1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-26

Last Push

13.2K

Stars

TypeScript

Language

464.1K

Lines of Code

2.2K

Files

319

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 259 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.1/100 · LOW

Are imports declared and package/API names verified? 38 finding(s).

Agent Over-Engineering Ratio 2.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 196 finding(s).

PR Review Velocity Impact 4.7/100 · LOW

Which changes need focused human review? 319 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 10MEDIUM 29LOW 278

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 319 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers174 hits · 181 pts

Severity	File	Line	Snippet	Context
LOW	server/public/script-full.js	96	function getOrCreateVisitorId(namespace) {	CODE
LOW	server/public/script-full.js	338	function isPlausibleScreenDimensions(width, height) {	CODE
LOW	server/public/script-full.js	344	function getScreenDimensionSignals(width, height, userAgent) {	CODE
LOW	server/src/index.ts	148	function receiveUsageStateFromPrimary(): Promise<void> {	CODE
LOW	server/src/mcp/wellKnown.ts	43	export function createOAuthWellKnownRoutes(dependencies: OAuthWellKnownDependencies = defaultDependencies) {	CODE
LOW	server/src/mcp/tools/organizations.ts	31	export function registerOrganizationTools(server: McpServer, api: RybbitApiClient, guard: ToolGuard, allowed: ScopeCheck	CODE
LOW	server/src/mcp/tools/searchConsole.ts	36	export function registerSearchConsoleTools(	CODE
LOW	server/src/lib/subscriptionUtils.test.ts	193	function listRejectsWhileIterating(message: string) {	CODE
LOW	server/src/lib/auth-utils.ts	86	function resolveBearerTokenFromRequest(req: FastifyRequest): string \| null {	CODE
LOW⚡	server/src/lib/auth-utils.ts	270	export function invalidateOrganizationSitesCache(organizationId: string) {	CODE
LOW⚡	server/src/lib/auth-utils.ts	275	export function invalidateSitesAccessCache(userId: string) {	CODE
LOW⚡	server/src/lib/auth-utils.ts	284	async function resolveTargetOrganizationId(options: {	CODE
LOW	server/src/lib/auth-utils.ts	478	export async function getSiteIsPubliclyReadable(req: FastifyRequest, siteId: string \| number): Promise<boolean> {	CODE
LOW	server/src/lib/auth-utils.ts	502	export async function getOrganizationSitesForCaller(	CODE
LOW	server/src/lib/auth-utils.ts	606	export async function getUserHasAdminAccessToSite(req: FastifyRequest, siteId: string \| number) {	CODE
LOW	server/src/lib/auth-middleware.ts	41	export function assertRouteAccessDeclared(route: RouteOptions): void {	CODE
LOW	server/src/lib/api-errors.ts	119	export function registerApiErrorResponses(server: FastifyInstance): void {	CODE
LOW	server/src/lib/subscriptionUtils.ts	240	export function invalidateStripeSubscriptionCache(stripeCustomerId: string \| null): void {	CODE
LOW	server/src/lib/subscriptionUtils.ts	263	export function invalidateAllStripeSubscriptionsCache(): void {	CODE
LOW	server/src/lib/subscriptionUtils.ts	285	export async function getAllStripeSubscriptionsByCustomer(): Promise<Map<string, Stripe.Subscription>> {	CODE
LOW	server/src/lib/subscriptionUtils.ts	335	export function stripeSubscriptionInfoFromSnapshot(	CODE
LOW	server/src/lib/subscriptionUtils.ts	450	export async function hasRenewingStripeSubscription(stripeCustomerId: string \| null): Promise<boolean> {	CODE
LOW	server/src/lib/subscriptionUtils.ts	609	function buildStripeSubscriptionInfo(subscription: Stripe.Subscription): StripeSubscriptionInfo \| null {	CODE
LOW	server/src/lib/subscriptionUtils.ts	672	export async function getCustomPlanSubscription(	CODE
LOW	server/src/lib/subscriptionUtils.ts	757	export async function getBestSubscriptionFromStripeSub(	CODE
LOW	server/src/lib/subscriptionUtils.ts	795	export function subscriptionIncludesReplay(subscription: SubscriptionInfo): boolean {	CODE
LOW	server/src/lib/openrouter.ts	82	export async function callOpenRouterWithMetadata(	CODE
LOW	server/src/lib/cors.ts	158	export function shouldRejectUntrustedOrigin(request: FastifyRequest, env: NodeJS.ProcessEnv = process.env): boolean {	CODE
LOW	server/src/lib/cors.ts	176	export function createCorsOptionsDelegate(env: NodeJS.ProcessEnv = process.env) {	CODE
LOW	server/src/lib/cors.ts	182	export function createRejectUntrustedOriginHook(env: NodeJS.ProcessEnv = process.env) {	CODE
LOW	server/src/lib/apiRateLimitPolicy.ts	24	async function dailyLimitForOrganization(organizationId: string): Promise<number> {	CODE
LOW	server/src/lib/apiRateLimitPolicy.ts	97	export function invalidateRateLimitPlanCache(ownerId: string): void {	CODE
LOW	server/src/lib/apiRateLimitPolicy.ts	108	export async function consumeRateLimitForIdentity(identity: {	CODE
LOW	server/src/lib/auth.ts	304	async function assertOrganizationNotBilling(organizationId: string, message: string) {	CODE
LOW	server/src/lib/auth.ts	328	async function applyInvitationSiteAccess(invitationId: string, memberId: string) {	CODE
LOW	server/src/lib/scopes.ts	87	export function statementsFromApiKeyPermissions(permissions: unknown): ScopeStatements \| null {	CODE
LOW	server/src/db/clickhouse/queryUser.ts	96	async function rowPoliciesHideUnnamedUsers(database: string, user: string): Promise<boolean> {	CODE
LOW	server/src/db/clickhouse/clickhouse.test.ts	45	function findSessionHourlyCreateQuery() {	CODE
LOW	server/src/db/clickhouse/schema/liteDashboard.ts	38	async function ensureSessionHourlyMaterializedView() {	CODE
LOW	server/src/db/clickhouse/schema/liteDashboard.ts	64	export async function initializeLiteDashboardMVs() {	CODE
LOW	server/src/api/experiments/getExperimentResults.ts	29	export function buildExperimentResultQueries({	CODE
LOW	server/src/api/experiments/utils.ts	26	export function getDuplicateExperimentMessage(error: unknown) {	CODE
LOW	server/src/api/experiments/utils.ts	33	export async function validateExperimentReferences(	CODE
LOW	server/src/api/experiments/utils.ts	71	export async function getExperimentWithRelations(	CODE
LOW	server/src/api/admin/getAdminServiceEventCount.ts	21	export async function getAdminServiceEventCount(	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	18	export async function getAdminOrganizationOptions(	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	60	export async function getAdminSubscriptionPlans(_request: FastifyRequest, reply: FastifyReply) {	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	91	export async function updateAdminSubscriptionOverride(	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	156	export async function getAdminOrganizationMember(	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	224	export async function updateAdminOrganizationMember(	CODE
LOW	server/src/api/admin/adminOrganizationManagement.ts	283	export async function deleteAdminOrganizationMember(	CODE
LOW	server/src/api/sites/siteSessionCountsQuery.ts	1	export function buildSiteSessionCountsQuery(useLiteDashboard: boolean) {	CODE
LOW	server/src/api/sites/getSiteExclusions.ts	101	export function getSiteExcludedUserAgents(request: FastifyRequest, reply: FastifyReply) {	CODE
LOW	server/src/api/sites/getSiteExclusions.ts	109	export function getSiteExcludedQueryParams(request: FastifyRequest, reply: FastifyReply) {	CODE
LOW	server/src/api/sites/updateSitePrivateLinkConfig.ts	9	export async function updateSitePrivateLinkConfig(request: FastifyRequest, reply: FastifyReply) {	CODE
LOW	server/src/api/gsc/searchAnalytics.ts	93	function normalizeFilterExpression(filter: z.infer<typeof filterSchema>): string {	CODE
LOW	server/src/api/gsc/searchAnalytics.ts	134	export function buildSearchAnalyticsRequest(rawQuery: unknown): SearchAnalyticsRequest {	CODE
LOW	server/src/api/featureFlags/schemas.ts	187	export function validateFeatureFlagUpdate(stored: Required<FeatureFlagShape>, patch: FeatureFlagUpdateBody): void {	CODE
LOW	server/src/api/featureFlags/index.ts	303	export async function evaluateServerFeatureFlags(	CODE
LOW	server/src/api/featureFlags/index.ts	313	async function evaluateFeatureFlagsForRuntime(	CODE
114 more matches not shown…

Decorative Section Separators22 hits · 66 pts

Severity	File	Line	Snippet	Context
MEDIUM	client/src/app/[site]/dashboards/examples.ts	22	// ── Overview ─────────────────────────────────────────────────────────────--	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	154	// ── Traffic ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	277	// ── Audience ─────────────────────────────────────────────────────────────--	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	353	// ── Behavior (beyond prebuilt) ──────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	695	// ── Behavior: derived insights ─────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	831	// ── Events & interactions ───────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	1093	// ── Events: derived insights ───────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	1171	// ── Performance ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	1261	// ── Performance: derived insights ──────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	1294	// ── Marketing ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/examples.ts	1417	// ── Power user ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	153	// ── X-axis tick formatting ───────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	251	// ── Value formatting ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	281	// ── Single-value (stat) ──────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	297	// ── Pie / donut ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	320	// ── Map (country choropleth) ─────────────────────────────────────────────────	COMMENT
MEDIUM	client/src/app/[site]/dashboards/utils.ts	341	// ── Calendar heatmap ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	…src/app/[site]/dashboards/components/charts/shared.tsx	97	// ── Shared periwinkle dataviz ramp (DESIGN.md --dataviz, hue 230) ─────────────	COMMENT
MEDIUM	…ent/src/app/[site]/journeys/components/journeyUtils.ts	19	// ───────── page patterns ─────────	COMMENT
MEDIUM	…ent/src/app/[site]/journeys/components/journeyUtils.ts	60	// ───────── the graph ─────────	COMMENT
MEDIUM	…ent/src/app/[site]/journeys/components/journeyUtils.ts	173	// ───────── one path ─────────	COMMENT
MEDIUM	…ent/src/app/[site]/journeys/components/journeyUtils.ts	198	// ───────── layout ─────────	COMMENT

Magic Placeholder Names10 hits · 50 pts

Severity	File	Line	Snippet	Context
HIGH	docs/src/app/[locale]/(home)/for-developers/page.tsx	119	{ text: '"Authorization: Bearer YOUR_API_KEY"', className: tokenString },	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	36	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	53	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	86	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	122	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	162	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	193	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	223	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	251	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE
HIGH	…/src/app/[site]/api-playground/utils/codeGenerators.ts	278	const { method, url, queryParams, body, apiKey = "YOUR_API_KEY" } = config;	CODE

Verbosity Indicators22 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	server/src/api/as/activate.ts	130	// Step 1: Exchange authorization code for access token	COMMENT
LOW	server/src/api/as/activate.ts	142	// Step 2: Fetch license key using access token	COMMENT
LOW	server/src/api/as/activate.ts	154	// Step 3: Check if license already exists	COMMENT
LOW	server/src/api/as/activate.ts	181	// Step 4: License doesn't exist - create new record	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	149	// Step 1: Find matching user IDs and their traits from Postgres	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	174	// Step 2: Get session counts + metadata from ClickHouse	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	194	// Step 3: Build lookup from ClickHouse data keyed by identified_user_id,	COMMENT
LOW	server/src/services/usageService.ts	361	// Step 0: Pull every customer's subscription from Stripe in one bulk pass (a handful of	COMMENT
LOW⚡	server/src/services/usageService.ts	373	// Step 1: Get all sites with their organization IDs	COMMENT
LOW⚡	server/src/services/usageService.ts	376	// Step 2: Get event and replay counts for all sites (current month, one query each). If	COMMENT
LOW	server/src/services/usageService.ts	391	// Step 3: Build a map of organizationId -> { sites, eventCount, replayCount }	COMMENT
LOW	server/src/services/usageService.ts	412	// Step 4: Get all organizations	COMMENT
LOW	server/src/services/usageService.ts	430	// Step 5: Process each organization	COMMENT
LOW	client/src/app/signup/page.tsx	48	// Step 1: Account creation	COMMENT
LOW	client/src/app/signup/page.tsx	64	// Step 1: Account creation submission	COMMENT
LOW	client/src/app/signup/page.tsx	106	// Step 2: Setup submission — create org + site, then advance (cloud) or redirect (self-hosted)	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	61	// Step 1: Account creation	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	66	// Step 2: Organization creation	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	69	// Step 3: Website addition	COMMENT
LOW	client/src/app/as/callback/page.tsx	165	// Step 1: Account creation submission	COMMENT
LOW	client/src/app/as/callback/page.tsx	210	// Step 2: Organization creation and AppSumo license activation	COMMENT
LOW	client/src/app/as/callback/page.tsx	251	// Step 3: Website addition submission	COMMENT

Structural Annotation Overuse22 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	server/src/api/as/activate.ts	130	// Step 1: Exchange authorization code for access token	COMMENT
LOW	server/src/api/as/activate.ts	142	// Step 2: Fetch license key using access token	COMMENT
LOW	server/src/api/as/activate.ts	154	// Step 3: Check if license already exists	COMMENT
LOW	server/src/api/as/activate.ts	181	// Step 4: License doesn't exist - create new record	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	149	// Step 1: Find matching user IDs and their traits from Postgres	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	174	// Step 2: Get session counts + metadata from ClickHouse	COMMENT
LOW	server/src/api/analytics/users/getUserTraits.ts	194	// Step 3: Build lookup from ClickHouse data keyed by identified_user_id,	COMMENT
LOW	server/src/services/usageService.ts	361	// Step 0: Pull every customer's subscription from Stripe in one bulk pass (a handful of	COMMENT
LOW⚡	server/src/services/usageService.ts	373	// Step 1: Get all sites with their organization IDs	COMMENT
LOW⚡	server/src/services/usageService.ts	376	// Step 2: Get event and replay counts for all sites (current month, one query each). If	COMMENT
LOW	server/src/services/usageService.ts	391	// Step 3: Build a map of organizationId -> { sites, eventCount, replayCount }	COMMENT
LOW	server/src/services/usageService.ts	412	// Step 4: Get all organizations	COMMENT
LOW	server/src/services/usageService.ts	430	// Step 5: Process each organization	COMMENT
LOW	client/src/app/signup/page.tsx	48	// Step 1: Account creation	COMMENT
LOW	client/src/app/signup/page.tsx	64	// Step 1: Account creation submission	COMMENT
LOW	client/src/app/signup/page.tsx	106	// Step 2: Setup submission — create org + site, then advance (cloud) or redirect (self-hosted)	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	61	// Step 1: Account creation	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	66	// Step 2: Organization creation	COMMENT
LOW⚡	client/src/app/as/callback/page.tsx	69	// Step 3: Website addition	COMMENT
LOW	client/src/app/as/callback/page.tsx	165	// Step 1: Account creation submission	COMMENT
LOW	client/src/app/as/callback/page.tsx	210	// Step 2: Organization creation and AppSumo license activation	COMMENT
LOW	client/src/app/as/callback/page.tsx	251	// Step 3: Website addition submission	COMMENT

Over-Commented Block31 hits · 31 pts

Severity	File	Line	Snippet	Context
LOW	server/src/utils.ts	221	return input;	COMMENT
LOW	server/src/scripts/disableUnentitledReplays.ts	1	// Lists — and with --apply, disables — session replay for sites whose organization's	COMMENT
LOW	server/src/scripts/backfillLiteDashboardMVs.ts	1	// Backfill the lite-dashboard materialized view targets from the existing	COMMENT
LOW	server/src/lib/const.ts	41	export const BASIC_SITE_LIMIT = 1;	COMMENT
LOW	server/src/lib/auth.ts	341	const { organizationId, hasRestrictedSiteAccess, siteIds, siteRole } = invitationRecord[0];	COMMENT
LOW	server/src/db/clickhouse/queryUser.ts	1	import { randomBytes } from "node:crypto";	COMMENT
LOW	server/src/db/clickhouse/client.ts	21	// honours it, so the stored epoch no longer depends on the server timezone.	COMMENT
LOW	server/src/db/clickhouse/schema/core.ts	41	{ name: "session_id", definition: "session_id String DEFAULT ''" },	COMMENT
LOW	server/src/db/clickhouse/schema/core.ts	361	// Successor to session_replay_metadata. The old table is a	COMMENT
LOW	server/src/db/clickhouse/schema/liteDashboard.ts	61	// Materialized views that back the simplified high-traffic dashboard.	COMMENT
LOW	server/src/db/redis/stickyResolveLua.ts	1	// Lua body for the stickyResolve command. Kept in its own side-effect-free	COMMENT
LOW	server/src/db/redis/redis.ts	101	// cand (ZSET) identities recently seen through datacenter egress under	COMMENT
LOW	server/src/db/redis/redis.ts	261	// single round-trip, and because the state lives in Redis every worker/replica	COMMENT
LOW	server/src/api/routes.ts	241	//	COMMENT
LOW	server/src/api/analytics/lite/utils.ts	1	import { FilterParams } from "@rybbit/shared";	COMMENT
LOW	server/src/api/analytics/lite/utils.ts	21	if (!filters) return false;	COMMENT
LOW	server/src/api/analytics/utils/timeWindow.test.ts	241	expect(result).not.toContain("Z'");	COMMENT
LOW	server/src/api/analytics/utils/sessionAttribution.ts	1	// Session-level attribution aggregations, shared by every query that derives a	COMMENT
LOW	server/src/services/userId/stickyUserId.ts	1	import crypto from "crypto";	COMMENT
LOW	server/src/services/tracker/identityBackfillQueue.ts	1	import { clickhouse } from "../../db/clickhouse/clickhouse.js";	COMMENT
LOW	…rver/src/services/tracker/botBlocking/botEventQueue.ts	121		COMMENT
LOW	server/src/services/tracker/botBlocking/index.ts	301		COMMENT
LOW	…rver/src/services/tracker/botBlocking/anomalyScorer.ts	641	const eventToken = nextEventToken(nowMs);	COMMENT
LOW	server/src/services/replay/replayClockSkew.ts	1	// Replay event timestamps come from the browser, not the server, so they carry	COMMENT
LOW	shared/src/permissions.ts	1	// Roles and permissions — the one answer to "what may this role do?".	COMMENT
LOW	…cs/src/app/[locale]/(home)/compare/data/competitors.ts	1	import { STANDARD_SITE_LIMIT, STANDARD_TEAM_LIMIT } from "@/lib/const";	COMMENT
LOW	.github/workflows/claude.yml	41	actions: read	COMMENT
LOW	…]/main/components/MainSection/annotations/emojiData.ts	1	// Generated from the Unicode emoji-test.txt data file for Emoji 15.1 — the	COMMENT
LOW	client/src/components/replay/replayEvents.ts	1	// Maps raw rrweb protocol events into human-meaningful session events	COMMENT
LOW	client/src/components/interior/segmented-control.tsx	1	// Adapted from interior.dev "SegmentedControl" (MIT). See ./THIRD_PARTY_LICENSES.md	COMMENT
LOW	client/src/lib/motion.ts	1	import type { Transition } from "framer-motion";	COMMENT

Fake / Example Data26 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	server/src/lib/email/templates/templates.test.ts	48	organizationName: "Acme Inc",	CODE
LOW	server/src/lib/email/templates/templates.test.ts	92	organizationName: "Acme Inc",	CODE
LOW	server/src/lib/email/templates/templates.test.ts	106	email: "tay@example.org",	CODE
LOW	server/src/lib/email/templates/templates.test.ts	110	organizationName: "Acme Inc",	CODE
LOW	server/src/lib/email/templates/templates.test.ts	129	expect(approachingLimitSubject("Acme Inc", 91_000, 100_000, usage.now)).toBe(	CODE
LOW	server/src/lib/email/templates/templates.test.ts	205	organizationName: "Acme Inc",	CODE
LOW	server/src/lib/email/templates/templates.test.ts	273	expect(html).toContain("Acme Inc");	CODE
LOW	server/src/lib/email/templates/templates.test.ts	283	organizationName: "Acme Inc",	CODE
LOW	…er/src/api/memberAccess/updateMemberSiteAccess.test.ts	104	('admin', 'Admin', 'admin@example.com'),	CODE
LOW	server/src/api/sites/siteTransfers.test.ts	100	async function startTransfer(email = "tay@example.org") {	CODE
LOW⚡	server/src/api/sites/siteTransfers.test.ts	143	expect(reply.body).toMatchObject({ recipientEmail: "tay@example.org", url: expect.stringContaining("/transfer/") });	CODE
LOW⚡	server/src/api/sites/siteTransfers.test.ts	145	expect.objectContaining({ email: "tay@example.org", sentBy: "barnaby@agency.io", siteDomain: "tay.example.org" })	CODE
LOW⚡	server/src/api/sites/siteTransfers.test.ts	153	const first = await startTransfer("first@example.org");	CODE
LOW⚡	server/src/api/sites/siteTransfers.test.ts	154	await startTransfer("tay@example.org");	CODE
LOW⚡	server/src/api/sites/siteTransfers.test.ts	157	{ id: expect.not.stringMatching(first.body.id), recipient_email: "tay@example.org" },	CODE
LOW	server/src/api/sites/siteTransfers.test.ts	184	request({ params: { siteId: "1" }, body: { email: "tay@example.org" }, user: undefined }),	CODE
LOW	server/src/api/sites/siteTransfers.test.ts	196	expect(shown.body.transfer).toMatchObject({ recipientEmail: "tay@example.org" });	CODE
LOW	server/src/api/sites/siteTransfers.test.ts	222	expect(asMallory.body).toMatchObject({ reason: "wrong_account", recipientEmailHint: "t••@example.org" });	CODE
LOW	server/src/api/sites/siteTransfers.test.ts	223	expect(JSON.stringify(asMallory.body)).not.toContain("tay@example.org");	CODE
LOW	server/src/api/sites/siteTransfers.ts	216	/** "tay@example.org" → "t••@example.org": enough to recognise, not to register. */	COMMENT
LOW	server/src/services/trialGrace/trialGraceEmails.test.ts	78	const org = { id: "org_1", name: "Acme Inc" };	CODE
LOW	server/src/services/trialGrace/trialGraceEmails.test.ts	112	organizationName: "Acme Inc",	CODE
LOW	…/settings/organization/components/CreateUserDialog.tsx	115	placeholder="John Doe"	CODE
LOW	client/src/app/transfer/[transferId]/page.tsx	364	// The server only reveals a masked address, e.g. "t••@example.org".	COMMENT
LOW	…/src/app/[site]/api-playground/utils/endpointConfig.ts	195	email: "user@example.com",	CODE
LOW	client/src/components/OrganizationSelector.tsx	50	<SelectItem value="placeholder" disabled>	CODE

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	server/public/rrweb.min.js	80	***************************************************************************** */function Fn(s,e){var t=typeof Symbol=="f	CODE
CRITICAL	docs/src/lib/agent-readiness.test.ts	166	assert.ok(document.components.schemas.ApiError.required.includes("resolution"));	CODE

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/docker-publish.yml	70	# Create a temporary directory to store digests	COMMENT
MEDIUM	.github/workflows/docker-publish.yml	133	# Create a temporary directory to store digests	COMMENT
MEDIUM	.github/workflows/docker-publish.yml	205	# Create a manifest list and push to GHCR	COMMENT
MEDIUM	.github/workflows/docker-publish.yml	242	# Create a manifest list and push to GHCR	COMMENT

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	restart.sh	11	# Check if .env file exists	COMMENT
LOW	setup.sh	82	# Check if domain name argument is provided	COMMENT
LOW	update.sh	20	# Check if .env file exists	COMMENT

AI Slop Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/package-lock.json	11696	"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",	CODE

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ale]/(home)/tools/(social-media-tools)/[slug]/page.tsx	1366	"Yes. The generated names are starting points. Feel free to modify them, combine elements from different sugge	CODE

Modern AI Meta-Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	ops/seo/voice/stories.md	55	- Facts (September 2026): Rybbit ran an A/B test of a new homepage design against the existing one using its own tags; t	CODE

rybbit-io/rybbit

Open-Source Code Quality, Security and Technical Debt Review