COMMENT
LOW	tools/filesystem/blob/writer.go	21	// https://www.apache.org/licenses/LICENSE-2.0	COMMENT
LOW	tools/filesystem/blob/reader.go	41	savedOffset int64 // Last relativeOffset for r, saved after relativeOffset is changed in Seek, or -1 if no Seek.	COMMENT
LOW	tools/filesystem/blob/hex.go	1	package blob	COMMENT
LOW	tools/filesystem/blob/hex.go	21	// distributed under the License is distributed on an "AS IS" BASIS,	COMMENT
LOW	tools/filesystem/blob/driver.go	41		COMMENT
LOW	tools/filesystem/blob/driver.go	61	// NewTypedWriter returns Writer that writes to an object associated with key.	COMMENT
LOW	tools/filesystem/blob/driver.go	81	// Copy copies the object associated with srcKey to dstKey.	COMMENT
LOW	tools/subscriptions/client.go	21	}	COMMENT
LOW	tools/search/simple_field_resolver.go	21	// ResolverResult defines a single FieldResolver.Resolve() successfully parsed result.	COMMENT
LOW	tools/search/filter.go	21	//	COMMENT
LOW	tools/search/token_functions.go	61	}, nil	COMMENT
LOW	tools/hook/hook.go	21	//	COMMENT
LOW	tools/hook/hook.go	41	// hook.Event	COMMENT
LOW	tools/cron/schedule.go	81	//	COMMENT
LOW	tools/store/store.go	161		COMMENT
LOW	tools/router/rereadable_read_closer.go	21	// NB! Make sure to call Close after done working with the reader.	COMMENT
LOW	tools/router/event.go	181	const jsonFieldsParam = "fields"	COMMENT
LOW	tools/router/event.go	341	// dst must be either a struct pointer or map[string]any.	COMMENT
LOW	tools/router/event.go	361	//	COMMENT
LOW	tools/router/unmarshal_request_data.go	21	//	COMMENT
LOW	tools/router/unmarshal_request_data.go	41	//	COMMENT
LOW	tools/router/router.go	21	// Optionally return a clean up function that will be invoked right after the route execution.	COMMENT
LOW	apis/record_auth_with_oauth2_redirect.go	121	// fallback if UI is not bundled	COMMENT
LOW	apis/serve.go	41	//	COMMENT
LOW	apis/record_crud.go	101	return firstApiError(err, e.InternalServerError("Failed to enrich records", err))	COMMENT
LOW	apis/middlewares_gzip.go	41	//	COMMENT
LOW	apis/middlewares_gzip.go	221	}	COMMENT
LOW	apis/middlewares_cors.go	1	package apis	COMMENT
LOW	apis/middlewares_cors.go	41	// validate any logic. Remember that attackers may register hostile domain names.	COMMENT
LOW	apis/middlewares_cors.go	61	// AllowMethods determines the value of the Access-Control-Allow-Methods	COMMENT
129 more matches not shown…

Cross-Language Confusion (JS/TS)16 hits · 120 pts

Severity	File	Line	Snippet	Context
HIGH⚡	ui/src/apiPreview/docsAuthWithOAuth2.js	135	print(pb.authStore.isValid);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithOAuth2.js	136	print(pb.authStore.token);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithOAuth2.js	137	print(pb.authStore.record.id);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthRefresh.js	113	print(pb.authStore.isValid);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthRefresh.js	114	print(pb.authStore.token);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthRefresh.js	115	print(pb.authStore.record.id);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithPassword.js	114	print(pb.authStore.isValid);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithPassword.js	115	print(pb.authStore.token);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithPassword.js	116	print(pb.authStore.record.id);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithOTP.js	98	print(pb.authStore.isValid);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithOTP.js	99	print(pb.authStore.token);	CODE
HIGH⚡	ui/src/apiPreview/docsAuthWithOTP.js	100	print(pb.authStore.record.id);	CODE
HIGH⚡	ui/src/apiPreview/docsRealtime.js	108	print(e.action);	CODE
HIGH⚡	ui/src/apiPreview/docsRealtime.js	109	print(e.record);	CODE
HIGH⚡	ui/src/apiPreview/docsRealtime.js	114	print(e.action);	CODE
HIGH⚡	ui/src/apiPreview/docsRealtime.js	115	print(e.record);	CODE

Fake / Example Data32 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	CHANGELOG_16_22.md	647	app.Logger().Info("Example message", "total", 123, "details", "lorem ipsum...")	CODE
LOW	CHANGELOG_16_22.md	650	$app.logger().info("Example message", "total", 123, "details", "lorem ipsum...")	CODE
LOW	CHANGELOG_16_22.md	1125	app.Dao().FindRecordsByFilter("posts", "title ~ 'lorem ipsum' && visible = true", "-created", 10)	CODE
LOW⚡	ui/public/libs/tinymce/tinymce.min.js	13	!function(){"use strict";var e=function(e){if(null===e)return"null";if(void 0===e)return"undefined";var t=typeof e;retur	CODE
LOW	ui/public/libs/tinymce/themes/silver/theme.min.js	1	!function(){"use strict";const e=Object.getPrototypeOf,t=(e,t,o)=>{var n;return!!o(e,t.prototype)\|\|(null===(n=e.construc	CODE
LOW	ui/src/fields/editor/init.js	17	return "Lorem ipsum dolor sit amet...";	CODE
LOW	ui/src/fields/editor/init.js	17	return "Lorem ipsum dolor sit amet...";	CODE
LOW	ui/src/apiPreview/docsAuthWithOAuth2.js	21	"name": "John Doe",	CODE
LOW	ui/src/base/select.js	247	{ rid: "selected-placeholder", className: "placeholder" },	CODE
LOW	tools/logger/batch_handler.go	59	// l.Info("Example message", "title", "lorem ipsum")	COMMENT
LOW	tools/inflector/inflector_test.go	128	{"John Doe", "john_doe"},	CODE
LOW	tools/mailer/html2text_test.go	74	<p>Lorem ipsum</p>	CODE
LOW	tools/mailer/html2text_test.go	75	<p>Dolor sit amet</p>	CODE
LOW	tools/mailer/html2text_test.go	117	"Lorem ipsum \r\nDolor sit amet \r\n[Verify](a/b/c) \r\n[Verify2.1 Verify2.2](a/b/c) \r\n\r\n- ul.test1 \r\n- ul.te	CODE
LOW	tools/mailer/html2text_test.go	117	"Lorem ipsum \r\nDolor sit amet \r\n[Verify](a/b/c) \r\n[Verify2.1 Verify2.2](a/b/c) \r\n\r\n- ul.test1 \r\n- ul.te	CODE
LOW⚡	tools/mailer/mailer_test.go	21	[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},	CODE
LOW⚡	tools/mailer/mailer_test.go	21	[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},	CODE
LOW⚡	tools/mailer/mailer_test.go	22	[]string{`"John Doe" <test1@example.com>`, `"Jane Doe" <test2@example.com>`},	CODE
LOW⚡	tools/mailer/mailer_test.go	22	[]string{`"John Doe" <test1@example.com>`, `"Jane Doe" <test2@example.com>`},	CODE
LOW⚡	tools/mailer/mailer_test.go	26	[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Address: "test2@example.com"}},	CODE
LOW⚡	tools/mailer/mailer_test.go	27	[]string{`"John Doe" <test1@example.com>`, `test2@example.com`},	CODE
LOW⚡	tools/mailer/mailer_test.go	31	[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},	CODE
LOW⚡	tools/mailer/mailer_test.go	31	[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},	CODE
LOW	tools/filesystem/filesystem.go	378	// content := strings.NewReader("Lorem ipsum dolor sit amet...")	COMMENT
LOW	tools/filesystem/filesystem.go	378	// content := strings.NewReader("Lorem ipsum dolor sit amet...")	COMMENT
LOW	core/record_query.go	364	// dbx.Params{"title": "lorem ipsum", "visible": true}	COMMENT
LOW	core/app.go	634	// dbx.Params{"title": "lorem ipsum", "visible": true}	COMMENT
LOW	plugins/jsvm/binds_test.go	930	if (result.name != "John Doe") {	CODE
LOW	plugins/jsvm/binds_test.go	931	throw new Error("Expected result.name 'John Doe', got " + result.name)	CODE
LOW	plugins/jsvm/binds_test.go	942	if (result.name != "John Doe") {	CODE
LOW	plugins/jsvm/binds_test.go	943	throw new Error("Expected result.name 'John Doe', got " + result.name)	CODE
LOW	plugins/jsvm/internal/types/types.go	391	* title: "Lorem ipsum"	COMMENT

Hyper-Verbose Identifiers16 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	ui/src/records/recordUpsertModal.js	869	function resetTokenKeyDropdownItem(collection, data, modalSettings) {	CODE
LOW	ui/src/records/recordUpsertModal.js	938	function sendPasswordResetEmailDropdownItem(collection, data, modalSettings) {	CODE
LOW	ui/src/records/recordUpsertModal.js	983	function sendVerificationDropdownItem(collection, data, modalSettings) {	CODE
LOW	ui/src/records/recordSummary.js	117	function hideRecordSummaryDropdown(target, delay = 150) {	CODE
LOW	ui/src/records/recordSummary.js	134	function showRecordSummaryDropdown(target, record, delay = 150) {	CODE
LOW	ui/src/auth/pageRequestSuperuserPasswordReset.js	1	export function pageRequestSuperuserPasswordReset(route) {	CODE
LOW	ui/src/apiPreview/docsCreate.js	375	export function replaceDummyPayloadPlaceholder(payloadStr) {	CODE
LOW	ui/src/collections/collectionsOverviewModal.js	125	function sortSystemUnderscoredLast(a, b) {	CODE
LOW	ui/src/collections/collectionUpsertModal.js	727	function syncFieldsAndIndexesWithScaffold(collection) {	CODE
LOW	…/src/collections/collectionChangesConfirmationModal.js	109	async function detectConflictingOIDCProviders() {	CODE
LOW	ui/src/collections/autocomplete.utils.js	67	function collectionFieldsAutocomplete(word, collections, collection, prefix = "", level = 0) {	CODE
LOW	ui/src/collections/autocomplete.utils.js	156	function requestFieldsAutocomplete(word, collections, baseCollection) {	CODE
LOW	ui/src/collections/autocomplete.utils.js	216	function collectionJoinAutocomplete(word, collections) {	CODE
LOW	ui/src/collections/oauth2/appleOptions.js	47	function appleSecretGeneratorModal(modalSettings = {}) {	CODE
LOW	ui/src/base/tinymce.js	88	function triggerOnchangeWithDebounce(debounce = 150) {	CODE
LOW	ui/src/base/codeEditor.js	110	function closeAutocompleteDropdown() {	CODE

Modern AI Meta-Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	ui/src/collections/collectionUpsertModal.js	338	// merge with the scaffold to ensure that the minimal props are set	COMMENT
MEDIUM	ui/src/collections/collectionUpsertModal.js	766	// remove old scaffold indexes	COMMENT
MEDIUM	ui/src/collections/collectionUpsertModal.js	788	// merge new scaffold indexes	COMMENT
MEDIUM	apis/collection.go	88	// create scaffold	COMMENT
MEDIUM	apis/collection.go	91	// merge the scaffold with the submitted request data	COMMENT

Example Usage Blocks9 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	core/mfa_model.go	34	// Example usage:	COMMENT
LOW	core/auth_origin_model.go	29	// Example usage:	COMMENT
LOW	core/external_auth_model.go	28	// Example usage:	COMMENT
LOW	core/otp_model.go	28	// Example usage:	COMMENT
LOW	core/record_model.go	1368	// Example usage:	COMMENT
LOW	plugins/migratecmd/migratecmd.go	6	// Example usage:	COMMENT
LOW	plugins/migratecmd/migratecmd.go	51	// Example usage:	COMMENT
LOW	plugins/ghupdate/ghupdate.go	7	// Example usage:	COMMENT
LOW	plugins/jsvm/jsvm.go	114	// Example usage:	COMMENT

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	ui/public/libs/tinymce/tinymce.min.js	13	!function(){"use strict";var e=function(e){if(null===e)return"null";if(void 0===e)return"undefined";var t=typeof e;retur	CODE
MEDIUM⚡	ui/public/libs/tinymce/tinymce.min.js	13	!function(){"use strict";var e=function(e){if(null===e)return"null";if(void 0===e)return"undefined";var t=typeof e;retur	CODE
MEDIUM	ui/src/records/recordsList.js	132	// no explicit presentable -> try to utilize the first found implicit presentable field	COMMENT
MEDIUM	plugins/jsvm/jsvm.go	5	// can utilize them as part of their own custom goja runtime setup.	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	ui/public/libs/tinymce/themes/silver/theme.min.js	1	!function(){"use strict";const e=Object.getPrototypeOf,t=(e,t,o)=>{var n;return!!o(e,t.prototype)\|\|(null===(n=e.construc	CODE

Slop Phrases2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	tools/filesystem/internal/s3blob/s3/s3.go	112	// Note: Don't forget to call resp.Body.Close() after done with the result.	COMMENT
LOW	tools/search/provider_test.go	749	// NB! Don't forget to call `db.Close()` at the end of the test.	COMMENT

pocketbase/pocketbase

Open-Source Code Quality, Security and Technical Debt Review