A Ruby/Rack web server built for parallelism
This report summarizes scanner evidence for puma/puma, a Ruby project with 7,918 GitHub stars. SynthScan examined 41,948 lines of code across 252 source files, recording 183 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 5.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 168 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 48 finding(s).
Which changes need focused human review? 183 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 183 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/test_request_invalid_multiple.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | test/test_puma_server.rb | 1801 | server_run(early_hints: opts[:early_hints], &app) | COMMENT |
| LOW | test/helpers/integration.rb | 521 | io | COMMENT |
| LOW | test/helpers/test_puma/puma_socket.rb | 21 | # @param timeout [Float, nil] total socket read timeout, defaults to `RESP_READ_TIMEOUT` | COMMENT |
| LOW | test/helpers/test_puma/puma_socket.rb | 41 | # * `port:` - tcp/ssl port (`Integer`, `String`) | COMMENT |
| LOW | ext/puma_http11/mini_ssl.c | 1 | #define RSTRING_NOT_MODIFIED 1 | COMMENT |
| LOW | docs/nginx.md | 41 | COMMENT | |
| LOW | docs/systemd.md | 21 | COMMENT | |
| LOW | docs/systemd.md | 41 | # Also replace the "<YOUR_APP_PATH>" placeholders below with this path. | COMMENT |
| LOW | examples/plugins/redis_stop_puma.rb | 1 | require 'puma/plugin' | COMMENT |
| LOW | benchmarks/local/long_tail_hey.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | benchmarks/local/long_tail_hey.rb | 21 | # | COMMENT |
| LOW | benchmarks/local/long_tail_hey-0-2-4-8.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | benchmarks/local/response_time_wrk.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | benchmarks/local/response_time_wrk.rb | 21 | # | COMMENT |
| LOW | benchmarks/local/bench_base.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/turbo-rails.yml | 61 | DST="if RUBY_PATCHLEVEL == -1\n gem 'rack', git: 'https://github.com/rack/rack', ref: 'main'\nelse\n gem 'ra | COMMENT |
| LOW | lib/puma/minissl.rb | 141 | end | COMMENT |
| LOW | lib/puma/const.rb | 81 | # For some HTTP status codes the client only expects headers. | COMMENT |
| LOW | lib/puma/cluster_accept_loop_delay.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/cluster_accept_loop_delay.rb | 21 | # | COMMENT |
| LOW | lib/puma/cluster_accept_loop_delay.rb | 41 | # (processes), they will "race" to accept a request at roughly the same rate. However, if one | COMMENT |
| LOW | lib/puma/launcher.rb | 21 | # Returns an instance of Launcher | COMMENT |
| LOW | lib/puma/response.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/response.rb | 41 | # | COMMENT |
| LOW | lib/puma/response.rb | 421 | conn = env.fetch(HTTP_CONNECTION, "").downcase | COMMENT |
| LOW | lib/puma/json_serialization.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/client_env.rb | 121 | # avoid allocation in the common case (ie there are no headers | COMMENT |
| LOW | lib/puma/sd_notify.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/sd_notify.rb | 21 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS | COMMENT |
| LOW | lib/puma/sd_notify.rb | 121 | # Generally this method will be used indirectly through the other methods | COMMENT |
| LOW | lib/puma/client.rb | 41 | # on any non-IO objects it polls. For example, nio4r internally calls | COMMENT |
| LOW | lib/puma/commonlogger.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/reactor.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/configuration.rb | 21 | # puts options[:foo] | COMMENT |
| LOW | lib/puma/configuration.rb | 101 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/puma/dsl.rb | 21 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 41 | # parameter. This allows storage of data, typically objects that are created | COMMENT |
| LOW | lib/puma/dsl.rb | 181 | # @example | COMMENT |
| LOW | lib/puma/dsl.rb | 201 | COMMENT | |
| LOW | lib/puma/dsl.rb | 261 | # not overwrite previous bindings. | COMMENT |
| LOW | lib/puma/dsl.rb | 281 | # bind 'ssl://127.0.0.1:9292?key=key.key&cert=cert.pem&ca=ca.pem&verify_mode=force_peer' | COMMENT |
| LOW | lib/puma/dsl.rb | 301 | # Systemd can present sockets as file descriptors that are already opened. | COMMENT |
| LOW | lib/puma/dsl.rb | 321 | end | COMMENT |
| LOW | lib/puma/dsl.rb | 341 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 361 | # If a new request is not received within this number of seconds, begin shutting down. | COMMENT |
| LOW | lib/puma/dsl.rb | 381 | # fiber_per_request | COMMENT |
| LOW | lib/puma/dsl.rb | 401 | end | COMMENT |
| LOW | lib/puma/dsl.rb | 441 | COMMENT | |
| LOW | lib/puma/dsl.rb | 461 | # load Puma itself (i.e. `ruby -Ilib bin/puma`), not the arguments | COMMENT |
| LOW | lib/puma/dsl.rb | 481 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 501 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 521 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 541 | # The default is +nil+. | COMMENT |
| LOW | lib/puma/dsl.rb | 561 | # Redirect +STDOUT+ and +STDERR+ to files specified. The +append+ parameter | COMMENT |
| LOW | lib/puma/dsl.rb | 581 | # end | COMMENT |
| LOW | lib/puma/dsl.rb | 621 | # | COMMENT |
| LOW | lib/puma/dsl.rb | 641 | COMMENT | |
| LOW | lib/puma/dsl.rb | 661 | # | COMMENT |
| 54 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/helper.rb | 320 | # This module is modified based on https://github.com/rails/rails/blob/7-1-stable/activesupport/lib/active_support/testi | COMMENT |
| MEDIUM | test/helpers/test_puma/puma_socket.rb | 24 | # This module is included in CI test files, and provides methods to create | COMMENT |
| MEDIUM | test/helpers/test_puma/puma_socket_include.rb | 14 | # This module contains the methods included in PumaSSLSocket, PumaTCPSocket, | COMMENT |
| MEDIUM | benchmarks/local/long_tail_hey.rb | 9 | # This file is called from `long_tail_hey.sh`. It requires `hey`. | COMMENT |
| MEDIUM | benchmarks/local/response_time_wrk.rb | 8 | # This file is called from `response_time_wrk.sh`. It requires `wrk`. | COMMENT |
| MEDIUM | lib/puma/log_writer.rb | 33 | # Create a LogWriter that prints to +stdout+ and +stderr+. | COMMENT |
| MEDIUM | lib/puma/cli.rb | 24 | # Create a new CLI object using +argv+ as the command line | COMMENT |
| MEDIUM | lib/puma/cluster.rb | 10 | # This class is instantiated by the `Puma::Launcher` and used | COMMENT |
| MEDIUM | lib/puma/client_env.rb | 8 | # This module is included in `Client`. It contains code to process the `env` | COMMENT |
| MEDIUM | lib/puma/single.rb | 8 | # This class is instantiated by the `Puma::Launcher` and used | COMMENT |
| MEDIUM | lib/puma/reactor.rb | 24 | # Create a new Reactor to monitor IO objects added by #add. | COMMENT |
| MEDIUM | lib/puma/dsl.rb | 323 | # Define the TCP port to bind to. Use `bind` for more advanced options. | COMMENT |
| MEDIUM | lib/puma/server.rb | 24 | # This class is used by the `Puma::Single` and `Puma::Cluster` classes | COMMENT |
| MEDIUM | lib/puma/server.rb | 59 | # Create a server for the rack app +app+. | COMMENT |
| MEDIUM | lib/puma/server.rb | 295 | # This method is called from the Reactor thread when a queued Client receives data, | COMMENT |
| MEDIUM | lib/puma/server.rb | 490 | # This method is called from a ThreadPool processor thread. | COMMENT |
| MEDIUM | lib/puma/cluster/worker_handle.rb | 7 | # This class represents a worker process from the perspective of the puma | COMMENT |
| MEDIUM | lib/puma/cluster/worker.rb | 8 | # This class is instantiated by the `Puma::Cluster` and represents a single | COMMENT |
| MEDIUM | lib/puma/launcher/bundle_pruner.rb | 6 | # This class is used to pickup Gemfile changes during | COMMENT |
| MEDIUM | lib/rack/handler/puma.rb | 5 | # This module is used as an 'include' file in code at bottom of file. It loads | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | test/test_request_invalid_multiple.rb | 109 | # ──────────────────────────────────── below are invalid Host header | COMMENT |
| MEDIUM⚡ | test/test_request_invalid_multiple.rb | 119 | # ──────────────────────────────────── below are invalid unescaped path characters | COMMENT |
| MEDIUM⚡ | test/test_request_invalid_multiple.rb | 129 | # ──────────────────────────────────── below are oversize path length | COMMENT |
| MEDIUM | test/test_request_invalid_multiple.rb | 142 | # ──────────────────────────────────── below are invalid Content-Length | COMMENT |
| MEDIUM | test/test_request_invalid_multiple.rb | 155 | # ──────────────────────────────────── below have http_content_length_limit set | COMMENT |
| MEDIUM | benchmarks/local/long_tail_hey.rb | 124 | str << "#{@ka.ljust 28} ──────────────────── Hey Latency ──────────────────── Long Tail\n" \ | CODE |
| MEDIUM | benchmarks/local/bench_base.rb | 413 | # Body ────────── req/sec ────────── ─────── req 50% times ─────── | COMMENT |
| MEDIUM | benchmarks/local/response_time_wrk.rb | 109 | # ───────────────────────────────────────────────────────────────── 1kB | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 24 | # ── Parse the release version from the branch name ────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 46 | # ── Check 1: VERSION in lib/puma/const.rb matches the branch ──────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 61 | # ── Check 2: CODE_NAME is set and not a placeholder ───────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 78 | # ── Check 3: History.md has an entry for this version ─────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 88 | # ── Check 4: History.md entry has a properly-formatted date ───────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 99 | # ── Check 5: Upgrade guide exists for major releases ──────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-checks.yml | 121 | # ── Check 6: SECURITY.md is updated for major releases ────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/test_puma_server_ssl.rb | 306 | def assert_ssl_client_error_match(error, subject: nil, context: CTX, &blk) | CODE |
| LOW | test/test_puma_server_ssl.rb | 528 | def assert_ssl_client_error_match(close_error, log_writer: SSLLogWriterHelper.new(STDOUT, STDERR), &blk) | CODE |
| LOW | test/test_worker_gem_independence.rb | 88 | def change_gem_version_during_phased_restart(old_app_dir:, | CODE |
| LOW | test/test_config.rb | 898 | def assert_raise_on_hooks_without_block(hook_name) | CODE |
| LOW | test/test_config.rb | 905 | def assert_warning_for_hooks_defined_in_single_mode(hook_name) | CODE |
| LOW | test/test_pumactl.rb | 315 | def assert_command_cli_output(options, expected_out) | CODE |
| LOW | test/test_pumactl.rb | 332 | def assert_system_exit_with_cli_output(options, expected_out) | CODE |
| LOW | test/helper.rb | 322 | def assert_called_on_instance_of(klass, method_name, message = nil, times: 1, returns: nil) | CODE |
| LOW | test/helper.rb | 345 | def assert_not_called_on_instance_of(klass, method_name, message = nil, &block) | CODE |
| LOW | test/test_json_serialization.rb | 98 | def assert_puma_json_generates_string(expected_output, value_to_serialize, expected_roundtrip: nil) | CODE |
| LOW | test/test_plugin_systemd.rb | 94 | def assert_restarts_with_systemd(signal, workers: 2) | CODE |
| LOW | test/categories.rb | 40 | def discover_integration_basenames(base = File.dirname(__FILE__)) | CODE |
| LOW | test/test_puma_server_hijack.rb | 187 | def partial_hijack_closes_body(hdrs, body) | CODE |
| LOW | test/test_puma_server.rb | 640 | def test_timeout_in_data_phase(**options) | CODE |
| LOW | test/test_puma_server.rb | 1666 | def test_open_connection_wait(**options) | CODE |
| LOW | test/test_puma_server.rb | 1800 | def assert_does_not_allow_http_injection(app, opts = {}) | CODE |
| LOW | test/test_puma_server.rb | 2004 | def assert_keep_alive_request_closed_during_shutdown(command, buffered) | CODE |
| LOW | test/test_integration_ssl.rb | 79 | def test_verify_client_cert_roundtrip(tls1_2 = nil) | CODE |
| LOW | test/helpers/integration.rb | 137 | def silent_and_checked_system_command(*args) | CODE |
| LOW | test/helpers/integration.rb | 247 | def restart_server_and_listen(argv, env: {}, log: false) | CODE |
| LOW | test/helpers/integration.rb | 271 | def wait_for_server_to_include(str, timeout: nil, log: false) | CODE |
| LOW | test/helpers/integration.rb | 541 | def restart_does_not_drop_connections( | CODE |
| LOW | lib/puma/binder.rb | 120 | def synthesize_binds_from_activated_fs(binds, only_matching) | CODE |
| LOW | lib/puma/server_plugin_control.rb | 28 | def update_thread_pool_min_max(min: max_threads, max: min_threads) | CODE |
| LOW | lib/puma/dsl.rb | 319 | def bind_to_activated_sockets(bind=true) | CODE |
| LOW | lib/puma/dsl.rb | 1183 | def raise_exception_on_sigterm(answer=true) | CODE |
| LOW | lib/puma/dsl.rb | 1201 | def extra_runtime_dependencies(answer = []) | CODE |
| LOW | lib/puma/dsl.rb | 1383 | def wait_for_less_busy_worker(val=0.005) | CODE |
| LOW | lib/puma/dsl.rb | 1565 | def mutate_stdout_and_stderr_to_sync_on_write(enabled=true) | CODE |
| LOW | lib/puma/dsl.rb | 1582 | def http_content_length_limit(limit) | CODE |
| LOW | lib/puma/dsl.rb | 1623 | def add_pem_values_to_options_store(opts) | CODE |
| LOW | lib/puma/runner.rb | 181 | def ensure_output_directory_exists(path, io_name) | CODE |
| LOW | lib/puma/server.rb | 776 | def update_thread_pool_min_max(min: @min_threads, max: @max_threads) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | lib/puma/dsl.rb | 649 | # you can use this method. | COMMENT |