1.3

Adjusted Signal

1.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

4.1K

Stars

Language

1.3M

Lines of Code

2.9K

Files

1.8K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1802 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 14 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 16 finding(s).

PR Review Velocity Impact 7.0/100 · LOW

Which changes need focused human review? 1828 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 16LOW 1809

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1828 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1765 hits · 1596 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/test_rop.c	1	// SPDX-FileCopyrightText: 2026 MrQuantum1915 <darshanpatelgdh@gmail.com>	COMMENT
LOW	test/unit/test_unum.c	1381	err = NULL;	COMMENT
LOW	test/unit/test_unum.c	2261	// Python oracle and the sympy-based verifier. Grouping notes are given	COMMENT
LOW	test/unit/test_unum.c	2801	// Wrap-around past 1 MiB is intentional - the old parser did not mask	COMMENT
LOW	test/unit/test_diff.c	281	mu_assert_notnull(result, "rz_diff_unified result not null");	COMMENT
LOW	test/unit/test_endian.c	21	#undef SIZE	COMMENT
LOW	test/unit/test_threads.c	1	// SPDX-FileCopyrightText: 2021-2023 RizinOrg <info@rizin.re>	COMMENT
LOW	test/unit/test_tokens.c	1	// SPDX-FileCopyrightText: 2022 Rot127 <rot127@posteo.com>	COMMENT
LOW	test/unit/minunit.h	1	// SPDX-FileCopyrightText: 2015 Jeffrey Crowell <crowell@bu.edu>	COMMENT
LOW	test/unit/minunit.h	21	#define TCYAN	COMMENT
LOW	test/unit/test_c6x_packet.c	1	// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>	COMMENT
LOW	test/unit/test_ht.c	1	// SPDX-FileCopyrightText: pancake <pancake@nopcode.org>	COMMENT
LOW	test/unit/test_parse.c	1	// SPDX-FileCopyrightText: 2026 Anton Kochkov <anton.kochkov@gmail.com>	COMMENT
LOW	test/unit/test_parse.c	41		COMMENT
LOW	test/integration/test_str_search.c	21	#include "rz_util/rz_buf.h"	COMMENT
LOW	test/integration/test_str_search.c	181	// Print the hits.	COMMENT
LOW	test/integration/test_pdb.c	401	mu_assert_false(has_union_member(m64_union, "noSuchMember"), "no such union member");	COMMENT
LOW	test/integration/test_dwarf_info.c	1	// SPDX-FileCopyrightText: 2020 HoundThe <cgkajm@gmail.com>	COMMENT
LOW	test/integration/test_interrupt_signal.c	1	// SPDX-FileCopyrightText: 2026 PremadeS <emadsohail001@gmail.com>	COMMENT
LOW	test/integration/test_dwarf_integration.c	1	// SPDX-FileCopyrightText: 2020 HoundThe <cgkajm@gmail.com>	COMMENT
LOW	test/fuzz/scripts/fuzz_rz_asm.py	1	#!/usr/bin/env python3	COMMENT
LOW	sys/gen_cpio_script.c	1	// VENDORED FROM: Linux Kernel sources 6.19.0	COMMENT
LOW	.github/riscv-qemu-setup-all.sh	61	# ├── bb	COMMENT
LOW	.github/riscv-qemu-setup-all.sh	81	# └── usr	COMMENT
LOW	.github/workflows/get_real_pr_shas.yml	1	# Github variable github.event.pull_request.base.sha will always return the commit sha of the base branch.	COMMENT
LOW	.github/workflows/get_real_pr_shas.yml	21	# runs-on: ubuntu-latest	COMMENT
LOW	binrz/rz-test/rz-test.c	1	// SPDX-FileCopyrightText: 2020-2021 thestr4ng3r <info@florianmaerkl.de>	COMMENT
LOW	binrz/rz-test/rz_test.h	1	// SPDX-FileCopyrightText: 2020 thestr4ng3r <info@florianmaerkl.de>	COMMENT
LOW	binrz/rz-test/rz_test.h	21	#else	COMMENT
LOW	binrz/rz-test/load.c	41	// read the (possibly multiline) string value of some key in the file	COMMENT
LOW	binrz/rizin/macos_sign.sh	1	#!/bin/sh	COMMENT
LOW	librz/reg/rcond.c	1	// SPDX-FileCopyrightText: 2014-2019 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/reg/profile.c	1	// SPDX-FileCopyrightText: 2009-2020 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/crypto/p/crypto_serpent_algo.h	1	// SPDX-FileCopyrightText: 2017 NicsTr <nicolas.bordes@grenoble-inp.org>	COMMENT
LOW	librz/crypto/p/crypto_cps2.c	1	// SPDX-FileCopyrightText: 2016 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/crypto/p/crypto_rc6.c	1	// SPDX-FileCopyrightText: 2016 rakholiyajenish.07 <rakholiyajenish.07@gmail.com>	COMMENT
LOW	librz/flag/flag.c	1	// SPDX-FileCopyrightText: 2007-2020 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/egg/egg_lang.c	781	// the egg->lang.nestedi[CTX-1] has increased	COMMENT
LOW	librz/egg/emit/trace.c	1	// SPDX-FileCopyrightText: 2011 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/egg/emit/x64.c	1	// SPDX-FileCopyrightText: 2010-2011 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/egg/emit/arm.c	1	// SPDX-FileCopyrightText: 2010-2011 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/egg/emit/x86.c	1	// SPDX-FileCopyrightText: 2010-2013 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/egg/emit/x86.c	21	#define RZ_REG_AR_OFF 1	COMMENT
LOW	librz/core/cesil.c	1	// SPDX-FileCopyrightText: 2009-2021 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/core/canalysis.c	1	// SPDX-FileCopyrightText: 2009-2020 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/core/cgraph.c	1	// SPDX-FileCopyrightText: 2022 imbillow <billow.fun@gmail.com>	COMMENT
LOW	librz/core/heap_glibc.c	1	// SPDX-FileCopyrightText: 2016-2020 n4x0r <kalianon2816@gmail.com>	COMMENT
LOW	librz/core/cconfig.c	1	// SPDX-FileCopyrightText: 2009-2021 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/core/agraph.c	1	// SPDX-FileCopyrightText: 2014-2020 pancake	COMMENT
LOW	librz/core/agraph.c	21		COMMENT
LOW	librz/core/agraph.c	41	#define PAGEKEY_SPEED (h / 2)	COMMENT
LOW	librz/core/disasm.c	1	// SPDX-FileCopyrightText: 2022 Florian Märkl <info@florianmaerkl.de>	COMMENT
LOW	librz/core/project_migrate.c	301	// Removed stackptr and parent_stackptr from the serialized RzAnalysisBlock	COMMENT
LOW	librz/core/project_migrate.c	761	// Enums can now declare a fixed underlying type ("enum E : long long { ... }"),	COMMENT
LOW	librz/core/project_migrate.c	801	return true;	COMMENT
LOW	librz/core/cbin.c	1	// SPDX-FileCopyrightText: 2011-2020 earada <pkedurat@gmail.com>	COMMENT
LOW	librz/core/rtr.c	1	// SPDX-FileCopyrightText: 2022 Florian Märkl <info@florianmaerkl.de>	COMMENT
LOW	librz/core/ctypes.c	1	// SPDX-FileCopyrightText: 2009-2020 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/core/core.c	1	// SPDX-FileCopyrightText: 2009-2020 pancake <pancake@nopcode.org>	COMMENT
LOW	librz/core/cmath.c	301		COMMENT
1705 more matches not shown…

Decorative Section Separators9 hits · 30 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/fuzz/scripts/fuzz_rz_asm.py	6	# ============	COMMENT
MEDIUM	.github/riscv32-qemu-setup-all.sh	11	#---------------------------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	.github/riscv32-qemu-setup-all.sh	31	#---------------------------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	…rzheap/glibc-config-extractor/extract_glibc_structs.py	21	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…rzheap/glibc-config-extractor/extract_glibc_structs.py	23	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…rzheap/glibc-config-extractor/extract_glibc_structs.py	84	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…rzheap/glibc-config-extractor/extract_glibc_structs.py	86	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…rzheap/glibc-config-extractor/extract_glibc_structs.py	140	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…rzheap/glibc-config-extractor/extract_glibc_structs.py	142	# ---------------------------------------------------------------------------	COMMENT

Fake / Example Data14 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/test_inflate_deflate.c	12	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/unit/test_inflate_deflate.c	12	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/unit/test_lzma.c	12	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/unit/test_lzma.c	12	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/unit/test_lzma.c	74	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/unit/test_lzma.c	74	{ "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna	CODE
LOW	test/integration/test_str_search.c	28	// This file has the same lorem ipsum string in three different encodings:	COMMENT
LOW⚡	librz/core/casm.c	629	RzCoreAsmHit dummy_value;	CODE
LOW⚡	librz/core/casm.c	630	dummy_value.addr = addr;	CODE
LOW⚡	librz/core/casm.c	631	addr_iter = rz_list_find(hits, &dummy_value, ((RzListComparator)coreasm_address_comparator), NULL);	CODE
LOW	librz/core/casm.c	820	RzCoreAsmHit dummy_value;	CODE
LOW	librz/core/casm.c	828	memset(&dummy_value, 0, sizeof(RzCoreAsmHit));	CODE
LOW	librz/core/casm.c	886	RzCoreAsmHit dummy_value;	CODE
LOW	librz/core/casm.c	925	memset(&dummy_value, 0, sizeof(RzCoreAsmHit));	CODE

TODO Padding10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/test_graph_new.c	83	// TODO: Add test for removing nodes and checking that nodes_vec is never larger than n.	COMMENT
LOW	librz/core/cmd/cmd_write.c	363	// TODO: implement it in an API RzCore.write_unified_hexpatch() is ETOOLONG	COMMENT
LOW	librz/util/table.c	1571	// TODO: implement join operation with other command's tables	COMMENT
LOW	librz/bin/format/pe/pe_info.c	459	//TODO: implement dep?	COMMENT
LOW	librz/arch/fcn.c	490	// TODO: implement following code analysis check for stripped binaries:	COMMENT
LOW	librz/arch/filter.c	302	// TODO: implement realname with flags, because functions dont hold this yet	COMMENT
LOW	librz/debug/p/native/reg/netbsd-x86.h	54	// TODO: implement flags like in linux --those flags are wrong	COMMENT
LOW	librz/debug/p/native/reg/kfbsd-x86.h	59	// TODO: implement flags like in linux --those flags are wrong	COMMENT
LOW	librz/debug/p/native/bt/generic-x86.c	24	// TODO: implement [stack] map uptrace method too	COMMENT
LOW	librz/debug/p/native/bt/generic-x86.c	63	// TODO: implement [stack] map uptrace method too	COMMENT

Synthetic Comment Markers2 hits · 12 pts

Severity	File	Line	Snippet	Context
HIGH	SECURITY.md	29	## AI generated vulnerability reports	COMMENT
HIGH	sys/riscv_extension_parser_generator.py	181	full_code += " * \n \n *********************************************** AUTO-GENERATED CODE, DO NOT EDIT BY HAND! "	CODE

AI Slop Vocabulary3 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/unit/test_unum.c	1402	// the path still fires, while staying robust on future hardware.	COMMENT
MEDIUM⚡	sys/macos-cert.sh	2	# Credits to https://github.com/derekparker/delve/blob/master/scripts/gencert.sh	COMMENT
MEDIUM⚡	sys/macos-cert.sh	2	# Credits to https://github.com/derekparker/delve/blob/master/scripts/gencert.sh	COMMENT

Structural Annotation Overuse5 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW⚡	CONTRIBUTING.md	75	#### Step 1: Switch to `dev` branch.	COMMENT
LOW⚡	CONTRIBUTING.md	79	#### Step 2: Pull new commits published to rizinorg repo.	COMMENT
LOW⚡	CONTRIBUTING.md	83	#### Step 3: Switch back to `my-awesome-feature` branch.	COMMENT
LOW⚡	CONTRIBUTING.md	87	#### Step 4: Rebase the `my-awesome-feature` branch.	COMMENT
LOW	CONTRIBUTING.md	98	#### Step 5: Publish your updated local branch.	COMMENT

Self-Referential Comments3 hits · 10 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	sys/macos-cert.sh	17	# Create the certificate template	COMMENT
MEDIUM	.github/riscv-qemu-setup-all.sh	28	# Create a rootfs	COMMENT
MEDIUM	.github/riscv32-qemu-setup-all.sh	33	# Create a init config for busybox	COMMENT

Deep Nesting6 hits · 6 pts

Severity	File	Line	Context
LOW	test/fuzz/scripts/fuzz_rz_asm.py	133	CODE
LOW	sys/check_outdated_subprojects.py	92	CODE
LOW	sys/check_outdated_subprojects.py	189	CODE
LOW	sys/check_outdated_subprojects.py	443	CODE
LOW	librz/core/cmd_descs/cmd_descs_generate.py	672	CODE
LOW	…rzheap/glibc-config-extractor/extract_glibc_structs.py	25	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	test/scripts/kill_http_server.py	22	except (psutil.AccessDenied, psutil.NoSuchProcess):	CODE

Verbosity Indicators3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	librz/arch/asm.c	2031	// Step 1:	COMMENT
LOW	librz/arch/asm.c	2035	// Step 2:	COMMENT
LOW	librz/arch/isa/sh/sh_il.c	69	* The purpose of this function is to remove the redundant IL block introduced	COMMENT

Hyper-Verbose Identifiers4 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	sys/clang-format.py	89	def get_files_from_arg_option(args):	CODE
LOW	sys/check_outdated_subprojects.py	273	def current_version_from_file(sec):	CODE
LOW	librz/core/rtr_http.c	6	typedef rz_core_rtr_http_handler_ptr (*rz_core_rtr_http_handler)();	CODE
LOW	librz/core/cmd_descs/rzshell_which.py	43	def get_c_handler_name_from_entry(e):	CODE

Excessive Try-Catch Wrapping2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	sys/riscv_extension_parser_generator.py	377	print(f"Error: Input file {input_header} not found")	CODE
LOW⚡	…rzheap/glibc-config-extractor/extract_glibc_structs.py	74	except Exception:	CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW⚡	sys/macos-cert.sh	7	# Check if the certificate is already present in the system keychain	COMMENT

rizinorg/rizin

Open-Source Code Quality, Security and Technical Debt Review