Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 16.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 219 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 22.1/100 · LOW

Which changes need focused human review? 219 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 219

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 219 distinct pattern matches across 1 syntactic category. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block219 hits · 158 pts

Severity	File	Line	Snippet	Context
LOW	serde_core/src/std_error.rs	1	use crate::lib::{Debug, Display};	COMMENT
LOW	serde_core/src/std_error.rs	21	/// impl std::error::Error for MySerError {}	COMMENT
LOW	serde_core/src/lib.rs	1	//! Serde is a framework for *serializing and de*serializing Rust data	COMMENT
LOW	serde_core/src/lib.rs	21	//! <br>	COMMENT
LOW	serde_core/src/lib.rs	41	// Show which crate feature enables conditionally compiled APIs in documentation.	COMMENT
LOW	serde_core/src/macros.rs	1	// Super explicit first paragraph because this shows up at the top level and	COMMENT
LOW	serde_core/src/macros.rs	21	/// #	COMMENT
LOW	serde_core/src/macros.rs	41	/// # }	COMMENT
LOW	serde_core/src/macros.rs	61	/// {	COMMENT
LOW	serde_core/src/macros.rs	81	/// # use serde::forward_to_deserialize_any;	COMMENT
LOW	serde_core/src/macros.rs	101	/// tuple_struct map struct enum identifier ignored_any	COMMENT
LOW	serde_core/src/private/string.rs	1	use crate::lib::*;	COMMENT
LOW	serde_core/src/de/mod.rs	1	//! Generic data structure deserialization framework.	COMMENT
LOW	serde_core/src/de/mod.rs	21	//! In rare cases it may be necessary to implement [`Deserialize`] manually for	COMMENT
LOW	serde_core/src/de/mod.rs	41	//! serialization. Some types can be serialized by Serde but not deserialized.	COMMENT
LOW	serde_core/src/de/mod.rs	61	//! - Box\<str\>	COMMENT
LOW	serde_core/src/de/mod.rs	81	//! - FFI types:	COMMENT
LOW	serde_core/src/de/mod.rs	101	//! - SocketAddrV6	COMMENT
LOW	serde_core/src/de/mod.rs	141	/// currently running.	COMMENT
LOW	serde_core/src/de/mod.rs	161	diagnostic::on_unimplemented(	COMMENT
LOW	serde_core/src/de/mod.rs	181	/// # }	COMMENT
LOW	serde_core/src/de/mod.rs	201	///	COMMENT
LOW	serde_core/src/de/mod.rs	221	/// This is the value that was present in the input file or other source	COMMENT
LOW	serde_core/src/de/mod.rs	301	}	COMMENT
LOW	serde_core/src/de/mod.rs	321	/// #	COMMENT
LOW	serde_core/src/de/mod.rs	421	StructVariant => formatter.write_str("struct variant"),	COMMENT
LOW	serde_core/src/de/mod.rs	441	/// # use serde::de::{self, Unexpected, Visitor};	COMMENT
LOW	serde_core/src/de/mod.rs	461	///	COMMENT
LOW	serde_core/src/de/mod.rs	521	/// automatically generate `Deserialize` implementations for structs and enums	COMMENT
LOW	serde_core/src/de/mod.rs	541	/// deserializer lifetimes] for a more detailed explanation of these lifetimes.	COMMENT
LOW	serde_core/src/de/mod.rs	561	fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>	COMMENT
LOW	serde_core/src/de/mod.rs	581	/// documentation because it is almost never what newbies are looking for.	COMMENT
LOW	serde_core/src/de/mod.rs	601	/// owned data.	COMMENT
LOW	serde_core/src/de/mod.rs	621	/// The relationship between `Deserialize` and `DeserializeOwned` in trait	COMMENT
LOW	serde_core/src/de/mod.rs	641	/// deserialize a JSON array into a `Vec<T>` but it would be a freshly allocated	COMMENT
LOW	serde_core/src/de/mod.rs	661	///	COMMENT
LOW	serde_core/src/de/mod.rs	681	/// borrowed by `Self::Value` when deserialized. See the page [Understanding	COMMENT
LOW	serde_core/src/de/mod.rs	701	/// // append array elements onto the end of an existing vector. The preexisting	COMMENT
LOW	serde_core/src/de/mod.rs	721	/// // input.	COMMENT
LOW	serde_core/src/de/mod.rs	741	/// }	COMMENT
LOW	serde_core/src/de/mod.rs	761	/// T: Deserialize<'de>,	COMMENT
LOW	serde_core/src/de/mod.rs	781	/// }	COMMENT
LOW	serde_core/src/de/mod.rs	821	fn deserialize<D>(self, deserializer: D) -> Result<T, D::Error>	COMMENT
LOW	serde_core/src/de/mod.rs	841	/// these various types.	COMMENT
LOW	serde_core/src/de/mod.rs	861	/// - The type of `()` in Rust. It represents an anonymous value containing	COMMENT
LOW	serde_core/src/de/mod.rs	881	/// `[u64; 10]`.	COMMENT
LOW	serde_core/src/de/mod.rs	901	/// know that it is seeing a map. If the data format supports	COMMENT
LOW	serde_core/src/de/mod.rs	921	/// others.	COMMENT
LOW	serde_core/src/de/mod.rs	941	diagnostic::on_unimplemented(	COMMENT
LOW	serde_core/src/de/mod.rs	1041	fn deserialize_char<V>(self, visitor: V) -> Result<V::Value, Self::Error>	COMMENT
LOW	serde_core/src/de/mod.rs	1061	/// data, indicate that to the `Deserializer` by using `deserialize_str`	COMMENT
LOW	serde_core/src/de/mod.rs	1181	/// Deserializers for non-self-describing formats may not support this mode.	COMMENT
LOW	serde_core/src/de/mod.rs	1201	/// # impl Timestamp {	COMMENT
LOW	serde_core/src/de/mod.rs	1221	/// # unimplemented!()	COMMENT
LOW	serde_core/src/de/mod.rs	1241	/// }	COMMENT
LOW	serde_core/src/de/mod.rs	1261	where	COMMENT
LOW	serde_core/src/de/mod.rs	1281	///	COMMENT
LOW	serde_core/src/de/mod.rs	1301	/// E: de::Error,	COMMENT
LOW	serde_core/src/de/mod.rs	1321	/// Format a message stating what data this Visitor expects to receive.	COMMENT
LOW	serde_core/src/de/mod.rs	1501	/// The input contains a `char`.	COMMENT
159 more matches not shown…

serde-rs/serde

Open-Source Code Quality, Security and Technical Debt Review