This report summarizes scanner evidence for raspberrypi/pico-sdk, a C project with 4,988 GitHub stars. SynthScan examined 312,849 lines of code across 979 source files, recording 9357 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 20.2 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 9321 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 40 finding(s).
Which changes need focused human review? 9357 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 9357 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build_all_headers.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/check_all_groups.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/CMakeLists.txt | 361 | # | COMMENT |
| LOW | tools/CMakeLists.txt | 421 | # \brief\ Set the UF2 family to use when creating the UF2. | COMMENT |
| LOW | tools/CMakeLists.txt | 481 | # \brief_nodesc\ Embed a partition table in the binary | COMMENT |
| LOW | tools/CMakeLists.txt | 501 | # and sign the encrypted binary. | COMMENT |
| LOW | tools/check_source_files_in_bazel_build.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/compare_build_systems.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/check_board_header.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/extract_cmake_functions.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/check_doxygen_groups.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/extract_cmake_configs.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/extract_build_defines.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/extract_configs.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/pioasm/pio_enums.h | 21 | #endif | COMMENT |
| LOW | tools/pioasm/pio_types.h | 1 | /* | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 1 | // A Bison parser, made by GNU Bison 3.7.2. | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 21 | // part or all of the Bison parser skeleton and distribute that work | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 41 | // DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual, | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 61 | # include <cstdlib> // std::abort | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 81 | # define YY_MOVE | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 101 | # define YY_CONSTEXPR | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 121 | # define YY_ATTRIBUTE_UNUSED __attribute__ ((__unused__)) | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 141 | _Pragma ("GCC diagnostic pop") | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 161 | # define YY_IGNORE_USELESS_CAST_BEGIN | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 421 | // value | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 2841 | const symbol_type& yyla_; | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 2901 | // Tables. | COMMENT |
| LOW | tools/pioasm/gen/parser.hpp | 3141 | stack_type yystack_; | COMMENT |
| LOW | tools/pioasm/gen/lexer.cpp | 861 | * | COMMENT |
| LOW | tools/pioasm/gen/location.h | 1 | // A Bison parser, made by GNU Bison 3.7.2. | COMMENT |
| LOW | tools/pioasm/gen/location.h | 21 | // part or all of the Bison parser skeleton and distribute that work | COMMENT |
| LOW | tools/pioasm/gen/location.h | 41 | # include <iostream> | COMMENT |
| LOW | tools/pioasm/gen/parser.cpp | 1 | // A Bison parser, made by GNU Bison 3.7.2. | COMMENT |
| LOW | tools/pioasm/gen/parser.cpp | 21 | // part or all of the Bison parser skeleton and distribute that work | COMMENT |
| LOW | tools/pioasm/gen/parser.cpp | 41 | #include "parser.hpp" | COMMENT |
| LOW | tools/pioasm/gen/parser.cpp | 61 | # define YY_(msgid) msgid | COMMENT |
| LOW | tools/pioasm/gen/parser.cpp | 121 | yy_stack_print_ (); \ | COMMENT |
| LOW | test/CMakeLists.txt | 41 | # This can use the following extra target properties from the test targets: | COMMENT |
| LOW | test/pico_low_power_test/low_power_test_common.h | 1 | #ifndef LOW_POWER_TEST_COMMON_H | COMMENT |
| LOW | test/pico_low_power_test/low_power_test_common.h | 41 | #endif | COMMENT |
| LOW | test/pico_low_power_test/external_sleep_timer.c | 1 | /** | COMMENT |
| LOW | …are_sync_spin_lock_test/hardware_sync_spin_lock_test.c | 201 | // | COMMENT |
| LOW | …are_sync_spin_lock_test/hardware_sync_spin_lock_test.c | 301 | // remote traffic, not contention), then flags and SEVs as a backstop. If core 0's __wfe() | COMMENT |
| LOW | test/pico_time_test/pico_time_test.c | 1 | /** | COMMENT |
| LOW | test/pico_time_test/pico_time_test.c | 21 | // Include sys/types.h before inttypes.h to work around issue with | COMMENT |
| LOW | …ico_unaligned_string_test/pico_unaligned_string_test.c | 1 | /* | COMMENT |
| LOW | …ico_unaligned_string_test/pico_unaligned_string_test.c | 21 | // * the RISC-V specific routines in newlib/libc/machine/riscv test | COMMENT |
| LOW | test/pico_float_test/pico_float_test.c | 1 | //===-- aeabi_cfcmpeq.c - Test __aeabi_cfcmpeq ----------------------------===// | COMMENT |
| LOW | test/pico_float_test/pico_float_test.c | 21 | // certain versions of GCC and newlib which causes omission of PRIx64 | COMMENT |
| LOW | test/pico_float_test/pico_float_test.c | 341 | #define allowed_range(a) (fabsf(a) / FRAC) | COMMENT |
| LOW | test/pico_float_test/pico_float_test.c | 361 | #endif | COMMENT |
| LOW | test/pico_float_test/double_benchmark.c | 1 | #include <stdio.h> | COMMENT |
| LOW | test/pico_float_test/double_benchmark.c | 161 | #else | COMMENT |
| LOW | test/pico_float_test/custom_float_funcs_test.c | 1 | #include <stdio.h> | COMMENT |
| LOW | test/pico_float_test/pico_double_test.c | 1 | //===-- aeabi_cdcmpeq.c - Test __aeabi_cdcmpeq ----------------------------===// | COMMENT |
| LOW | test/pico_float_test/pico_double_test.c | 321 | double __real_pow(double, double); | COMMENT |
| LOW | test/pico_float_test/custom_double_funcs_test.c | 1 | #include <stdio.h> | COMMENT |
| LOW | test/pico_float_test/float_benchmark.c | 1 | #include <stdio.h> | COMMENT |
| LOW | test/pico_float_test/float_benchmark.c | 161 | #else | COMMENT |
| 9217 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/check_extern_c_guards.py | 58 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 88 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 202 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 204 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 254 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 256 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 289 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 291 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 363 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/check_extern_c_guards.py | 365 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/check_board_header.py | 296 | except ValueError: | CODE |
| HIGH | tools/check_board_header.py | 318 | except ValueError: | CODE |
| HIGH | tools/check_board_header.py | 387 | except ValueError: | CODE |
| HIGH | tools/check_board_header.py | 215 | except ValueError: | CODE |
| HIGH | tools/run_test_matrix.py | 202 | except: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/copro_dis.py | 38 | CODE | |
| LOW | tools/check_float_test_names.py | 156 | CODE | |
| LOW | tools/check_float_test_names.py | 178 | CODE | |
| LOW | tools/check_float_test_names.py | 249 | CODE | |
| LOW | tools/check_extern_c_guards.py | 120 | CODE | |
| LOW | tools/check_extern_c_guards.py | 440 | CODE | |
| LOW | tools/compare_build_systems.py | 214 | CODE | |
| LOW | tools/compare_build_systems.py | 244 | CODE | |
| LOW | tools/memmap_include_tree.py | 233 | CODE | |
| LOW | tools/check_board_header.py | 94 | CODE | |
| LOW | tools/extract_cmake_functions.py | 103 | CODE | |
| LOW | tools/extract_cmake_functions.py | 152 | CODE | |
| LOW | tools/extract_cmake_configs.py | 71 | CODE | |
| LOW | tools/extract_build_defines.py | 69 | CODE | |
| LOW | tools/run_test_matrix.py | 80 | CODE | |
| LOW | tools/extract_configs.py | 76 | CODE | |
| LOW | tools/extract_configs.py | 102 | CODE | |
| LOW | src/rp2_common/pico_lwip/tools/makefsdata.py | 88 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build_all_headers.py | 12 | # Usage: | COMMENT |
| LOW | tools/check_all_groups.py | 11 | # Usage: | COMMENT |
| LOW | tools/check_source_files_in_bazel_build.py | 11 | # Usage: | COMMENT |
| LOW | tools/compare_build_systems.py | 11 | # Usage: | COMMENT |
| LOW | tools/check_board_header.py | 10 | # Usage: | COMMENT |
| LOW | tools/extract_cmake_functions.py | 12 | # Usage: | COMMENT |
| LOW | tools/check_doxygen_groups.py | 10 | # Usage: | COMMENT |
| LOW | tools/extract_cmake_configs.py | 12 | # Usage: | COMMENT |
| LOW | tools/extract_build_defines.py | 12 | # Usage: | COMMENT |
| LOW | tools/extract_configs.py | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/check_all_groups.py | 45 | def get_group_from_config_attrs(attr_str): | CODE |
| LOW | tools/check_source_files_in_bazel_build.py | 93 | def check_bazel_build_for_files( | CODE |
| LOW | tools/check_source_files_in_bazel_build.py | 151 | def git_ls_files_by_extension(file_suffixes: Iterable[str]) -> Iterable[Path]: | CODE |
| LOW | tools/check_source_files_in_bazel_build.py | 173 | def check_sources_in_bazel_build(picotool_dir) -> int: | CODE |
| LOW | tools/memmap_include_tree.py | 74 | def _indent_default_excludes_body(text: str) -> str: | CODE |
| LOW | tools/memmap_include_tree.py | 143 | def validate_explicit_platform(sdk_root: Path, platform: str) -> str | None: | CODE |
| LOW | tools/memmap_include_tree.py | 300 | def fold_docstring_for_argparse(doc: str) -> str: | CODE |
| LOW | tools/memmap_include_tree.py | 310 | def collect_unresolved_include_paths( | CODE |
| LOW | tools/memmap_include_tree.py | 323 | def format_memmap_annotate_status_line(tag: str, msg: str) -> str: | CODE |
| LOW | tools/extract_cmake_configs.py | 241 | def build_mismatch_exception_message(name, thing, config_obj1, value1, config_obj2, value2): | CODE |
| LOW | tools/extract_build_defines.py | 238 | def build_mismatch_exception_message(name, thing, config_obj1, value1, config_obj2, value2): | CODE |
| LOW | tools/extract_configs.py | 348 | def build_mismatch_exception_message(name, thing, config_obj1, value1, config_obj2, value2): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/check_extern_c_guards.py | 138 | except Exception as exc: | CODE |
| LOW | tools/check_extern_c_guards.py | 184 | except Exception as exc: | CODE |
| MEDIUM | tools/check_extern_c_guards.py | 270 | print("Error: not inside a git repository.", file=sys.stderr) | CODE |
| LOW | tools/run_test_matrix.py | 197 | except Exception as e: | CODE |
| LOW | tools/run_test_matrix.py | 226 | except Exception as e: | CODE |
| MEDIUM | tools/run_test_matrix.py | 227 | print(f"Error reading output file: {e}") | CODE |
| LOW | tools/run_test_matrix.py | 240 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/memmap_annotate.py | 22 | CODE | |
| LOW | tools/memmap_include_tree.py | 25 | CODE | |
| LOW | tools/bazel_buildifier_lint_check.py | 12 | CODE | |
| LOW | tools/bazel_buildifier_lint_check.py | 13 | CODE | |
| LOW | tools/bazel_buildifier_lint_check.py | 17 | CODE | |
| LOW | tools/bazel_build.py | 9 | CODE | |
| LOW | tools/bazel_build.py | 13 | CODE | |
| LOW | …ithub/workflows/scripts/generate_multi_gcc_workflow.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/rp2350/hardware_regs/include/hardware/regs/rp_ap.h | 650 | // manager and the switched-core. Essentially that is everythjing | COMMENT |
| MEDIUM | src/rp2_common/pico_stdlib/stdlib.c | 18 | // this is mostly for backwards compatibility - stdio_uart_init is a bit more nuanced, and usually likely to be pres | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/extract_cmake_functions.py | 32 | logger = logging.getLogger(__name__) | CODE |
| LOW | tools/extract_cmake_configs.py | 34 | logger = logging.getLogger(__name__) | CODE |
| LOW | tools/extract_build_defines.py | 34 | logger = logging.getLogger(__name__) | CODE |
| LOW | tools/extract_configs.py | 34 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/rp2_common/pico_multicore/multicore.c | 200 | // entry is the initial program counter (PC) (don't forget to set the thumb bit!) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/rp2_common/pico_bootrom/include/pico/bootrom.h | 76 | // NOTE: This function does not validate the buffer for NS access. This must be validated before | COMMENT |