The Prometheus monitoring system and time series database.
This report summarizes scanner evidence for prometheus/prometheus, a Go project with 66,871 GitHub stars. SynthScan examined 526,476 lines of code across 1569 source files, recording 1268 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 2.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 1255 finding(s).
Are imports declared and package/API names verified? 10 finding(s).
Are wrappers, guards, and repeated structures necessary? 14 finding(s).
Which changes need focused human review? 1268 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1268 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/prometheus/reload_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/warnings_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/main_upgrade_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/scrape_failure_log_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/warnings.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/upload_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/query_log_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/features_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/main_unix_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/main.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/prometheus/main_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/rules_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/query.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/backfill_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/unittest.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/metrics.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/analyze_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/metrics_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/rules.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/unittest_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/sd_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/tsdb_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/archive.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/debug.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/backfill.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/tsdb_posix_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/analyze.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/tsdb.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/sd.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/main.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | cmd/promtool/main_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | tracing/tracing_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | tracing/tracing.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | documentation/examples/prometheus-marathon.yml | 21 | # in their app definitions. Example using a port mapping (container or bridge networking): | COMMENT |
| LOW | documentation/examples/prometheus-kubernetes.yml | 1 | # A scrape configuration for running Prometheus on a Kubernetes cluster. | COMMENT |
| LOW | documentation/examples/prometheus-kubernetes.yml | 61 | action: keep | COMMENT |
| LOW | documentation/examples/prometheus-kubernetes.yml | 101 | # retrieve those metrics. | COMMENT |
| LOW | documentation/examples/prometheus-kubernetes.yml | 121 | COMMENT | |
| LOW | documentation/examples/prometheus-kubernetes.yml | 161 | # regex: true | COMMENT |
| LOW | documentation/examples/prometheus-kubernetes.yml | 261 | COMMENT | |
| LOW | documentation/examples/prometheus-kubernetes.yml | 281 | # - source_labels: [__meta_kubernetes_pod_annotation_example_io_metric_path] | COMMENT |
| LOW | documentation/examples/prometheus-dockerswarm.yml | 21 | - source_labels: [__meta_dockerswarm_node_address] | COMMENT |
| LOW | documentation/examples/prometheus-eureka.yml | 21 | # eureka: | COMMENT |
| LOW | documentation/examples/prometheus-eureka.yml | 41 | # Example relabel to customize metric path based on application | COMMENT |
| LOW | documentation/examples/prometheus-eureka.yml | 61 | # | COMMENT |
| LOW | documentation/examples/prometheus-nomad.yml | 1 | # An example scrape configuration for running Prometheus with | COMMENT |
| LOW | …cumentation/examples/custom-sd/adapter/adapter_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | documentation/examples/custom-sd/adapter/adapter.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | documentation/examples/custom-sd/adapter-usage/main.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …xamples/remote_storage/example_write_adapter/server.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …examples/remote_storage/remote_storage_adapter/main.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …mote_storage/remote_storage_adapter/influxdb/client.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …storage/remote_storage_adapter/influxdb/client_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …orage/remote_storage_adapter/opentsdb/tagvalue_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …mote_storage/remote_storage_adapter/opentsdb/client.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …te_storage/remote_storage_adapter/opentsdb/tagvalue.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …te_storage/remote_storage_adapter/opentsdb/tagvalue.go | 21 | ) | COMMENT |
| LOW | …te_storage/remote_storage_adapter/opentsdb/tagvalue.go | 41 | // - If ':' is encountered, it is replaced by '_.'. | COMMENT |
| LOW | …storage/remote_storage_adapter/opentsdb/client_test.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| LOW | …mote_storage/remote_storage_adapter/graphite/escape.go | 1 | // Copyright The Prometheus Authors | COMMENT |
| 1139 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/prometheus/scrape_failure_log_test.go | 56 | // Step 1: Set up an initial Prometheus configuration that globally | COMMENT |
| LOW | cmd/prometheus/scrape_failure_log_test.go | 99 | // Step 2: Update the Prometheus configuration to remove the scrape failure | COMMENT |
| LOW | cmd/prometheus/scrape_failure_log_test.go | 133 | // Step 3: Re-add the scrape failure log file setting, but this time under | COMMENT |
| LOW⚡ | tsdb/head_append_v2_test.go | 4928 | // Step 1: Establish a series with histogram data | COMMENT |
| LOW⚡ | tsdb/head_append_v2_test.go | 4934 | // Step 2: Add a float staleness marker with a start timestamp. It is | COMMENT |
| LOW | tsdb/head_test.go | 5477 | // Step 1: Create a batch of series and make them stale. | COMMENT |
| LOW | tsdb/head_test.go | 5489 | // Step 2: Truncate stale series. This removes them from the Head and | COMMENT |
| LOW | tsdb/head_test.go | 5501 | // Step 3: Add new series AFTER the truncation. In the WAL, these series | COMMENT |
| LOW | tsdb/head_test.go | 5514 | // Step 4: Close and re-open the Head to trigger WAL replay. | COMMENT |
| LOW | tsdb/chunks/head_chunks.go | 835 | // NOTE: This method needs to be called at least once after creating ChunkDiskMapper | COMMENT |
| LOW | config/config.go | 397 | // NOTE: This method should not be used outside of this package. Use Load or LoadFile instead. | COMMENT |
| LOW | docs/configuration/configuration.md | 294 | # WARNING: The "NoTranslation" setting has significant known risks and limitations (see https://prometheus.io/docs/p | COMMENT |
| LOW | promql/parser/lex.go | 796 | // NOTE: This function as well as the helper function digitVal() and associated | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tsdb/ooo_head_read.go | 539 | ir.ch.head.metrics.seriesNotFound.Inc() | CODE |
| CRITICAL | tsdb/ooo_head_read.go | 552 | getOOOSeriesChunks(s, ir.ch.head.opts.UseXOR2FloatEncoding(), ir.ch.head.opts.EnableHistogramSTEncoding.Load(), ir.ch.m | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | prompb/io/prometheus/client/decoder.go | 33 | // We leverage the fact those two don't collide. | COMMENT |
| MEDIUM | tsdb/head_test.go | 5725 | // than waiting a fixed amount of time: faster in the common case, and robust | COMMENT |
| MEDIUM | tsdb/fileutil/direct_io_force.go | 14 | // This allows seamless testing of the Direct I/O writer across all tsdb tests. | COMMENT |
| MEDIUM | web/api/v1/search_test.go | 1479 | // No line should decode as a success trailer. This is robust to a | COMMENT |
| MEDIUM | scrape/st_synthesis.go | 47 | // to leverage native DetectReset and Sub methods. | COMMENT |
| MEDIUM | promql/functions.go | 756 | // extrapolationThreshold below. Essentially, we are assuming a more or | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/prometheus/scrape_failure_log_test.go | 56 | // Step 1: Set up an initial Prometheus configuration that globally | COMMENT |
| LOW | cmd/prometheus/scrape_failure_log_test.go | 99 | // Step 2: Update the Prometheus configuration to remove the scrape failure | COMMENT |
| LOW | cmd/prometheus/scrape_failure_log_test.go | 133 | // Step 3: Re-add the scrape failure log file setting, but this time under | COMMENT |
| LOW⚡ | tsdb/head_append_v2_test.go | 4928 | // Step 1: Establish a series with histogram data | COMMENT |
| LOW⚡ | tsdb/head_append_v2_test.go | 4934 | // Step 2: Add a float staleness marker with a start timestamp. It is | COMMENT |
| LOW | tsdb/head_test.go | 5477 | // Step 1: Create a batch of series and make them stale. | COMMENT |
| LOW | tsdb/head_test.go | 5489 | // Step 2: Truncate stale series. This removes them from the Head and | COMMENT |
| LOW | tsdb/head_test.go | 5501 | // Step 3: Add new series AFTER the truncation. In the WAL, these series | COMMENT |
| LOW | tsdb/head_test.go | 5514 | // Step 4: Close and re-open the Head to trigger WAL replay. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | documentation/examples/prometheus-dockerswarm.yml | 10 | # Create a job for Docker daemons. | COMMENT |
| MEDIUM | documentation/examples/prometheus-dockerswarm.yml | 25 | # Create a job for Docker Swarm containers. | COMMENT |
| MEDIUM | documentation/examples/prometheus-docker.yml | 9 | # Create a job for Docker daemon. | COMMENT |
| MEDIUM | documentation/examples/prometheus-docker.yml | 18 | # Create a job for Docker Swarm containers. | COMMENT |
| MEDIUM | scripts/dependabot.yml | 2 | # This file is synced from https://github.com/prometheus/prometheus | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/ui/react-app/src/pages/graph/HistogramHelpers.ts | 5 | export function calculateDefaultExpBucketWidth( | CODE |
| LOW | …/ui/mantine-ui/src/pages/AlertmanagerDiscoveryPage.tsx | 12 | export default function AlertmanagerDiscoveryPage() { | CODE |
| LOW | web/ui/mantine-ui/src/pages/query/HistogramHelpers.ts | 3 | export function calculateDefaultExpBucketWidth( | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 154 | function getMetricNameInVectorSelector(tree: SyntaxNode, state: EditorState): string { | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 191 | function isAfterClosedFunctionCallBody(state: EditorState, node: SyntaxNode, pos: number): boolean { | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 218 | export function computeEndCompletePosition(state: EditorState, node: SyntaxNode, pos: number): number { | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 263 | function isDurationFunctionFragment(state: EditorState, node: SyntaxNode): boolean { | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 272 | function computeStartCompleteLabelPositionInLabelMatcherOrInGroupingLabel(node: SyntaxNode, pos: number): number { | CODE |
| LOW | web/ui/module/codemirror-promql/src/complete/hybrid.ts | 290 | export function computeStartCompletePosition(state: EditorState, node: SyntaxNode, pos: number): number { | CODE |
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 230 | def build_repo_ownership_model(owner, repo): | CODE |
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 411 | def has_author_ci_explanation(author_comments_after_commit): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/prometheus/main.go | 1324 | // Don't forget to release the reloadReady channel so that waiting blocks can exit normally. | COMMENT |
| MEDIUM | documentation/examples/prometheus-eureka.yml | 19 | # If you are using SpringBoot, you can add metadata using eureka.instance.metadataMap like this: | COMMENT |
| LOW | .github/ISSUE_TEMPLATE/bug_report.yml | 52 | description: Insert relevant configuration here. Don't forget to remove secrets. | CODE |
| LOW | .github/ISSUE_TEMPLATE/bug_report.yml | 68 | description: Insert relevant configuration here. Don't forget to remove secrets. | CODE |
| MEDIUM | model/textparse/benchmark_test.go | 44 | // For local iteration, feel free to adjust cases/comment out code etc. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | util/annotations/annotations_test.go | 47 | warnings, infos := annos.AsStrings("lorem ipsum dolor sit amet", 0, 0) | CODE |
| LOW | util/annotations/annotations_test.go | 47 | warnings, infos := annos.AsStrings("lorem ipsum dolor sit amet", 0, 0) | CODE |
| LOW | web/ui/mantine-ui/src/promql/ast.ts | 12 | placeholder = "placeholder", | CODE |
| LOW | discovery/oci/oci_test.go | 204 | "CreatedBy": "user@example.com", | CODE |
| LOW | discovery/oci/oci_test.go | 217 | require.Equal(t, model.LabelValue("user@example.com"), labels[ociLabelDefinedTagPrefix+"Oracle_Tags_CreatedBy"]) | CODE |
| LOW | discovery/consul/consul_test.go | 272 | Token: "fake-token", | CODE |
| LOW | discovery/consul/consul_test.go | 367 | config.Token = "fake-token" | CODE |
| LOW | discovery/consul/consul_test.go | 588 | Token: "fake-token", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …kills/pr-triage-board/scripts/generate_triage_board.py | 141 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 146 | CODE | |
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 196 | CODE | |
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 273 | CODE | |
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 418 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …kills/pr-triage-board/scripts/generate_triage_board.py | 141 | except Exception: | STRING |
| MEDIUM | …kills/pr-triage-board/scripts/generate_triage_board.py | 912 | print("Error: 0 PRs fetched from GitHub GraphQL API; aborting to avoid overwriting with empty board.", file=sys. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/api/v1/openapi_test.go | 185 | // TODO: Add test to verify all routes from api.go Register() are covered in OpenAPI spec. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/api/testhelpers/request.go | 30 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync_repo_files.sh | 348 | # Check if a PR is already opened for the branch from the prombot fork. | COMMENT |