1.6

Adjusted Signal

1.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

5.1K

Stars

Language

341.8K

Lines of Code

1.7K

Files

389

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 266 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.6/100 · LOW

Are imports declared and package/API names verified? 92 finding(s).

Agent Over-Engineering Ratio 1.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 41 finding(s).

PR Review Velocity Impact 6.9/100 · LOW

Which changes need focused human review? 389 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 1MEDIUM 39LOW 347

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 389 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block206 hits · 190 pts

Severity	File	Line	Snippet	Context
LOW	ui/src/util/base64.ts	1	// The MIT License (MIT)	COMMENT
LOW	authenticate/handlers.go	201		COMMENT
LOW	config/identity_provider.go	21	"github.com/pomerium/pomerium/pkg/health"	COMMENT
LOW	config/identity_provider.go	41	// The special value `kubernetes:///` selects the API server of the	COMMENT
LOW	config/identity_provider.go	161		COMMENT
LOW	config/identity_provider.go	281	// providers that would have used it, rather than the whole map — kubernetes://	COMMENT
LOW	config/identity_provider.go	301	deferred []*deferredKubernetesProvider	COMMENT
LOW	config/identity_provider.go	321	cacheKey uint64	COMMENT
LOW	config/identity_provider.go	521	ProviderName: rp.Name,	COMMENT
LOW	config/identity_provider.go	581	// fetches.	COMMENT
LOW	config/identity_provider.go	601	// automatically. The CA bundle is written to the digest directly: routing	COMMENT
LOW	config/options.go	161	// non-interactive workloads on routes whose BearerTokenFormat is	COMMENT
LOW	config/options.go	241	// If multiple keys are given, they must each have unique algorithms.	COMMENT
LOW	config/policy.go	101		COMMENT
LOW	config/policy.go	141	SetRequestHeaders map[string]string `mapstructure:"set_request_headers" yaml:"set_request_headers,omitempty"`	COMMENT
LOW	config/identity_provider_kubernetes.go	1	package config	COMMENT
LOW	config/identity_provider_kubernetes.go	21	//	COMMENT
LOW	config/identity_provider_kubernetes.go	61	kubernetesIssuerScheme = "kubernetes"	COMMENT
LOW	config/identity_provider_kubernetes.go	161	return &http.Client{Transport: &kubernetesAuthRoundTripper{	COMMENT
LOW	config/autocert.go	41	// MustStaple will cause autocert to request a certificate with	COMMENT
LOW	config/mtls.go	21	// DownstreamMTLSSettings specify the downstream client certificate requirements.	COMMENT
LOW	config/envoyconfig/websocket_int_test.go	21		COMMENT
LOW	config/envoyconfig/websocket_int_test.go	61	// without upgrade_configs). Asserting the status pins the fact	COMMENT
LOW	internal/middleware/responsewriter/wrap_writer.go	41	// WrapResponseWriter is a proxy around an http.ResponseWriter that allows you to hook	COMMENT
LOW	internal/httputil/headers.go	21	// HeaderPomeriumAuthorization is the header key for a pomerium authorization JWT. It	COMMENT
LOW	internal/recording/protocol.go	61		COMMENT
LOW	internal/mcp/cors.go	1	package mcp	COMMENT
LOW	internal/mcp/cors.go	21	// endpoints should "support the necessary CORS headers to allow the responses to	COMMENT
LOW	internal/mcp/client_id_metadata.go	101	// - MUST NOT contain a fragment component	COMMENT
LOW	internal/mcp/handler_token.go	41	// enumerate registered clients.	COMMENT
LOW	internal/mcp/upstream_auth_prm_resource_test.go	21	//	COMMENT
LOW	internal/mcp/upstream_discovery.go	41	//	COMMENT
LOW	internal/mcp/handler_connect.go	261	if redirectHostname != stripPort(requestHost) &&	COMMENT
LOW	internal/mcp/handler_connect.go	281	//	COMMENT
LOW	internal/mcp/e2e/mcp_cors_test.go	21	"github.com/pomerium/pomerium/internal/testenv/snippets"	COMMENT
LOW	…rnal/mcp/e2e/ext_proc_databroker_config_update_test.go	41	// The handler wraps a *mcp.HostInfo whose map of hostname -> ServerHostInfo is	COMMENT
LOW	internal/mcp/extproc/handler.go	21	// HandleUpstreamResponse processes a 401/403 response from upstream.	COMMENT
LOW	internal/opaquetoken/payload.pb.go	81	}	COMMENT
LOW	internal/testenv/types.go	21	}	COMMENT
LOW	internal/testenv/types.go	81	// to make additional modifications. The aggregate's Modify() is called first.	COMMENT
LOW	internal/testenv/ports.go	21	// silently land on whichever server won the race.	COMMENT
LOW	internal/testenv/environment.go	81	CACert() *tls.Certificate	COMMENT
LOW	internal/testenv/environment.go	121	AddOption(pomerium.Option)	COMMENT
LOW	internal/testenv/environment.go	141	// given, but can be called at any time.	COMMENT
LOW	internal/testenv/environment.go	161	// before continuing, after triggering the state change.	COMMENT
LOW	internal/testenv/upstreams/http.go	101	// be the actual client used for that request. It can be the same as the input	COMMENT
LOW	internal/acceptance/acceptance_test.go	1	//go:build acceptance	COMMENT
LOW	…cceptance/suites/upstream-tls/setup/pomerium-config.ts	1	// Pomerium configuration generator for the upstream TLS/mTLS suite.	COMMENT
LOW	…nal/acceptance/suites/upstream-tls/setup/containers.ts	1	// testcontainers orchestration for the upstream TLS/mTLS e2e stack.	COMMENT
LOW	…al/acceptance/suites/upstream-tls/scripts/gen-certs.sh	1	#!/bin/sh	COMMENT
LOW	…rnal/acceptance/suites/upstream-tls/upstream/server.js	1	"use strict";	COMMENT
LOW	…ptance/suites/downstream-mtls/setup/pomerium-config.ts	1	// Pomerium configuration generator for per-test-group variants.	COMMENT
LOW	…/acceptance/suites/downstream-mtls/setup/containers.ts	1	// testcontainers orchestration for the downstream mTLS e2e stack.	COMMENT
LOW	…al/acceptance/suites/downstream-mtls/tests/crl.spec.ts	81	// DEVIATION FROM THE MANUAL TEST PLAN, confirmed against the source: the	COMMENT
LOW	…acceptance/suites/downstream-mtls/scripts/gen-certs.sh	1	#!/bin/sh	COMMENT
LOW	internal/acceptance/suites/mcp/setup/certs.ts	1	// mkcert-based certificate generation.	COMMENT
LOW	internal/acceptance/suites/mcp/setup/containers.ts	1	// testcontainers orchestration for the MCP e2e stack.	COMMENT
LOW	internal/acceptance/suites/mcp/mcp-client/connect.ts	1	// Connect an MCP client to a Pomerium-fronted MCP server, performing the OAuth	COMMENT
LOW	internal/zero/controller/config.go	61	}	COMMENT
LOW	internal/zero/controller/config.go	81	// Example: "file:///path/to/file" would write the config to "/path/to/file"	COMMENT
146 more matches not shown…

Decorative Section Separators31 hits · 112 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	internal/recording/protocol.go	67	// ├──► RecordingData(Metadata) ───────►│ 1. Receive metadata	COMMENT
MEDIUM⚡	internal/recording/protocol.go	71	// │◄─── RecordingSession ──────────────┤ 2. Send manifest	COMMENT
MEDIUM⚡	internal/recording/protocol.go	74	// ├──► RecordingData(Chunk) ──────────►│ 3. Stream chunks	COMMENT
MEDIUM⚡	internal/recording/protocol.go	75	// ├──► ... ──────────►│	COMMENT
MEDIUM⚡	internal/recording/protocol.go	76	// ├──► RecordingData(Checksum) ───────►│ 4. Verify checksum	COMMENT
MEDIUM⚡	internal/recording/protocol.go	78	// │◄─── RecordingSession ──────────────┤ 5. Send updated manifest	COMMENT
MEDIUM⚡	internal/recording/protocol.go	80	// ├──► RecordingData(Chunk) ──────────►│ 6. Continue streaming until done...	COMMENT
MEDIUM	…acceptance/suites/downstream-mtls/scripts/gen-certs.sh	35	# ============================================================================	COMMENT
MEDIUM	…acceptance/suites/downstream-mtls/scripts/gen-certs.sh	37	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	52	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	54	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	81	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	83	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	123	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	125	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	137	# ===========================================================================	COMMENT
MEDIUM	internal/acceptance/pomerium/config.yaml	139	# ===========================================================================	COMMENT
MEDIUM⚡	internal/acceptance/scripts/gen-mtls-certs.sh	35	# ============================================================================	COMMENT
MEDIUM⚡	internal/acceptance/scripts/gen-mtls-certs.sh	37	# ============================================================================	COMMENT
MEDIUM⚡	internal/acceptance/scripts/gen-mtls-certs.sh	46	# ============================================================================	COMMENT
MEDIUM⚡	internal/acceptance/scripts/gen-mtls-certs.sh	48	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	78	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	80	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	114	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	116	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	149	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	151	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	182	# ============================================================================	COMMENT
MEDIUM	internal/acceptance/scripts/gen-mtls-certs.sh	184	# ============================================================================	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	17	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	36	# ---------------------------------------------------------------------------	COMMENT

Fake / Example Data90 hits · 92 pts

Severity	File	Line	Snippet	Context
LOW	proxy/handlers_test.go	282	assert.Equal(t, `{"admin":true,"name":"John Doe","sub":"1234567890"}`, string(b))	CODE
LOW	config/policy_test.go	235	&Policy{From: "https://pomerium.io", To: mustParseWeightedURLs(t, "http://localhost"), AllowedUsers: []string{"foo@ba	CODE
LOW	config/policy_test.go	272	p := &Policy{From: "https://pomerium.io", To: mustParseWeightedURLs(t, "http://localhost"), AllowedUsers: []string{"foo	CODE
LOW	config/policy_test.go	317	AllowedUsers: []string{"foo@bar.com"},	CODE
LOW	config/options_test.go	591	"AUTOCERT_EAB_MAC_KEY": "fake-key",	CODE
LOW	config/options_test.go	606	EABMACKey: "fake-key",	CODE
LOW	config/options_test.go	622	"AUTOCERT_EAB_MAC_KEY": "fake-key",	CODE
LOW	config/options_test.go	637	EABMACKey: "fake-key",	CODE
LOW	internal/authenticateflow/stateful_test.go	463	"name": "John Doe",	CODE
LOW	internal/authenticateflow/stateful_test.go	480	"name": {Values: []*structpb.Value{structpb.NewStringValue("John Doe")}},	CODE
LOW	internal/authenticateflow/identityprofile_test.go	38	"name": structpb.NewStringValue("John Doe"),	CODE
LOW	internal/authenticateflow/identityprofile_test.go	65	"name": {Values: []*structpb.Value{structpb.NewStringValue("John Doe")}},	CODE
LOW	…ternal/authenticateflow/jwt_claims_headers_int_test.go	33	Email: "user@example.com",	CODE
LOW	…ternal/authenticateflow/jwt_claims_headers_int_test.go	77	upstreams.AuthenticateAs("user@example.com"),	CODE
LOW	…ternal/authenticateflow/jwt_claims_headers_int_test.go	88	assert.Equal(t, "user@example.com", hdrs["x-pomerium-claim-email"])	CODE
LOW	…ternal/authenticateflow/jwt_claims_headers_int_test.go	98	assert.Equal(t, "user@example.com", payload["email"])	CODE
LOW	internal/mcp/e2e/mcp_test.go	36	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_test.go	166	userToken := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/mcp_upstream_pre_registered_test.go	53	idp := scenarios.NewIDP([]*scenarios.User{{Email: "user@example.com"}})	CODE
LOW	internal/mcp/e2e/mcp_upstream_pre_registered_test.go	224	upstreams.AuthenticateAs("user@example.com"),	CODE
LOW	internal/mcp/e2e/mcp_upstream_pre_registered_test.go	267	authResp, err := upstreams.AuthenticateFlow(t.Context(), browser, authReq, "user@example.com", true)	CODE
LOW	internal/mcp/e2e/mcp_auth_flow_test.go	51	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_auth_flow_test.go	247	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	170	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	309	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	342	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	372	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	411	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	437	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_handler_test.go	457	token := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/mcp_upstream_dcr_fallback_test.go	46	idp := scenarios.NewIDP([]*scenarios.User{{Email: "user@example.com"}})	CODE
LOW	internal/mcp/e2e/mcp_upstream_dcr_fallback_test.go	221	upstreams.AuthenticateAs("user@example.com"),	CODE
LOW	internal/mcp/e2e/mcp_upstream_dcr_fallback_test.go	263	authResp, err := upstreams.AuthenticateFlow(t.Context(), browser, authReq, "user@example.com", true)	CODE
LOW	internal/mcp/e2e/service_account_test.go	60	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/service_account_test.go	146	userToken := getToken("user@example.com")	CODE
LOW⚡	internal/mcp/e2e/service_account_test.go	162	UserId: "user@example.com",	CODE
LOW	internal/mcp/e2e/service_account_test.go	211	UserId: "user@example.com",	CODE
LOW	internal/mcp/e2e/service_account_test.go	341	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/service_account_test.go	418	UserId: "user@example.com",	CODE
LOW	internal/mcp/e2e/mcp_client_routes_test.go	56	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_client_routes_test.go	134	resp, err := upstreams.AuthenticateFlow(ctx, client, authReq, "user@example.com", true)	CODE
LOW	internal/mcp/e2e/mcp_cors_test.go	54	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_cors_test.go	312	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/mcp_echo_only_server_test.go	56	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_echo_only_server_test.go	148	upstreams.AuthenticateAs("user@example.com"),	CODE
LOW	internal/mcp/e2e/ext_proc_test.go	54	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/ext_proc_test.go	162	userToken := getToken("user@example.com")	CODE
LOW	internal/mcp/e2e/ext_proc_test.go	198	upstreams.AuthenticateAs("user@example.com"),	CODE
LOW	internal/mcp/e2e/mcp_dcr_disabled_test.go	38	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_conformance_test.go	51	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_conformance_test.go	169	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	47	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	222	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	314	{Email: "user@example.com"},	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	409	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	452	resp, err := upstreams.AuthenticateFlow(ctx, authClient, req, "user@example.com", false)	CODE
LOW	internal/mcp/e2e/mcp_client_id_metadata_test.go	479	{Email: "user@example.com"},	CODE
LOW	internal/databroker/config_source_test.go	62	}, AllowedUsers: []string{"foo@bar.com"},	CODE
LOW	internal/rfc7591/format_test.go	49	"contacts": ["admin@example.com", "support@example.com"],	CODE
LOW	internal/rfc7591/format_test.go	72	Contacts: []string{"admin@example.com", "support@example.com"},	CODE
30 more matches not shown…

Structural Annotation Overuse19 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	internal/mcp/DESIGN.md	535	### Step 1: Protected Resource Metadata (PRM)	COMMENT
LOW	internal/mcp/DESIGN.md	562	### Step 2: Authorization Server Metadata	COMMENT
LOW	internal/mcp/upstream_oauth_setup.go	254	// Step 1: Fetch Protected Resource Metadata (RFC 9728)	COMMENT
LOW⚡	internal/mcp/upstream_oauth_setup.go	292	// Step 2: If PRM succeeded, use PRM → AS metadata flow	COMMENT
LOW⚡	internal/mcp/upstream_oauth_setup.go	297	// Step 3: PRM not available — fall back to direct AS metadata discovery.	COMMENT
LOW	internal/mcp/handler_connect.go	417	// Step 1: Check for pending upstream auth from ext_proc.	COMMENT
LOW	internal/mcp/handler_connect.go	466	// Step 2: Proactive discovery — fetch PRM to check if upstream needs OAuth.	COMMENT
LOW	internal/mcp/e2e/service_account_test.go	124	// Step 1: First, establish an interactive session to provision upstream tokens.	COMMENT
LOW⚡	internal/mcp/e2e/service_account_test.go	158	// Step 2: Create a service account for the same user in the databroker.	COMMENT
LOW	internal/acceptance/suites/mcp/mcp-client/connect.ts	50	// Step 1: probe — expected to throw UnauthorizedError after the SDK has	COMMENT
LOW⚡	internal/acceptance/suites/mcp/mcp-client/connect.ts	70	// Step 2: browser sign-in.	COMMENT
LOW⚡	internal/acceptance/suites/mcp/mcp-client/connect.ts	76	// Step 3: exchange the code, then reconnect with the stored token.	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	310	// Step 1: Initial SyncLatest returns records k0, k1	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	314	// Step 2: Sync returns k2, then Canceled error	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	319	// Step 3: Canceled doesn't reset serverVersion, so Sync is retried (not SyncLatest)	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	323	// Step 4: Retry Sync, returns k3, k4, k5, then Aborted error	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	328	// Step 5: Aborted resets serverVersion, so SyncLatest is called	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	332	// Step 6: Retry SyncLatest, returns all 6 records	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	336	// Step 7: Sync is called. We need to handle retries to avoid gomock errors.	COMMENT

Verbosity Indicators17 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	internal/mcp/upstream_oauth_setup.go	254	// Step 1: Fetch Protected Resource Metadata (RFC 9728)	COMMENT
LOW⚡	internal/mcp/upstream_oauth_setup.go	292	// Step 2: If PRM succeeded, use PRM → AS metadata flow	COMMENT
LOW⚡	internal/mcp/upstream_oauth_setup.go	297	// Step 3: PRM not available — fall back to direct AS metadata discovery.	COMMENT
LOW	internal/mcp/handler_connect.go	417	// Step 1: Check for pending upstream auth from ext_proc.	COMMENT
LOW	internal/mcp/handler_connect.go	466	// Step 2: Proactive discovery — fetch PRM to check if upstream needs OAuth.	COMMENT
LOW	internal/mcp/e2e/service_account_test.go	124	// Step 1: First, establish an interactive session to provision upstream tokens.	COMMENT
LOW⚡	internal/mcp/e2e/service_account_test.go	158	// Step 2: Create a service account for the same user in the databroker.	COMMENT
LOW	internal/acceptance/suites/mcp/mcp-client/connect.ts	50	// Step 1: probe — expected to throw UnauthorizedError after the SDK has	COMMENT
LOW⚡	internal/acceptance/suites/mcp/mcp-client/connect.ts	70	// Step 2: browser sign-in.	COMMENT
LOW⚡	internal/acceptance/suites/mcp/mcp-client/connect.ts	76	// Step 3: exchange the code, then reconnect with the stored token.	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	310	// Step 1: Initial SyncLatest returns records k0, k1	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	314	// Step 2: Sync returns k2, then Canceled error	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	319	// Step 3: Canceled doesn't reset serverVersion, so Sync is retried (not SyncLatest)	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	323	// Step 4: Retry Sync, returns k3, k4, k5, then Aborted error	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	328	// Step 5: Aborted resets serverVersion, so SyncLatest is called	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	332	// Step 6: Retry SyncLatest, returns all 6 records	COMMENT
LOW⚡	pkg/databrokerutil/syncer_test.go	336	// Step 7: Sync is called. We need to handle retries to avoid gomock errors.	COMMENT

AI Slop Vocabulary7 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	…nfig/testdata/main_http_connection_manager_filter.json	283	"inlineString": "-- This filter interprets the accept header of an incoming request and attempts to map it t	CODE
MEDIUM	internal/acceptance/pomerium/config.yaml	2	# This configuration is designed for use with the acceptance test harness	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	18	# Each e2e harness runs as an INDEPENDENT job (own runner, own stack, own	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	19	# timeout) so they run in parallel and can't break each other. Every harness	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	22	# merges each harness's committed feature-map.json fragment, and renders ONE	COMMENT
MEDIUM⚡	.github/workflows/acceptance.yaml	26	# To add a harness: add a job below that uploads an `e2e-results-<name>`	COMMENT
MEDIUM	pkg/mcp/configapi/sensitive_test.go	727	// Match by proto identity, not Go type — robust to vendored	COMMENT

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	authorize/evaluator/headers_evaluator_evaluation.go	172	if e.request.Policy.LoadBalancingPolicy.Value.ToEnvoy() == envoy_config_cluster_v3.Cluster_RING_HASH \|\|	CODE
CRITICAL	authorize/evaluator/headers_evaluator_evaluation.go	173	e.request.Policy.LoadBalancingPolicy.Value.ToEnvoy() == envoy_config_cluster_v3.Cluster_MAGLEV {	CODE

Hyper-Verbose Identifiers10 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	ui/src/components/UserInfoPage.tsx	30	function handleCloseDeviceEnrolled() {	CODE
LOW	…nal/acceptance/suites/upstream-tls/setup/containers.ts	348	export async function startPomeriumExpectingConfigError(opts: {	CODE
LOW	…eptance/browser/tests/authz/pomerium-endpoints.spec.ts	55	function expectUnauthenticatedDenied(	CODE
LOW	internal/acceptance/browser/helpers/csrf.ts	55	export async function getCSRFTokenFromAuthenticate(page: Page): Promise<string \| null> {	CODE
LOW	internal/acceptance/browser/helpers/csrf.ts	142	export async function verifyOAuthStateContainsCSRF(page: Page): Promise<void> {	CODE
LOW	internal/acceptance/browser/helpers/csrf.ts	177	export function createTamperedCallbackUrl(	CODE
LOW	internal/acceptance/browser/helpers/csrf.ts	199	export function buildLogoutUrlWithoutCSRF(): string {	CODE
LOW	internal/acceptance/browser/helpers/cors.ts	255	export async function verifyCrossOriginRequestWorks(	CODE
LOW	internal/acceptance/browser/helpers/cookies.ts	135	export async function verifySessionCookieSecurity(page: Page): Promise<void> {	CODE
LOW	internal/acceptance/browser/helpers/cookies.ts	177	export async function verifySessionCookieAbsent(page: Page): Promise<void> {	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	internal/rfc7591/rfc7591_types.pb.go	839	// Contains the client metadata as requested by the client.	COMMENT

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/config/route.example.yaml	1	# This file contains only route and policy configuration details. Other	COMMENT
MEDIUM	examples/config/policy.example.yaml	1	# This file contains only policy and route configuration details. Other	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	internal/testenv/values/value.go	127	// Example usage:	COMMENT
LOW	internal/testenv/values/value.go	147	// Example usage:	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	internal/acceptance/scripts/gen-mtls-certs.sh	13	# Check if cert is still valid (not expired)	COMMENT
LOW	internal/acceptance/scripts/gen-certs.sh	13	# Check if cert is still valid (not expired)	COMMENT

pomerium/pomerium

Open-Source Code Quality, Security and Technical Debt Review