AI Slop Code RIsk Monitor

qazbnm456/awesome-web-security

🐶 A curated list of Web Security materials and resources.

8.8 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for qazbnm456/awesome-web-security, a Python project with 13,876 GitHub stars. SynthScan examined 29,734 lines of code across 130 source files, recording 115 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 8.8 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

8.8
Adjusted Signal
8.8
Raw Pattern Score
100%
Time Factor
2026-09-14
Last Push
13.9K
Stars
Python
Language
29.7K
Lines of Code
130
Files
115
Pattern Hits
2026-10-12
Scan Date
0.02
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 6.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 26 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 11 finding(s).

Agent Over-Engineering Ratio 30.5/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 81 finding(s).

PR Review Velocity Impact 36.2/100 · MEDIUM

Which changes need focused human review? 115 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 71LOW 42

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 115 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators58 hits · 183 pts
SeverityFileLineSnippetContext
MEDIUMscripts/generate.py30# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py32# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py163# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py165# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py184# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py186# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py306# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py308# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py346# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/generate.py348# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py31# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py33# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py48# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py50# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py94# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py96# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py192# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py194# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py395# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py397# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py436# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/migrate.py438# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/migrate.py531# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/migrate.py533# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py63# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py65# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py100# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py102# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py176# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py178# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py293# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py295# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/pr_review.py388# ---------------------------------------------------------------------------STRING
MEDIUM⚡scripts/ci/pr_review.py390# ---------------------------------------------------------------------------STRING
MEDIUMscripts/ci/pr_review.py619# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/pr_review.py621# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/triage_dead_links.py382# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/triage_dead_links.py384# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/triage_dead_links.py509# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/triage_dead_links.py511# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py138# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py140# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py335# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py337# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py405# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py407# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py533# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py535# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py556# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py558# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py614# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/triage_dead_links.py616# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/archive.py45# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/archive.py48# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/archive.py120# ---------------------------------------------------------------------------COMMENT
MEDIUMscripts/ci/archive.py122# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/archive.py240# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡scripts/ci/archive.py242# ---------------------------------------------------------------------------COMMENT
Modern AI Meta-Vocabulary12 hits · 26 pts
SeverityFileLineSnippetContext
MEDIUMREADME.md652- [Vigolium](https://github.com/vigolium/vigolium) - High-fidelity vulnerability scanner fusing agentic AI with native sCODE
MEDIUMREADME.md729- [GuardRails](https://github.com/apps/guardrails) - A GitHub App that provides security feedback in Pull Requests.CODE
MEDIUMREADME-jp.md660- [Vigolium](https://github.com/vigolium/vigolium) - High-fidelity vulnerability scanner fusing agentic AI with native sCODE
MEDIUMREADME-jp.md734- [GuardRails](https://github.com/apps/guardrails) - A GitHub App that provides security feedback in Pull Requests.CODE
MEDIUMREADME-zh.md693- [Vigolium](https://github.com/vigolium/vigolium) - High-fidelity vulnerability scanner fusing agentic AI with native sCODE
MEDIUMREADME-zh.md767- [GuardRails](https://github.com/apps/guardrails) - A GitHub App that provides security feedback in Pull Requests.CODE
MEDIUMscripts/ci/check_content_drift.py133# `github.com/apps/guardrails` is a GitHub App listing; treating "apps" as anCOMMENT
MEDIUMskills/awesome-web-security/SKILL.md75## Safety guardrailsCOMMENT
MEDIUMdata/index.json6579 "url": "https://github.com/apps/guardrails",CODE
MEDIUMdata/index.json6594 "archive_url": "https://web.archive.org/web/20260223204744/https://github.com/apps/guardrails",CODE
MEDIUMdata/entries/tools-detecting.yml134 url: "https://github.com/apps/guardrails"CODE
MEDIUMdata/entries/tools-detecting.yml144 archive_url: "https://web.archive.org/web/20260223204744/https://github.com/apps/guardrails"CODE
Excessive Try-Catch Wrapping18 hits · 19 pts
SeverityFileLineSnippetContext
LOWscripts/verify_schema.py106 except Exception as exc:CODE
LOWscripts/ci/check_content_drift.py100 except Exception: # noqa: BLE001CODE
LOWscripts/ci/check_content_drift.py164 except Exception as exc: # noqa: BLE001CODE
LOWscripts/ci/check_content_drift.py179 except Exception as exc: # noqa: BLE001CODE
LOWscripts/ci/check_content_drift.py208 except Exception as exc: # noqa: BLE001CODE
LOWscripts/ci/check_content_drift.py222 except Exception: # noqa: BLE001CODE
LOWscripts/ci/publish_review.py77 except Exception as exc: # noqa: BLE001CODE
LOWscripts/ci/publish_review.py97 except Exception as exc: # noqa: BLE001CODE
LOWscripts/ci/pr_review.py84 except Exception as exc:CODE
LOWscripts/ci/pr_review.py253 except Exception as e2:CODE
LOWscripts/ci/pr_review.py257 except Exception as exc:CODE
LOW⚡scripts/ci/pr_review.py383 except Exception as exc:STRING
LOWscripts/ci/pr_review.py677 except Exception:CODE
MEDIUMscripts/ci/pr_review.py673def pr_body() -> str:CODE
LOW⚡scripts/ci/triage_dead_links.py374 except Exception:CODE
LOWscripts/ci/triage_dead_links.py265 except Exception as exc:CODE
LOWscripts/ci/archive.py174 except Exception as exc: # noqa: BLE001 - reported, then we fall throughCODE
LOW⚡scripts/ci/archive.py235 except Exception as exc:CODE
Unused Imports11 hits · 10 pts
SeverityFileLineSnippetContext
LOWscripts/verify_schema.py6CODE
LOWscripts/generate.py9CODE
LOWscripts/verify_anchors.py15CODE
LOWscripts/migrate.py10CODE
LOWscripts/migrate.py16CODE
LOWscripts/ci/check_content_drift.py31CODE
LOWscripts/ci/publish_review.py23CODE
LOWscripts/ci/pr_review.py25CODE
LOWscripts/ci/port_legacy_pr.py24CODE
LOWscripts/ci/triage_dead_links.py65CODE
LOWscripts/ci/archive.py15CODE
Empty Error Handlers2 hits · 10 pts
SeverityFileLineSnippetContext
HIGHscripts/ci/triage_dead_links.py172except ValueError:CODE
HIGHscripts/ci/triage_dead_links.py204except ImportError:CODE
Deep Nesting10 hits · 9 pts
SeverityFileLineSnippetContext
LOWscripts/verify_schema.py94CODE
LOWscripts/generate.py38CODE
LOWscripts/generate.py83CODE
LOWscripts/migrate.py222CODE
LOWscripts/migrate.py402CODE
LOWscripts/ci/pr_review.py229CODE
LOWscripts/ci/port_legacy_pr.py69CODE
LOWscripts/ci/triage_dead_links.py269CODE
LOWscripts/ci/triage_dead_links.py618CODE
LOWscripts/ci/archive.py199CODE
Hyper-Verbose Identifiers3 hits · 4 pts
SeverityFileLineSnippetContext
LOWscripts/generate.py265def has_descendants_with_entries(sec_key: str, sections: list[dict], entries_by_cat: dict[str, list[dict]], lang: str) -CODE
LOW⚡scripts/migrate.py527def section_has_entries_in_any_lang(key: str, grouped: dict[str, list[Entry]]) -> bool:CODE
LOW⚡scripts/ci/triage_dead_links.py513def fetch_broken_urls_from_issue(issue: str, repo: str) -> list[str]:CODE
Over-Commented Block1 hit · 1 pts
SeverityFileLineSnippetContext
LOW.github/workflows/pr-review-publish.yml61 # from the API, so every fact it validates against comes from oneCOMMENT