Home / sandstorm-io / sandstorm
AI Slop Code RIsk Monitor

sandstorm-io/sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.

5.3 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for sandstorm-io/sandstorm, a JavaScript project with 7,080 GitHub stars. SynthScan examined 99,548 lines of code across 457 source files, recording 431 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 5.3 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.3
Adjusted Signal
5.3
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
7.1K
Stars
JavaScript
Language
99.5K
Lines of Code
457
Files
431
Pattern Hits
2026-10-12
Scan Date
0.02
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 14.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 302 finding(s).

Hallucinated Dependency & Supply Chain Risk 10.4/100 · LOW

Are imports declared and package/API names verified? 128 finding(s).

Agent Over-Engineering Ratio 1.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 22 finding(s).

PR Review Velocity Impact 23.3/100 · LOW

Which changes need focused human review? 431 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 9HIGH 1MEDIUM 6LOW 415

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 431 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block271 hits · 256 pts
SeverityFileLineSnippetContext
LOWinstall.sh1#! /bin/bashCOMMENT
LOWinstall.sh21# The script will ask you whether you're OK with giving it root privileges.COMMENT
LOWinstall.sh181 #COMMENT
LOWinstall.sh641 fiCOMMENT
LOWinstall.sh761COMMENT
LOWinstall.sh1161 # OK! Let's proceed.COMMENT
LOWinstall.sh1381 fail "E_BAD_PACKAGE" "Bad package -- did not contain $BUILD_DIR directory."COMMENT
LOWinstall.sh1401 # pinned Meteor version holds everything else back.COMMENT
LOWinstall.sh1581 # WARNING: This function should only be run if we already knowCOMMENT
LOWmake-bundle.sh1#! /bin/bashCOMMENT
LOWfind-meteor-dev-bundle.sh1#! /bin/bashCOMMENT
LOWfind-meteor-dev-bundle.sh21# users install them separately.COMMENT
LOWshell/server/main.ts1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/server/main.ts21// This file exists to reify load order as we try to move everything to modernCOMMENT
LOWshell/imports/constants.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/db-deprecated.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/demo.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/tapi18n.js1// This file is an indirection that re-exports the tap:i18n API for useCOMMENT
LOWshell/imports/dates.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/install.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/blackrock-payments/constants.js1// Sandstorm BlackrockCOMMENT
LOW…l/imports/blackrock-payments/server/payments-server.js1// Sandstorm BlackrockCOMMENT
LOW…l/imports/blackrock-payments/server/payments-server.js41const HOSTNAME = Url.parse(ROOT_URL).hostname;COMMENT
LOW…l/imports/blackrock-payments/server/payments-server.js321 data.subscriptions.data[0].id);COMMENT
LOW…ports/blackrock-payments/server/payments-api-server.js1// Sandstorm BlackrockCOMMENT
LOW…l/imports/blackrock-payments/client/payments-client.js1// Sandstorm BlackrockCOMMENT
LOW…l/imports/blackrock-payments/client/billingSettings.js1// Sandstorm BlackrockCOMMENT
LOW…ports/blackrock-payments/client/payments-api-client.js1// Sandstorm BlackrockCOMMENT
LOW…ell/imports/blackrock-payments/client/billingPrompt.js1// Sandstorm BlackrockCOMMENT
LOWshell/imports/sandstorm-ui-topbar/topbar.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/sandstorm-ui-topbar/topbar.js421 // Like `startOpen`, but indicates that the initial state of the popup should be "modal", i.e.COMMENT
LOWshell/imports/sandstorm-db/profile.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/sandstorm-db/db.js1// Sandstorm - Personal Cloud SandboxCOMMENT
LOWshell/imports/sandstorm-db/db.js41} else {COMMENT
LOWshell/imports/sandstorm-db/db.js61// A credential identifies a method for authenticating a user, such as an attached Google or GithubCOMMENT
LOWshell/imports/sandstorm-db/db.js81// being a demo user.COMMENT
LOWshell/imports/sandstorm-db/db.js101// invariant that a credetial only be a login credetial for a single account.COMMENT
LOWshell/imports/sandstorm-db/db.js121// terms of service.COMMENT
LOWshell/imports/sandstorm-db/db.js141// reliably determining which users's names are safe to display.COMMENT
LOWshell/imports/sandstorm-db/db.js161Meteor.users.ensureIndexOnServer("services.oidc.id", { sparse: 1 });COMMENT
LOWshell/imports/sandstorm-db/db.js181// isAutoUpdated: This package was downloaded as part of an auto-update. We shouldn't clean it upCOMMENT
LOWshell/imports/sandstorm-db/db.js201// appId: The app ID this package is intended to override (as with Packages.appId).COMMENT
LOWshell/imports/sandstorm-db/db.js221// appMarketingVersion: Human-readable presentation of the app version, e.g. "2.9.17"COMMENT
LOWshell/imports/sandstorm-db/db.js241// do not observe global user IDs, but rather grain-local user IDs, generated when each userCOMMENT
LOWshell/imports/sandstorm-db/db.js261// The following fields *might* also exist. These are temporary hacks used to implement e-mail andCOMMENT
LOWshell/imports/sandstorm-db/db.js281// Contacts are not symmetric. Bob might be one of Alice's contacts even if Alice is not one ofCOMMENT
LOWshell/imports/sandstorm-db/db.js301// _id: String generated as a SHA256 hash of the grain ID, the user ID, a salt generated by theCOMMENT
LOWshell/imports/sandstorm-db/db.js321// token: For a non-UiView capability, the API token that can be used to restore thisCOMMENT
LOWshell/imports/sandstorm-db/db.js341// hasLoaded: Marked as true by the proxy when the underlying UiSession has responded to its firstCOMMENT
LOWshell/imports/sandstorm-db/db.js361// Each contains:COMMENT
LOWshell/imports/sandstorm-db/db.js381COMMENT
LOWshell/imports/sandstorm-db/db.js401// timestamp: File creation time. Used to figure out when the token and file should be wiped.COMMENT
LOWshell/imports/sandstorm-db/db.js421// grainId: The grain servicing this API. (Not present if the API isn't serviced by a grain.)COMMENT
LOWshell/imports/sandstorm-db/db.js441// treated as type AnyPointer, and so encoded as a raw Cap'n Proto message.COMMENT
LOWshell/imports/sandstorm-db/db.js461// verifiedEmail: An VerifiedEmail capability that is implemented by the frontend.COMMENT
LOWshell/imports/sandstorm-db/db.js481// parentToken: If present, then this token represents exactly the capability represented byCOMMENT
LOWshell/imports/sandstorm-db/db.js501// so treat this token the same as "trashed". It is denormalized out of Users forCOMMENT
LOWshell/imports/sandstorm-db/db.js521// illustrate, here is an approximate definition of ApiToken in pseudo Cap'n Proto schema language:COMMENT
LOWshell/imports/sandstorm-db/db.js541// emailVerifier :group {COMMENT
LOWshell/imports/sandstorm-db/db.js561// child :group {COMMENT
211 more matches not shown…
Fake / Example Data119 hits · 130 pts
SeverityFileLineSnippetContext
LOWshell/i18n/fi.i18n.json312 "placeholder": "etsi"CODE
LOWshell/i18n/fi.i18n.json393 "placeholder": "Kirjoita sähköposti osoitteet tai nimet"CODE
LOWshell/i18n/fi.i18n.json477 "placeholder": "https://example.com",CODE
LOWshell/i18n/fi.i18n.json517 "placeholder": "alice@example.com",CODE
LOWshell/i18n/fi.i18n.json641 "placeholder": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",CODE
LOW⚡shell/i18n/fi.i18n.json658 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml"CODE
LOW⚡shell/i18n/fi.i18n.json662 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml/SingleLogoutService"CODE
LOW⚡shell/i18n/fi.i18n.json666 "placeholder": "base64 encoded cert (e.g. MIID...8F==)"CODE
LOWshell/i18n/fi.i18n.json810 "placeholder": "https://example.com/tos",CODE
LOWshell/i18n/fi.i18n.json815 "placeholder": "https://example.com/privacy",CODE
LOWshell/i18n/fi.i18n.json948 "placeholder": "etsi"CODE
LOWshell/i18n/fi.i18n.json1093 "placeholder": "alice@email.com\nbob@example.com",CODE
LOWshell/i18n/fi.i18n.json1338 "placeholder": "etsi"CODE
LOWshell/i18n/fi.i18n.json1438 "placeholder": "koko nimi",CODE
LOWshell/i18n/fi.i18n.json1443 "placeholder": "nimimerkki",CODE
LOWshell/i18n/fi.i18n.json1608 "placeholder": "kirjoita sähköpostiosoite",CODE
LOWshell/i18n/fi.i18n.json1615 "placeholder": "kirjoita kirjautumiskoodisi",CODE
LOWshell/i18n/zh-TW.i18n.json303 "placeholder": "搜尋 "CODE
LOWshell/i18n/zh-TW.i18n.json347 "placeholder": "輸入電郵信箱或姓名"CODE
LOWshell/i18n/zh-TW.i18n.json431 "placeholder": "https://example.com",CODE
LOWshell/i18n/zh-TW.i18n.json471 "placeholder": "alice@example.com",CODE
LOWshell/i18n/zh-TW.i18n.json595 "placeholder": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",CODE
LOW⚡shell/i18n/zh-TW.i18n.json612 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml"CODE
LOW⚡shell/i18n/zh-TW.i18n.json616 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml/SingleLogoutService"CODE
LOW⚡shell/i18n/zh-TW.i18n.json620 "placeholder": "base64 encoded cert (e.g. MIID...8F==)"CODE
LOWshell/i18n/zh-TW.i18n.json764 "placeholder": "https://example.com/tos",CODE
LOWshell/i18n/zh-TW.i18n.json769 "placeholder": "https://example.com/privacy",CODE
LOWshell/i18n/zh-TW.i18n.json897 "placeholder": "搜尋"CODE
LOWshell/i18n/zh-TW.i18n.json1042 "placeholder": "alice@email.com\nbob@example.com",CODE
LOWshell/i18n/zh-TW.i18n.json1286 "placeholder": "搜尋"CODE
LOWshell/i18n/zh-TW.i18n.json1386 "placeholder": "全名",CODE
LOWshell/i18n/zh-TW.i18n.json1391 "placeholder": "網名",CODE
LOWshell/i18n/zh-TW.i18n.json1555 "placeholder": "輸入電郵地址",CODE
LOWshell/i18n/zh-TW.i18n.json1562 "placeholder": "輸入您的認證碼",CODE
LOWshell/i18n/en.i18n.json343 "placeholder": "search"CODE
LOWshell/i18n/en.i18n.json426 "placeholder": "Enter email addresses or names"CODE
LOWshell/i18n/en.i18n.json510 "placeholder": "https://example.com",CODE
LOWshell/i18n/en.i18n.json550 "placeholder": "alice@example.com",CODE
LOWshell/i18n/en.i18n.json674 "placeholder": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",CODE
LOW⚡shell/i18n/en.i18n.json711 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml"CODE
LOW⚡shell/i18n/en.i18n.json715 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml/SingleLogoutService"CODE
LOW⚡shell/i18n/en.i18n.json719 "placeholder": "base64 encoded cert (e.g. MIID...8F==)"CODE
LOWshell/i18n/en.i18n.json867 "placeholder": "https://example.com/tos",CODE
LOWshell/i18n/en.i18n.json872 "placeholder": "https://example.com/privacy",CODE
LOWshell/i18n/en.i18n.json1006 "placeholder": "search"CODE
LOWshell/i18n/en.i18n.json1151 "placeholder": "alice@email.com\nbob@example.com",CODE
LOWshell/i18n/en.i18n.json1396 "placeholder": "search"CODE
LOWshell/i18n/en.i18n.json1496 "placeholder": "full name",CODE
LOWshell/i18n/en.i18n.json1501 "placeholder": "handle",CODE
LOWshell/i18n/en.i18n.json1666 "placeholder": "enter email address",CODE
LOWshell/i18n/en.i18n.json1673 "placeholder": "enter your token",CODE
LOWshell/i18n/zh-CN.i18n.json312 "placeholder": "搜索"CODE
LOWshell/i18n/zh-CN.i18n.json393 "placeholder": "输入电邮地址或姓名"CODE
LOWshell/i18n/zh-CN.i18n.json477 "placeholder": "https://example.com",CODE
LOWshell/i18n/zh-CN.i18n.json517 "placeholder": "alice@example.com",CODE
LOWshell/i18n/zh-CN.i18n.json641 "placeholder": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",CODE
LOW⚡shell/i18n/zh-CN.i18n.json658 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml"CODE
LOW⚡shell/i18n/zh-CN.i18n.json662 "placeholder": "https://YOUR_SAML_PROVIDER.com/sso/saml/SingleLogoutService"CODE
LOW⚡shell/i18n/zh-CN.i18n.json666 "placeholder": "base64 encoded cert (e.g. MIID...8F==)"CODE
LOWshell/i18n/zh-CN.i18n.json810 "placeholder": "https://example.com/tos",CODE
59 more matches not shown…
Hallucination Indicators9 hits · 90 pts
SeverityFileLineSnippetContext
CRITICALshell/imports/sandstorm-db/db.js3152 const result = this.connection.sandstormDb.collections.userActions.findAndModify({CODE
CRITICALshell/imports/server/transfers-server.js49 this.connection.sandstormDb.collections.incomingTransfers.find({userId: this.userId},CODE
CRITICALshell/imports/server/transfers-server.js51 this.connection.sandstormDb.collections.outgoingTransfers.find({userId: this.userId})CODE
CRITICALshell/imports/server/admin-server.js149 this.connection.sandstormDb.collections.settings.upsert({ _id: "organizationMembership" }, { value: params.membershiCODE
CRITICALshell/imports/server/admin-server.js150 this.connection.sandstormDb.collections.settings.upsert({ _id: "organizationSettings" }, { value: params.settings })CODE
CRITICALshell/imports/server/admin-server.js366 this.connection.sandstormDb.collections.setupSession.upsert({CODE
CRITICALshell/imports/client/grain/grainlist-client.js475 const myGrainsCursor = instance.data._db.collections.grains.find({CODE
CRITICALshell/imports/client/grain/grainlist-client.js482 const myTokens = instance.data._db.collections.apiTokens.find({CODE
CRITICAL…torm_readthedocs_modified_theme/js/jquery-2.1.1.min.js4},removeAttr:function(a,b){var c,d,e=0,f=b&&b.match(E);if(f&&1===a.nodeType)while(c=f[e++])d=n.propFix[c]||c,n.expr.matcCODE
Hyper-Verbose Identifiers21 hits · 24 pts
SeverityFileLineSnippetContext
LOWmeteor-bundle-main.js36function monkeypatchHttpForGateway() {CODE
LOWshell/imports/sandstorm-db/db.js2375function appShortDescriptionFromPackage(pkg) {CODE
LOWshell/imports/sandstorm-db/db.js2381function nounPhraseForActionAndAppTitle(action, appTitle) {CODE
LOWshell/imports/sandstorm-identicons/helpers.js112function iconSrcForDenormalizedGrainMetadata(metadata, usage, staticPrefix) {CODE
LOWshell/imports/server/observe-helpers.js17function fillUndefinedForChangedDoc(newDoc, oldDoc) {CODE
LOWshell/imports/server/gateway-router.js665function storeReferralProgramInfoApiTokenCreated(db, accountId, apiTokenAccountId) {CODE
LOWshell/imports/server/gateway-router.js692function referralProgramLogSharingTokenUse(db, bobAccountId) {CODE
LOWshell/imports/server/gateway-router.js750function parsePowerboxDescriptorList(list) {CODE
LOWshell/imports/server/migrations.js744function backgroundFillInGrainSizes(db, backend) {CODE
LOWshell/imports/server/migrations.js858function onePersonaPerAccountPreCleanup(db, _backend) {CODE
LOWshell/imports/server/migrations.js1129function onePersonaPerAccountPostCleanup(db, _backend) {CODE
LOW⚡shell/imports/server/migrations.js1166function cleanupBadExpiresIfUnused(db, _backend) {CODE
LOW⚡shell/imports/server/migrations.js1172function deleteReferralNotifications(db, _backend) {CODE
LOW⚡shell/imports/server/migrations.js1181function deleteHackSessionHttpSetting(db, _backend) {CODE
LOW⚡shell/imports/server/acme.js204function notifyAdminOfCertificateExpiration(expirationDate) {CODE
LOW⚡shell/imports/server/acme.js208function removeAllCertificateExpirationNotifications() {CODE
LOW⚡shell/imports/server/acme.js214function renewCertificateWhenNeeded(certChain) {CODE
LOWshell/imports/server/drivers/external-ui-view.js112function registerHttpApiFrontendRef(registry) {CODE
LOWshell/imports/sandstorm-ui-powerbox/powerbox-server.js194function registerUiViewQueryHandler(frontendRefRegistry) {CODE
LOWshell/imports/client/accounts/account-settings-ui.js1function SandstormAccountSettingsUi(topbar, db, staticHost) {CODE
LOWtests/tests/backup-restore.js56function makeCleanDownloadsDirSync() {CODE
AI Slop Vocabulary3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUM…l/imports/blackrock-payments/server/payments-server.js519 // more robust for us to search for all changes since the last we know about.COMMENT
MEDIUMshell/imports/sandstorm-ui-topbar/topbar.js430 // right, the highest-priority will be *rightmost*. Essentially, higher-priority items tendCOMMENT
MEDIUMshell/imports/server/accounts/saml-utils.js316 // we would probably need to stuff it in Mongo to make it robust across multipleCOMMENT
AI Response Leakage1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHshell/imports/sandstorm-ui-powerbox/powerbox-server.js376 // others, and prefer the most-specific match. For now, though, I've implemented a heuristic:COMMENT
Self-Referential Comments2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMinstall.sh2057 -new `# Create a new certificate/request.` \CODE
MEDIUMinstall.sh2058 -newkey rsa:4096 `# Create a new RSA key of length 4096 bits.` \CODE
Decorative Section Separators1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMinstall.sh574 # ========================================================================================COMMENT
Structural Annotation Overuse2 hits · 3 pts
SeverityFileLineSnippetContext
LOWinstall.sh1542 # WARNING: This function should only be run if we already knowCOMMENT
LOWinstall.sh1581 # WARNING: This function should only be run if we already knowCOMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWinstaller-tests/prepare-for-tests.sh38# Check if Vagrant has plugins we need; if not, we install them.COMMENT
Deep Nesting1 hit · 1 pts
SeverityFileLineSnippetContext
LOWshell/i18n/sync-langs.py45CODE