AI Slop Code Risk Monitor

rust-lang/crates.io

SlopCodeMonitor badge for rust-lang/crates.io Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

The Rust package registry

1.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for rust-lang/crates.io, a Rust project with 3,730 GitHub stars. SynthScan examined 153,362 lines of code across 1284 source files, recording 214 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 1.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.5
Adjusted Signal
1.5
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
3.7K
Stars
Rust
Language
153.4K
Lines of Code
1.3K
Files
214
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 162 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.4/100 · LOW

Are imports declared and package/API names verified? 44 finding(s).

Agent Over-Engineering Ratio 0.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 9 finding(s).

PR Review Velocity Impact 7.0/100 · LOW

Which changes need focused human review? 214 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 209

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 214 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block141 hits · 131 pts
SeverityFileLineSnippetContext
LOWdeny.toml1# This template contains all of the possible sections and their default valuesCOMMENT
LOWdeny.toml21targets = [COMMENT
LOWdeny.toml41# be toggled off if true, if you want to conditionally enable `--all-features` itCOMMENT
LOWdeny.toml61# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.htmlCOMMENT
LOWdeny.toml81 "RUSTSEC-2026-0194",COMMENT
LOWdeny.toml101#severity-threshold =COMMENT
LOWdeny.toml141 # listCOMMENT
LOWdeny.toml161# when running the license check, otherwise the clarification will be ignoredCOMMENT
LOWdeny.toml181# One or more private registries that you might publish crates to, if a crateCOMMENT
LOWdeny.toml201highlight = "all"COMMENT
LOWdeny.toml221 # is a direct dependency of the otherwise banned crateCOMMENT
LOWdeny.toml241# "tokio-rustls",COMMENT
LOWdeny.toml261# More documentation about the 'sources' section can be found here:COMMENT
LOWdeny.toml281# 1 or more bitbucket.org organizations to allow git sources forCOMMENT
LOWdiesel-guard.toml1# diesel-guard configuration fileCOMMENT
LOWdiesel-guard.toml21# check_down = falseCOMMENT
LOWplaywright.config.ts41 projects: [COMMENT
LOWplaywright.config.ts61 // },COMMENT
LOWcrates/crates_io_env_vars/src/lib.rs1#![doc = include_str!("../README.md")]COMMENT
LOWcrates/crates_io_env_vars/src/lib.rs21 Err(error) => Err(error.into()),COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs441#[serde(rename_all = "kebab-case")]COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs461 /// `cargo test`.COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs481 pub proc_macro: bool,COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs701#[serde(rename_all = "kebab-case")]COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs781}COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs801 pub links: Option<String>,COMMENT
LOWcrates/crates_io_cargo_toml/src/lib.rs821 pub license: Option<MaybeInherited<String>>,COMMENT
LOWcrates/crates_io_cargo_toml/src/target_metadata.rs41 /// The package build script.COMMENT
LOWcrates/crates_io_cargo_toml/src/target_metadata.rs161 /// A target path is absolute or escapes the package root.COMMENT
LOWcrates/crates_io_heroku/src/lib.rs41///COMMENT
LOWcrates/crates_io_heroku/src/lib.rs61///COMMENT
LOWcrates/crates_io_heroku/src/lib.rs81}COMMENT
LOWcrates/crates_io_heroku/src/lib.rs101/// use crates_io_heroku::slug_commit;COMMENT
LOWcrates/crates_io_heroku/src/lib.rs121/// the current standard while `HEROKU_SLUG_COMMIT` is deprecated.COMMENT
LOWcrates/crates_io_cdn_logs/src/paths.rs1use semver::Version;COMMENT
LOWcrates/crates_io_cdn_logs/src/fastly/json.rs1//! Imported from <https://github.com/rust-lang/simpleinfra/blob/4fb365809295de075d28d8b2d51f6f419537be7d/terragrunt/modCOMMENT
LOWcrates/crates_io_cdn_logs/src/fastly/json.rs21/// - The `date_time`, `method`, `url`, and `version` fields are using `Cow` toCOMMENT
LOWcrates/crates_io_index/src/commit_builder.rs1use crate::repo::Repository;COMMENT
LOWcrates/crates_io_index/src/credentials.rs21 _ => None,COMMENT
LOWcrates/crates_io_index/src/data.rs21 /// with a `Cargo.lock` file.COMMENT
LOWcrates/crates_io_index/src/data.rs41 ///COMMENT
LOWcrates/crates_io_index/src/repo.rs81 /// See [`Self::open_shallow`] for a variant that only fetches the tipCOMMENT
LOWcrates/crates_io_index/src/repo.rs101 ///COMMENT
LOWcrates/crates_io_fastly/src/lib.rs41 .unwrap();COMMENT
LOWcrates/crates_io_database_dump/src/dump-db.toml1# This file configures what to include in public database dumps. For eachCOMMENT
LOWcrates/crates_io_database_dump/src/configuration.rs1use serde::Deserialize;COMMENT
LOWcrates/crates_io_test_db/src/lib.rs21const CONNECTION_TIMEOUT: Duration = Duration::from_secs(5);COMMENT
LOWcrates/crates_io_test_db/src/lib.rs181/// This sweeps any leftover per-test schemas from a prior crashed run,COMMENT
LOWcrates/crates_io_version/src/lib.rs1#![doc = include_str!("../README.md")]COMMENT
LOWcrates/crates_io_trustpub/src/lib.rs1#![doc = include_str!("../README.md")]COMMENT
LOWcrates/crates_io_trustpub/src/unverified.rs1use jsonwebtoken::TokenData;COMMENT
LOWcrates/crates_io_trustpub/src/access_token.rs1use rand::distr::{Alphanumeric, SampleString};COMMENT
LOWcrates/crates_io_trustpub/src/gitlab/validation.rs1//! Validation functions for GitLab Trusted Publishing configuration fields.COMMENT
LOWcrates/crates_io_trustpub/src/gitlab/workflows.rs1/// Extracts the workflow path from a GitLab `ci_config_ref_uri` claim.COMMENT
LOWcrates/crates_io_trustpub/src/keystore/load_jwks.rs1use jsonwebtoken::jwk::JwkSet;COMMENT
LOWcrates/crates_io_database/tests/semver_ord_v2.rs41COMMENT
LOWcrates/crates_io_database/src/semver.rs1use diesel::Queryable;COMMENT
LOWcrates/crates_io_database/src/schema.rs1// @generated automatically by Diesel CLI.COMMENT
LOWcrates/crates_io_database/src/schema.rs21 /// (Automatically generated by Diesel.)COMMENT
LOWcrates/crates_io_database/src/schema.rs41 /// The `id` column of the `api_tokens` table.COMMENT
81 more matches not shown…
Fake / Example Data44 hits · 44 pts
SeverityFileLineSnippetContext
LOWcrates/crates_io_github/src/lib.rs570 "name": "John Doe"CODE
LOWcrates/crates_io_worker/README.md114 to: "user@example.com".to_string(),CODE
LOWsvelte/src/lib/components/UserPageHeader.stories.svelte21 name: 'Jane Doe',CODE
LOWsvelte/src/lib/components/UserAvatar.stories.svelte23 name: 'Jane Doe',CODE
LOWsvelte/src/lib/components/UserAvatar.stories.svelte44 name: 'Jane Doe',CODE
LOWsvelte/src/lib/components/OwnersList.stories.svelte18 name: 'Jane Doe',CODE
LOWsvelte/src/lib/components/CrateHeader.stories.svelte25 name: 'John Doe',CODE
LOWsvelte/src/lib/components/CrateHeader.stories.svelte41 name: 'John Doe',CODE
LOWsvelte/src/lib/components/Header.stories.svelte25 name: 'John Doe',CODE
LOWsvelte/src/lib/components/EmailInput.stories.svelte21 name: 'John Doe',CODE
LOWsvelte/src/lib/components/PrivilegedAction.svelte36 interface Props extends Omit<HTMLAttributes<HTMLDivElement>, 'placeholder'> {CODE
LOWsvelte/src/lib/components/PrivilegedAction.svelte60 <div {...others} class="placeholder">CODE
LOWsvelte/src/lib/components/Placeholder.svelte15 class={['placeholder', className]}CODE
LOWsvelte/src/lib/components/EmailInput.svelte.test.ts18 name: 'John Doe',CODE
LOWpackages/crates-io-msw/models/user.test.ts32 let user = await db.user.create({ name: 'John Doe' });CODE
LOWpackages/crates-io-msw/models/user.test.ts50 "name": "John Doe",CODE
LOWpackages/crates-io-msw/handlers/cdn.test.ts35 let readme = 'lorem ipsum <i>est</i> dolor!';CODE
LOW…ages/crates-io-msw/handlers/crates/list-owners.test.ts33 name: 'John Doe',CODE
LOW…ages/crates-io-msw/handlers/crates/list-owners.test.ts57 "name": "John Doe",CODE
LOW…ages/crates-io-msw/handlers/crates/list-owners.test.ts91 let user = await db.user.create({ name: 'John Doe' });CODE
LOW…ages/crates-io-msw/handlers/crates/list-owners.test.ts112 "name": "John Doe",CODE
LOW…ages/crates-io-msw/handlers/crates/user-owners.test.ts32 let user = await db.user.create({ name: 'John Doe' });CODE
LOW…ages/crates-io-msw/handlers/crates/user-owners.test.ts50 "name": "John Doe",CODE
LOWpackages/crates-io-msw/handlers/users/stats.test.ts20 let user = await db.user.create({ name: 'John Doe' });CODE
LOWpackages/crates-io-msw/handlers/users/stats.test.ts32 let user = await db.user.create({ name: 'John Doe' });CODE
LOWpackages/crates-io-msw/handlers/users/stats.test.ts49 let user1 = await db.user.create({ name: 'John Doe' });CODE
LOWpackages/crates-io-msw/handlers/users/stats.test.ts50 let user2 = await db.user.create({ name: 'Jane Doe' });CODE
LOWe2e/acceptance/logout.spec.ts5 let user = await msw.db.user.create({ name: 'John Doe' });CODE
LOWe2e/acceptance/logout.spec.ts12 await expect(menu.locator('[data-test-toggle]')).toHaveText('John Doe');CODE
LOWe2e/acceptance/login.spec.ts10 let user = await msw.db.user.create({ name: 'John Doe' });CODE
LOWe2e/acceptance/login.spec.ts30 await expect(page.locator('[data-test-user-menu] [data-test-toggle]')).toHaveText('John Doe');CODE
LOWe2e/acceptance/login.spec.ts50 let user = await msw.db.user.create({ name: 'John Doe' });CODE
LOWe2e/acceptance/login.spec.ts76 await expect(page.locator('[data-test-user-menu] [data-test-toggle]')).toHaveText('John Doe');CODE
LOWe2e/acceptance/dashboard.spec.ts14 name: 'John Doe',CODE
LOWe2e/acceptance/api-token.spec.ts8 name: 'John Doe',CODE
LOWe2e/acceptance/sudo.spec.ts8 name: 'John Doe',CODE
LOWe2e/acceptance/dashboard.spec.ts-snapshots/aria.yml10 - button "John Doe"CODE
LOWe2e/acceptance/api-token.spec.ts-snapshots/aria.yml10 - button "John Doe"CODE
LOWe2e/routes/settings/tokens/index.spec.ts7 name: 'John Doe',CODE
LOWe2e/routes/settings/tokens/index.spec.ts35 name: 'John Doe',CODE
LOWe2e/routes/settings/tokens/new.spec.ts8 name: 'John Doe',CODE
LOWsrc/email.rs439 assert_eq!(mask_email("user@example.com"), "u***@e***.com");CODE
LOWsrc/worker/jobs/typosquat.rs139 let cache = Cache::new(vec!["admin@example.com".to_string()], &mut async_conn).await?;CODE
LOWsrc/worker/jobs/typosquat.rs170 assert_eq!(&sent.0.to(), &["admin@example.com".parse::<Address>()?]);CODE
Verbosity Indicators10 hits · 18 pts
SeverityFileLineSnippetContext
LOW⚡src/tests/krate/publish/trustpub_github.rs62 // Step 1: Publish a new crate via API tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_github.rs68 // Step 2: Create a Trusted Publishing configurationCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs101 // Step 3: Generate a new OIDC token and exchange it for a temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs125 // Step 4: Publish a new version of the crate using the temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs148 // Step 5: Revoke the temporary access tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_gitlab.rs44 // Step 1: Publish a new crate via API tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_gitlab.rs50 // Step 2: Create a Trusted Publishing configurationCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs82 // Step 3: Generate a new OIDC token and exchange it for a temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs106 // Step 4: Publish a new version of the crate using the temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs129 // Step 5: Revoke the temporary access tokenCOMMENT
Structural Annotation Overuse10 hits · 18 pts
SeverityFileLineSnippetContext
LOW⚡src/tests/krate/publish/trustpub_github.rs62 // Step 1: Publish a new crate via API tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_github.rs68 // Step 2: Create a Trusted Publishing configurationCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs101 // Step 3: Generate a new OIDC token and exchange it for a temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs125 // Step 4: Publish a new version of the crate using the temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_github.rs148 // Step 5: Revoke the temporary access tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_gitlab.rs44 // Step 1: Publish a new crate via API tokenCOMMENT
LOW⚡src/tests/krate/publish/trustpub_gitlab.rs50 // Step 2: Create a Trusted Publishing configurationCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs82 // Step 3: Generate a new OIDC token and exchange it for a temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs106 // Step 4: Publish a new version of the crate using the temporary access tokenCOMMENT
LOWsrc/tests/krate/publish/trustpub_gitlab.rs129 // Step 5: Revoke the temporary access tokenCOMMENT
Excessive Try-Catch Wrapping8 hits · 18 pts
SeverityFileLineSnippetContext
LOW⚡crates/crates_io_real_ip/update-data.py21 except Exception as e:CODE
MEDIUM⚡crates/crates_io_real_ip/update-data.py22 print(f"Error downloading {name} IP ranges: {e}", file=sys.stderr)CODE
LOW⚡crates/crates_io_real_ip/update-data.py30 except Exception as e:CODE
MEDIUM⚡crates/crates_io_real_ip/update-data.py31 print(f"Error parsing IPv4 CIDR {cidr}: {e}", file=sys.stderr)CODE
LOW⚡crates/crates_io_real_ip/update-data.py39 except Exception as e:CODE
MEDIUM⚡crates/crates_io_real_ip/update-data.py40 print(f"Error parsing IPv6 CIDR {cidr}: {e}", file=sys.stderr)CODE
MEDIUMcrates/crates_io_real_ip/update-data.py137 print("Error: No CloudFront networks found!", file=sys.stderr)CODE
MEDIUMcrates/crates_io_real_ip/update-data.py165 print("Error: No Fastly networks found!", file=sys.stderr)CODE
Hyper-Verbose Identifiers1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsvelte/src/routes/settings/profile/+page.svelte21 async function updateNotificationSettings() {CODE