Cloud-native OSS search engine for observability
This report summarizes scanner evidence for quickwit-oss/quickwit, a Rust project with 11,754 GitHub stars. SynthScan examined 363,738 lines of code across 1176 source files, recording 1225 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 3.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 1200 finding(s).
Are imports declared and package/API names verified? 7 finding(s).
Are wrappers, guards, and repeated structures necessary? 22 finding(s).
Which changes need focused human review? 1225 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1225 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 121 | # semverParseInto and semverLT from https://github.com/cloudflare/semver_bash/blob/master/semver.sh | COMMENT |
| LOW | docker-compose.yml | 1 | # By default, this docker compose script maps all services to localhost only. | COMMENT |
| LOW | config/quickwit.yaml | 1 | # ============================ Node Configuration ============================== | COMMENT |
| LOW | config/quickwit.yaml | 21 | # - for its Gossip cluster membership service (UDP) | COMMENT |
| LOW | config/quickwit.yaml | 41 | # x-header-1: header-value-1 | COMMENT |
| LOW | config/quickwit.yaml | 61 | # `/health/startupz` (plus `/health/readyz`, a deprecated alias for `startupz`), letting liveness | COMMENT |
| LOW | config/quickwit.yaml | 81 | # expected_name: quickwit.local | COMMENT |
| LOW | config/quickwit.yaml | 101 | # By default, the peer seed list is empty. | COMMENT |
| LOW | config/quickwit.yaml | 121 | # serve stale-tolerant read-only metastore requests. Searchers use those nodes | COMMENT |
| LOW | config/quickwit.yaml | 141 | # discouraged. Prefer the alternative authentication methods that your storage | COMMENT |
| LOW | config/quickwit.yaml | 161 | # metastore: | COMMENT |
| LOW | config/quickwit.yaml | 181 | # | COMMENT |
| LOW | config/quickwit.yaml | 201 | # use_metastore_read_replica: false | COMMENT |
| LOW | distribution/ecs/example/kafka.tf | 1 | # Example configuration for injecting SSL keys for securing a Kafka connection | COMMENT |
| LOW | distribution/ecs/example/terraform.tf | 41 | # desired_count = 3 | COMMENT |
| LOW | distribution/ecs/example/terraform.tf | 61 | # memory = 512 | COMMENT |
| LOW | quickwit/Cargo.toml | 401 | ## this patched version of tracing helps better understand what happens inside futures (when are | COMMENT |
| LOW | quickwit/deny.toml | 1 | # This template contains all of the possible sections and their default values | COMMENT |
| LOW | quickwit/deny.toml | 21 | targets = [ | COMMENT |
| LOW | quickwit/deny.toml | 81 | COMMENT | |
| LOW | quickwit/deny.toml | 101 | COMMENT | |
| LOW | quickwit/deny.toml | 121 | # The graph highlighting used when creating dotgraphs for crates | COMMENT |
| LOW | quickwit/deny.toml | 141 | # Certain crates/versions that will be skipped when doing duplicate detection. | COMMENT |
| LOW | quickwit/dependency-licenses.html | 12721 | // MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR | COMMENT |
| LOW | quickwit/diesel-guard.toml | 1 | # diesel-guard: lint dangerous Postgres migration patterns. | COMMENT |
| LOW | quickwit/.license_header.txt | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/playwright.config.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/e2e/homepage.spec.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/index.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/index.test.js | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/providers/EditorProvider.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …wit/quickwit-ui/src/providers/LocalStorageProvider.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/utils/urls.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/utils/theme.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/utils/models.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/utils/SearchComponentProps.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/IndexesTable.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/LayoutUtils.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …it/quickwit-ui/src/components/ResponseErrorDisplay.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/Loader.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/TopBar.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/IndexSideBar.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/IndexSummary.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/SideBar.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/JsonEditor.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/ApiUrlFooter.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/TimeRangeSelect.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/components/QueryActionBar.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …quickwit-ui/src/components/QueryEditor/QueryEditor.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …it-ui/src/components/QueryEditor/AggregationEditor.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …ckwit/quickwit-ui/src/components/QueryEditor/config.ts | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …t-ui/src/components/SearchResult/AggregationResult.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …ickwit-ui/src/components/SearchResult/SearchResult.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …ickwit/quickwit-ui/src/components/SearchResult/Row.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | …uickwit-ui/src/components/SearchResult/ResultTable.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/views/App.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/views/IndexView.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/views/ClusterView.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/views/IndexesView.tsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| LOW | quickwit/quickwit-ui/src/views/ClusterView.test.jsx | 1 | // Copyright 2021-Present Datadog, Inc. | COMMENT |
| 1073 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 11 | ## Step 1: Check that we are on the main branch | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 17 | ## Step 2: Ensure main is up to date | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 23 | ## Step 3: Get the latest tantivy SHA | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 29 | ## Step 4: Update Cargo.toml | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 38 | ## Step 5: Run cargo check and fix compilation errors | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 48 | ## Step 6: Format code | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 52 | ## Step 7: Update licenses | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 59 | ## Step 8: Create a new branch | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 69 | ## Step 9: Commit changes | COMMENT |
| LOW⚡ | .claude/skills/bump-tantivy/SKILL.md | 76 | ## Step 10: Push and open a PR | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 11 | ## Step 1: Check workspace state | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 19 | ## Step 2: Ensure main is up to date | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 25 | ## Step 3: Review staged changes | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 31 | ## Step 4: Generate commit message | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 37 | ## Step 5: Create a new branch | COMMENT |
| LOW⚡ | .claude/skills/simple-pr/SKILL.md | 45 | ## Step 6: Run pre-PR checks | COMMENT |
| LOW | .claude/skills/simple-pr/SKILL.md | 68 | ## Step 7: Commit changes | COMMENT |
| LOW | .claude/skills/simple-pr/SKILL.md | 75 | ## Step 8: Push and open a PR | COMMENT |
| LOW⚡ | .claude/skills/rationalize-deps/SKILL.md | 18 | ## Step 1: Identify the target | COMMENT |
| LOW⚡ | .claude/skills/rationalize-deps/SKILL.md | 25 | ## Step 2: Analyze current dependencies | COMMENT |
| LOW⚡ | .claude/skills/rationalize-deps/SKILL.md | 33 | ## Step 3: For each candidate dependency | COMMENT |
| LOW | .claude/skills/rationalize-deps/SKILL.md | 76 | ## Step 4: Document findings | COMMENT |
| LOW | .claude/skills/rationalize-deps/SKILL.md | 84 | ## Step 5: Verify full build | COMMENT |
| LOW | .claude/skills/fix-clippy/SKILL.md | 10 | ## Step 1: Auto-fix | COMMENT |
| LOW | .claude/skills/fix-clippy/SKILL.md | 18 | ## Step 2: Fix remaining warnings manually | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 13 | ## Step 1: Verify we are on main | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 19 | ## Step 2: Pull latest main | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 25 | ## Step 3: Get the commit short hash | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 32 | ## Step 4: Check the tag does not already exist | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 42 | ## Step 5: Push the tag to trigger the workflow | COMMENT |
| LOW | .claude/skills/update-lambda/SKILL.md | 54 | ## Step 6: Wait for the workflow run to complete | COMMENT |
| LOW | .claude/skills/update-lambda/SKILL.md | 73 | ## Step 7: Fetch the draft release asset info | COMMENT |
| LOW | .claude/skills/update-lambda/SKILL.md | 90 | ## Step 8: Publish the draft release | COMMENT |
| LOW | .claude/skills/update-lambda/SKILL.md | 101 | ## Step 9: Update build.rs | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 112 | ## Step 10: Create a working branch | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 121 | ## Step 11: Commit the changes | COMMENT |
| LOW⚡ | .claude/skills/update-lambda/SKILL.md | 129 | ## Step 12: Push and open a PR | COMMENT |
| LOW | docs/get-started/tutorials/prometheus-metrics.md | 11 | ## Step 1: Create a Docker Compose File | COMMENT |
| LOW | docs/get-started/tutorials/prometheus-metrics.md | 46 | ## Step 2: Configure Prometheus | COMMENT |
| LOW⚡ | docs/get-started/tutorials/prometheus-metrics.md | 63 | ## Step 3: Start the Services | COMMENT |
| LOW⚡ | docs/get-started/tutorials/prometheus-metrics.md | 73 | ## Step 4: Configure Grafana to Use Prometheus | COMMENT |
| LOW⚡ | docs/get-started/tutorials/prometheus-metrics.md | 80 | ## Step 5: Create or Use Pre-Configured Dashboards | COMMENT |
| LOW | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1368 | // Step 1: Create index and ingest to seed the routing table. | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1388 | // Step 2: Delete the index. | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1396 | // Step 3: Wait for 2+ broadcast cycles (50ms each with testsuite feature) so that | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1400 | // Step 4: Recreate with the same name — new incarnation. | COMMENT |
| LOW | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1413 | // Step 5: Ingest into the recreated index. If stale routing entries weren't | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 120 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | install.sh | 126 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | install.sh | 237 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | install.sh | 240 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 187 | //! ──────────────────────│───────────────────────│────────────────────── | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 189 | //! ┌─ call 1 ───────────┐│ │ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 192 | //! └───────┬────────────┘│ │ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 198 | //! │ hash ──────> L2 lookup: miss │ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 206 | //! │ <─ Arc::clone ─────┘ │ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 213 | //! │ │ │ ┌─ call 2 ───────────┐ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 216 | //! │ │ │ └───────┬────────────┘ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 222 | //! │ │ L2 lookup: hit <──── hash ──────┘ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 224 | //! │ │ Arc::clone ──────────> | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 231 | //! ┌─ call 3 ───────────┐│ │ │ | COMMENT |
| MEDIUM⚡ | quickwit/quickwit-metrics/src/lib.rs | 234 | //! └───────┬────────────┘│ │ │ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1368 | // Step 1: Create index and ingest to seed the routing table. | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1388 | // Step 2: Delete the index. | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1396 | // Step 3: Wait for 2+ broadcast cycles (50ms each with testsuite feature) so that | COMMENT |
| LOW⚡ | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1400 | // Step 4: Recreate with the same name — new incarnation. | COMMENT |
| LOW | …uickwit-integration-tests/src/tests/ingest_v2_tests.rs | 1413 | // Step 5: Ingest into the recreated index. If stale routing entries weren't | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | distribution/ecs/example/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | quickwit/clippy.toml | 2 | # This function is not sound because it does not return a Result | COMMENT |
| MEDIUM | …i-tests/scenarii/es_compatibility/_setup.quickwit.yaml | 82 | # Create a dedicated index with a root fast-only field | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | quickwit/quickwit-common/src/tower/circuit_breaker.rs | 39 | /// to fail. In this implementation, we use a simple heuristic that does not take in account | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | quickwit/rest-api-tests/run_tests.py | 375 | except: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/quickwit-ui/src/utils/models.ts | 131 | export function extractAggregationResults( | CODE |
| LOW | quickwit/quickwit-ui/src/components/TimeRangeSelect.tsx | 342 | function convertTimestampSecsIntoDateUtc(timestamp_secs: number): Dayjs { | CODE |
| LOW | quickwit/quickwit-ui/src/views/SearchView.tsx | 43 | function updateSearchRequestWithIndex( | CODE |
| LOW | quickwit/rest-api-tests/run_tests.py | 273 | def run_setup_teardown_scripts(self, script_name, path): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/quickwit-search/src/leaf.rs | 3043 | qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non \ | CODE |
| LOW | quickwit/quickwit-search/src/leaf.rs | 3043 | qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non \ | CODE |
| LOW | .github/workflows/coverage.yml | 15 | AWS_ACCESS_KEY_ID: "placeholder" | CODE |
| LOW | .github/workflows/coverage.yml | 16 | AWS_SECRET_ACCESS_KEY: "placeholder" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …fig/tutorials/stackoverflow/send_messages_to_pulsar.py | 1 | CODE | |
| LOW | quickwit/rest-api-tests/run_tests.py | 5 | CODE | |
| LOW | quickwit/rest-api-tests/run_tests.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | quickwit/quickwit-common/src/tower/circuit_breaker.rs | 44 | /// This approach is accurate enough, robust, very easy to code and avoids calling the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/quickwit-metrics-inventory/scripts/run.sh | 9 | # Usage: | COMMENT |
| LOW | quickwit/quickwit-metrics-inventory/scripts/check.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/rest-api-tests/run_tests.py | 155 | except Exception as e: | CODE |
| LOW | quickwit/rest-api-tests/run_tests.py | 317 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/rest-api-tests/run_tests.py | 181 | CODE | |
| LOW | quickwit/scripts/inspect_split.py | 30 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/quickwit-search/src/cluster_client.rs | 142 | // TODO: implement retry | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | quickwit/rest-api-tests/run_tests.py | 206 | # Check if the length differs by more than five | COMMENT |