1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-28

Last Push

46.9K

Stars

JavaScript

Language

502.5K

Lines of Code

2.4K

Files

401

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 321 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.2/100 · LOW

Are imports declared and package/API names verified? 42 finding(s).

Agent Over-Engineering Ratio 2.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 161 finding(s).

PR Review Velocity Impact 6.4/100 · LOW

Which changes need focused human review? 401 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 20HIGH 6MEDIUM 26LOW 349

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 401 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators20 hits · 205 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ss/test/unit/lib/plugins/aws/remove/lib/bucket.test.js	765	const order = ctx.provider.request.mock.calls.map(([, m]) => m)	CODE
CRITICAL	…ss/test/unit/lib/plugins/aws/remove/lib/bucket.test.js	901	const order = ctx.provider.request.mock.calls.map(([, m, p]) =>	CODE
CRITICAL	…t/lib/plugins/aws/deploy/lib/cleanup-s3-bucket.test.js	146	const batches = ctx.provider.request.mock.calls.map(	CODE
CRITICAL	…unit/lib/plugins/aws/web-apps/compilers/domain.test.js	240	template.Resources.ShopDotexampleDotcomCloudFrontDistribution.Properties.DistributionConfig.CacheBehaviors.map(	CODE
CRITICAL	…unit/lib/plugins/aws/web-apps/compilers/domain.test.js	255	template.Resources.ShopDotexampleDotcomCloudFrontDistribution.Properties.DistributionConfig.Origins.map(	CODE
CRITICAL	…ib/plugins/aws/package/compile/events/schedule.test.js	639	resources.IamRoleLambdaExecution.Properties.AssumeRolePolicyDocument.Statement.find(	CODE
CRITICAL	…/serverless/lib/classes/config-schema-handler/index.js	169	const idx = this.schema.properties.build.anyOf.findIndex(	CODE
CRITICAL⚡	packages/serverless/lib/plugins/python/lib/zip.js	282	this.serverless.service.package.patterns.push('.requirements.zip')	CODE
CRITICAL	packages/serverless/lib/plugins/python/lib/zip.js	104	this.serverless.service.package.patterns.push('unzip_requirements.py')	CODE
CRITICAL	…serverless/lib/plugins/aws/appsync/resources/Schema.js	58	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…/lib/plugins/aws/appsync/resources/PipelineFunction.js	15	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…erless/lib/plugins/aws/appsync/resources/JsResolver.js	12	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…erless/lib/plugins/aws/appsync/resources/JsResolver.js	46	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…erless/lib/plugins/aws/appsync/resources/JsResolver.js	52	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…rverless/lib/plugins/aws/appsync/resources/Resolver.js	79	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…rverless/lib/plugins/aws/appsync/resources/Resolver.js	99	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…s/lib/plugins/aws/appsync/resources/MappingTemplate.js	11	throw new this.api.plugin.serverless.classes.Error(	CODE
CRITICAL	…ess/lib/plugins/aws/package/compile/events/schedule.js	394	resources.IamRoleLambdaExecution.Properties.AssumeRolePolicyDocument.Statement.find(	CODE
CRITICAL	…/lib/plugins/aws/package/compile/events/cloud-front.js	796	Resources.IamRoleLambdaExecution.Properties.AssumeRolePolicyDocument.Statement.find(	CODE
CRITICAL	…aws/package/compile/events/api-gateway/lib/rest-api.js	24	endpointType = this.serverless.service.provider.endpointType.toUpperCase()	CODE

Over-Commented Block134 hits · 134 pts

Severity	File	Line	Snippet	Context
LOW	binary-installer/e2e/concurrent_install_test.go	1	//go:build e2e	COMMENT
LOW	binary-installer/src/version.go	201	// underscores.	COMMENT
LOW	binary-installer/src/version_test.go	601	}	COMMENT
LOW	docs/sf/providers/aws/guide/building.md	41		COMMENT
LOW	docs/sf/providers/aws/guide/building.md	61	#	COMMENT
LOW	docs/sf/providers/aws/guide/building.md	81	# This property can be set to a different number if you wish to limit the	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	21	```yml	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	281	# Set how Lambda controls all functions runtime. AWS default is auto; this can either be 'auto' or 'onFunctionUpdate'.	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	321	# Name of an existing bucket to use. Optional. (default: created by serverless)	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	541	# Required	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	721	# The Application Log Level to be used, case-insensitive. Functions take it only when `logFormat` is `JSON`; web a	COMMENT
LOW	docs/sf/providers/aws/guide/serverless.yml.md	741	# Enable REST API logs	COMMENT
LOW	.devcontainer/devcontainer.json	21	// "forwardPorts": [],	COMMENT
LOW	release-scripts/scripts/publishReleaseToMongo.js	1	import { MongoClient, ServerApiVersion } from 'mongodb'	COMMENT
LOW	packages/util/src/logger/index.js	21	renderer.isInitialized = false	COMMENT
LOW	packages/util/src/logger/index.js	101	//	COMMENT
LOW	…/test/unit/lib/util/logger-progress-plain-path.test.js	1	// Guards the plain (non-animated) progress path. When the spinner cannot render	COMMENT
LOW	…less/test/unit/lib/plugins/agent/build-clients.test.js	1	import { describe, test, expect, jest, beforeEach } from '@jest/globals'	COMMENT
LOW	…serverless/test/unit/lib/plugins/agent/inspect.test.js	1	import { describe, test, expect, jest, beforeEach } from '@jest/globals'	COMMENT
LOW	…/serverless/test/unit/lib/plugins/aws/provider.test.js	201	// Note: getCredentials uses `resolveCredentials` which is complex and uses the chain.	COMMENT
LOW	…erverless/test/unit/lib/plugins/aws/mcp/schema.test.js	1	import { jest } from '@jest/globals'	COMMENT
LOW	…verless/test/unit/lib/plugins/aws/mcp/validate.test.js	521	code: 'MCP_AUTHORIZER_INVALID',	COMMENT
LOW	…/lib/uses-dedicated-per-function-role.lockstep.test.js	1	'use strict'	COMMENT
LOW	…aws/package/lib/iam-empty-collection-invariant.test.js	1	'use strict'	COMMENT
LOW	…aws/package/lib/iam-empty-collection-invariant.test.js	561	provider.naming.getNormalizedFunctionName('kitchenSink') +	COMMENT
LOW	…s/serverless/test/unit/lib/plugins/prune/index.test.js	1601	// is the only candidate. It must be kept via the mapped basename	COMMENT
LOW	…lib/plugins/esbuild/package-patterns-filtering.test.js	601	expect(traces).toHaveLength(1)	COMMENT
LOW	…less/test/unit/lib/plugins/esbuild/build-dedup.test.js	221	expect([...plugin.serverless.builtFunctions]).toEqual(['getItems'])	COMMENT
LOW	…ss/test/unit/lib/plugins/esbuild/project-sweep.test.js	1101	it('MISSES a directory import whose own name has a dot (known limitation)', () => {	COMMENT
LOW	packages/serverless/lib/plugins/agent/inspect.js	1	// The `serverless agent inspect` command plugin: the integration keystone that	COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/select.js	1	// Selection: given the discovered-resource index (discover-resources.js's	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	1	// The client factory: supplies the real `invoke(awsService, commandName,	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	21	// })	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	41	// instance is constructed per (awsService, region) and cached for the life	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	61	// bucket's remaining calls. A `LocationConstraint` of '' or null means	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	121	import * as KinesisSdk from '@aws-sdk/client-kinesis'	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	281	*/	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/build-clients.js	361	// denied location call nuking every sibling call for the bucket. The	COMMENT
LOW	…serverless/lib/plugins/agent/lib/discover-resources.js	1	// Discovery: turns a deployed CloudFormation stack into the flat resource	COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	1	// The call runner: given a registry entry (see lib/registry/index.js) plus a	COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	21	// This cleanly decouples this runner from build-clients.js's client factory:	COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	81		COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	301		COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	321	// result stored under that key (e.g. apigatewayv2 `routeResponses` fans out	COMMENT
LOW	packages/serverless/lib/plugins/agent/lib/run-calls.js	401	// ---------------------------------------------------------------------------	COMMENT
LOW	…verless/lib/plugins/agent/lib/registry/apigatewayv2.js	41	// needs BOTH the outer ApiId AND a per-route RouteId, so it's a cross-call	COMMENT
LOW	…ges/serverless/lib/plugins/agent/lib/registry/index.js	1	// The resource registry: the single source of truth mapping a	COMMENT
LOW	…kages/serverless/lib/plugins/agent/lib/registry/iam.js	21	// Field on the ListRolePolicies response holding the names to fan	COMMENT
LOW	…kages/serverless/lib/plugins/agent/lib/registry/iam.js	41	// {	COMMENT
LOW	…less/lib/plugins/agent/lib/registry/lambda-microvms.js	1	// Registry entries for the `lambda-microvms` AWS service (alias	COMMENT
LOW	…ages/serverless/lib/plugins/agent/lib/registry/logs.js	1	// Registry entry for the `logs` AWS service (CloudWatch Logs).	COMMENT
LOW	…erverless/lib/plugins/agent/lib/registry/lambda-web.js	1	// Registry entries for the `lambda-web` AWS service -- the Lambda Web	COMMENT
LOW	…lugins/aws/sandboxes/dev/api-emulator/control-plane.js	281	// Lead with the short tag (matches this VM's streamed log prefix, so the two correlate); keep	COMMENT
LOW	…ugins/aws/sandboxes/dev/api-emulator/container-logs.js	1	'use strict'	COMMENT
LOW	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	161	// For s3://: use the literal URI string.	COMMENT
LOW	…ss/lib/plugins/aws/bedrock-agentcore/docker/builder.js	141	*/	COMMENT
LOW	…verless/lib/plugins/aws/bedrock-agentcore/dev/index.js	61	#roleArn	COMMENT
LOW	…ss/lib/plugins/aws/utils/get-s3-endpoint-for-region.js	1	export default function getS3EndpointForRegion(region) {	COMMENT
LOW	packages/serverless/lib/plugins/aws/mcp/index.js	41	// the entry is a build product, absent from a fresh checkout until	COMMENT
LOW	packages/serverless/lib/plugins/aws/mcp/index.js	101	// The window for the handler swap opens the moment esbuild's packaging	COMMENT
74 more matches not shown…

Hyper-Verbose Identifiers123 hits · 123 pts

Severity	File	Line	Snippet	Context
LOW	packages/util/src/proxy/aws.js	53	function shouldAwsEndpointsBypassProxy() {	CODE
LOW	…/serverless/test/unit/lib/plugins/agent/select.test.js	512	async function discoverWithMicrovmResources() {	CODE
LOW	…/serverless/test/unit/lib/plugins/agent/select.test.js	595	async function discoverWithWebAppResources() {	CODE
LOW	…less/test/unit/lib/plugins/agent/build-clients.test.js	19	function makeFakeEngineClientClass(name, clientProp = 'client') {	CODE
LOW	…s/aws/sandboxes/dev/api-emulator/control-plane.test.js	30	function recordingContainerManager(containers) {	CODE
LOW	…plugins/aws/sandboxes/compilation/orchestrator.test.js	419	async function orchestrateWithOperatorRole(operatorRole) {	CODE
LOW	…lib/plugins/esbuild/package-patterns-filtering.test.js	752	function makeServiceDirWithUnreadableExcludedEntry() {	CODE
LOW	…plugins/esbuild/nobundle-partition-concurrency.test.js	57	function makeThreePartitionService() {	CODE
LOW	packages/serverless/lib/plugins/python/lib/poetry.js	12	async function pyprojectTomlToRequirements(modulePath, pluginInstance) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/pip.js	29	function prependUvBootstrapCommands(pipCmds) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/pip.js	612	function getPackageNameFromPyproject(packagePath) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/pip.js	632	function getLocalPackagesFromRequirements(requirementsPath, servicePath) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/pip.js	801	async function installRequirementsIfNeeded(	CODE
LOW	packages/serverless/lib/plugins/python/lib/pipenv.js	138	function removeEditableFlagFromRequirementsString(requirementBuffer) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/shared.js	14	function checkForAndDeleteMaxCacheVersions({ serverless, options, log }) {	CODE
LOW	packages/serverless/lib/plugins/python/lib/shared.js	98	function getRequirementsWorkingPath(	CODE
LOW	packages/serverless/lib/plugins/agent/lib/select.js	89	function resolveSelectedCategories(options) {	CODE
LOW	packages/serverless/lib/plugins/agent/lib/select.js	179	function computeInlineFunctionRole(selected) {	CODE
LOW	packages/serverless/lib/plugins/observability/index.js	11	export function determineObservabilityProviderFromConfig(	CODE
LOW	packages/serverless/lib/plugins/observability/index.js	43	function determineStageSpecificObservabilityProvider(observability, app) {	CODE
LOW	…erverless/lib/plugins/observability/dashboard/index.js	10	export function isDashboardObservabilityEnabled(configurationInput, stageName) {	CODE
LOW	…ess/lib/plugins/aws/sandboxes/utils/failure-context.js	14	export function getSandboxVersionLimitContext(serverless, event) {	CODE
LOW	…verless/lib/plugins/aws/sandboxes/dev/iam-emulation.js	19	function findDevPolicyStatementIndex(trustPolicy) {	CODE
LOW	…ib/plugins/aws/domains/models/web-app-domain-config.js	36	export function getApiGatewayOnlyFieldMessages(config, path) {	CODE
LOW	…ib/plugins/aws/domains/models/web-app-domain-config.js	51	export function getMissingHostnameMessage(path, config) {	CODE
LOW	…ib/plugins/aws/domains/models/web-app-domain-config.js	63	export function getUnremovedRecordsMessage(config) {	CODE
LOW	…less/lib/plugins/aws/bedrock-agentcore/utils/naming.js	32	export function getNormalizedResourceName(resourceName) {	CODE
LOW	…erless/lib/plugins/aws/bedrock-agentcore/utils/tags.js	18	export function tagsToCloudFormationArray(tags) {	CODE
LOW	…erless/lib/plugins/aws/bedrock-agentcore/utils/tags.js	28	export function cloudFormationArrayToTags(tagsArray) {	CODE
LOW	…less/lib/plugins/aws/bedrock-agentcore/iam/policies.js	828	export function generateCodeInterpreterRole(name, config, context) {	CODE
LOW	…s/lib/plugins/aws/bedrock-agentcore/dev/credentials.js	59	export function getCredentialExpirationMinutes(credentials) {	CODE
LOW	…s/lib/plugins/aws/bedrock-agentcore/dev/credentials.js	76	export function findDevPolicyStatementIndex(trustPolicy) {	CODE
LOW	…s/lib/plugins/aws/bedrock-agentcore/dev/credentials.js	224	export async function resolveCallerPrincipalArn(stsArn, getRoleArn) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	112	function buildNetworkConfiguration(network = {}) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	134	function buildAuthorizerConfiguration(authorizer) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	172	function buildLifecycleConfiguration(lifecycle) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	196	function buildProtocolConfiguration(protocol) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	214	function buildEnvironmentVariables(environment) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/runtime.js	224	function buildRequestHeaderConfiguration(requestHeaders) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/gateway.js	36	export function buildGatewayAuthorizerConfiguration(authConfig) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/gateway.js	80	export function buildGatewayProtocolConfiguration(protocolConfig) {	CODE
LOW	…lib/plugins/aws/bedrock-agentcore/compilers/browser.js	35	export function buildBrowserNetworkConfiguration(network = {}) {	CODE
LOW	…ins/aws/bedrock-agentcore/compilers/codeInterpreter.js	33	export function buildCodeInterpreterNetworkConfiguration(network = {}) {	CODE
LOW	…ugins/aws/bedrock-agentcore/compilers/gatewayTarget.js	84	export function buildCredentialProviderConfigurations(credentials) {	CODE
LOW	…ugins/aws/bedrock-agentcore/compilers/gatewayTarget.js	146	export function transformSchemaToCloudFormation(schema) {	CODE
LOW	…gins/aws/bedrock-agentcore/compilation/orchestrator.js	48	export function compileAgentCoreResources(config) {	CODE
LOW	…gins/aws/bedrock-agentcore/compilation/orchestrator.js	854	export function compileCodeInterpreterResources(	CODE
LOW	…s/serverless/lib/plugins/aws/custom-resources/index.js	16	async function addCustomResourceToService(	CODE
LOW	…resources/resources/cognito-user-pool/lib/user-pool.js	19	function getUpdateConfigFromCurrentSetup(currentSetup) {	CODE
LOW	…m-resources/resources/event-bridge/lib/event-bridge.js	87	async function updateTargetConfiguration(config) {	CODE
LOW	…m-resources/resources/event-bridge/lib/event-bridge.js	126	async function removeTargetConfiguration(config) {	CODE
LOW	…kages/serverless/lib/plugins/aws/lib/invoke-options.js	41	export function assertInvokeOptionsAvailable(options) {	CODE
LOW	…ss/lib/plugins/aws/lib/function-replacement-context.js	16	export function getFunctionReplacementContext(event) {	CODE
LOW	…ess/lib/plugins/aws/lib/get-function-artifact-paths.js	29	export async function resolveFunctionArtifactPaths(serverless, packagePath) {	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	117	def get_remaining_time_in_millis(self):	CODE
LOW	…erverless/lib/plugins/aws/web-apps/compilers/domain.js	41	export function getDistributionLogicalIds(hostname) {	CODE
LOW	…erverless/lib/plugins/aws/web-apps/compilers/domain.js	184	function compileOriginAccessControl({ functionName, region }) {	CODE
LOW	…erverless/lib/plugins/aws/package/compile/functions.js	1470	function extractLayerConfigurationsFromFunction(	CODE
LOW	…kage/compile/events/api-gateway/lib/usage-plan-keys.js	4	function createUsagePlanKeyResource(	CODE
LOW	…ge/compile/events/api-gateway/lib/hack/update-stage.js	118	function resolveApiGatewayResource(resources) {	CODE
63 more matches not shown…

Decorative Section Separators22 hits · 66 pts

Severity	File	Line	Snippet	Context
MEDIUM	…less/test/unit/lib/plugins/aws/sandboxes/index.test.js	492	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…less/test/unit/lib/plugins/aws/sandboxes/index.test.js	497	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…less/test/unit/lib/plugins/aws/sandboxes/index.test.js	549	// ── Minimal sandbox (mini) ──────────────────────────────────────────────────	COMMENT
MEDIUM	…less/test/unit/lib/plugins/aws/sandboxes/index.test.js	676	// ── Full sandbox (full) ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…less/test/unit/lib/plugins/aws/sandboxes/index.test.js	849	// ── Cross-cutting template shape ────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	143	// ── Base image ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	149	// ── Code artifact (compute only — no S3 upload) ─────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	182	// ── IAM roles ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	202	// ── VPC / NetworkConnector ───────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	225	// ── Compile image ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	268	// ── Merge into template ──────────────────────────────────────────────────	COMMENT
MEDIUM	…/lib/plugins/aws/sandboxes/compilation/orchestrator.js	326	// ── Tags ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	188	// ── 1. Deploy ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	212	// ── 2. Validate resources ──────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	277	// ── 3. Observability ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	304	// ── 3b. Kitchen sink ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	329	// ── 4. Invoke ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	447	// ── 5. invoke --sandbox ────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	475	// ── 6. logs --sandbox ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	500	// ── 7. IAM emulation ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	556	// ── 8. Remove ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/sf-core/tests/integration/sandboxes/sandboxes.test.js	558	// ── Image versions and artifacts ───────────────────────────────────────────	COMMENT

Structural Annotation Overuse33 hits · 50 pts

Severity	File	Line	Snippet	Context
LOW	docs/sf/providers/aws/guide/domains.md	530	### Step 1: Create SSL Certificate Manually	COMMENT
LOW	docs/sf/providers/aws/guide/domains.md	539	### Step 2: Configure Serverless Framework	COMMENT
LOW	docs/sf/providers/aws/guide/domains.md	565	### Step 3: Create DNS Records Manually	COMMENT
LOW	docs/sf/guides/dashboard/cicd/README.md	38	### Step 1: Link your AWS Account	COMMENT
LOW	docs/sf/guides/dashboard/cicd/README.md	44	### Step 2: Connect to Github	COMMENT
LOW	docs/sf/guides/dashboard/cicd/README.md	59	### Step 3: Deploy from a Github branch	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/clean.js	13	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/clean.js	27	// Step 2: Separate functions by packaging mode	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/clean.js	47	// Step 3: Add cleanup artifacts for individually packaged functions	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/clean.js	53	// Step 4: Add cleanup artifacts for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	926	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	940	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	960	// Step 3: Install requirements for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	1003	// Step 4: Install requirements for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	1029	// Step 5: Install requirements for agents (always ARM64, always individual)	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	118	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	132	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	152	// Step 3: Handle module relocation for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	169	// Step 4: Inject requirements into individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	190	// Step 5: Inject requirements into shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	210	// Step 6: Inject requirements into agent packages	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/zip.js	273	// Step 4: Pack requirements for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	31	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	45	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	69	// Step 3: Add helper for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	91	// Step 4: Add helper for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	120	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	134	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	154	// Step 3: Remove helper from individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	177	// Step 4: Remove helper from shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	201	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	215	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	235	// Step 3: Pack requirements for individually packaged functions	COMMENT

Verbosity Indicators27 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	packages/serverless/lib/plugins/python/lib/clean.js	13	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/clean.js	27	// Step 2: Separate functions by packaging mode	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/clean.js	47	// Step 3: Add cleanup artifacts for individually packaged functions	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/clean.js	53	// Step 4: Add cleanup artifacts for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	926	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	940	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	960	// Step 3: Install requirements for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	1003	// Step 4: Install requirements for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/pip.js	1029	// Step 5: Install requirements for agents (always ARM64, always individual)	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	118	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	132	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	152	// Step 3: Handle module relocation for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	169	// Step 4: Inject requirements into individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	190	// Step 5: Inject requirements into shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/inject.js	210	// Step 6: Inject requirements into agent packages	COMMENT
LOW⚡	packages/serverless/lib/plugins/python/lib/zip.js	273	// Step 4: Pack requirements for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	31	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	45	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	69	// Step 3: Add helper for individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	91	// Step 4: Add helper for shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	120	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	134	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	154	// Step 3: Remove helper from individually packaged functions	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	177	// Step 4: Remove helper from shared package	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	201	// Step 1: Get all Python functions and set default module	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	215	// Step 2: Separate functions by packaging mode	COMMENT
LOW	packages/serverless/lib/plugins/python/lib/zip.js	235	// Step 3: Pack requirements for individually packaged functions	COMMENT

Empty Error Handlers6 hits · 30 pts

Severity	File	Line	Snippet	Context
HIGH	…ess/lib/plugins/aws/dev/local/clients/python_client.py	91	except ValueError:	CODE
HIGH	…ess/lib/plugins/aws/dev/local/clients/python_client.py	437	except Exception:	CODE
HIGH	…ess/lib/plugins/aws/dev/local/clients/python_client.py	441	except Exception:	CODE
HIGH	…ess/lib/plugins/aws/dev/local/clients/python_client.py	365	except OSError:	CODE
HIGH	…ess/lib/plugins/aws/dev/local/clients/python_client.py	511	except GONE:	CODE
HIGH	…ib/plugins/aws/invoke-local/runtime-wrappers/invoke.py	92	except (OSError, subprocess.CalledProcessError):	CODE

Unused Imports21 hits · 21 pts

Severity	File	Line	Context
LOW	…_level_individually_all_individual/module2/handler2.py	1	CODE
LOW	…_level_individually_all_individual/module1/handler1.py	1	CODE
LOW	…unction_level_individually_subdirs/module2/handler2.py	1	CODE
LOW	…unction_level_individually_subdirs/module1/handler1.py	1	CODE
LOW	…re/tests/python/tests/individually/module2/handler2.py	1	CODE
LOW	…re/tests/python/tests/individually/module1/handler1.py	1	CODE
LOW	…sts/function_level_individually_slim/handler_shared.py	1	CODE
LOW	…function_level_individually_slim/handler_individual.py	1	CODE
LOW	…/tests/function_level_individually_mixed_rt/handler.py	1	CODE
LOW	…unction_level_individually_mixed_pkg/handler_shared.py	1	CODE
LOW	…ion_level_individually_mixed_pkg/handler_individual.py	1	CODE
LOW	…n/tests/individually_mixed_runtime/module2/handler2.py	1	CODE
LOW	…unction_level_individually_zip_mixed/handler_shared.py	1	CODE
LOW	…ion_level_individually_zip_mixed/handler_individual.py	1	CODE
LOW	…hon/tests/function_level_individually_basic/handler.py	1	CODE
LOW	…ore/tests/python/tests/mixed_runtime_shared/handler.py	1	CODE
LOW	…function_level_individually_override/handler_shared.py	1	CODE
LOW	…tion_level_individually_override/handler_individual.py	1	CODE
LOW	…tests/function_level_individually_zip_basic/handler.py	1	CODE
LOW	…tests/function_level_individually_multiple/handler2.py	1	CODE
LOW	…tests/function_level_individually_multiple/handler1.py	1	CODE

Excessive Try-Catch Wrapping10 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	183	except Exception:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	244	except Exception as error:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	288	except Exception as error:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	295	except Exception as error:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	316	except Exception as error:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	437	except Exception:	CODE
LOW	…ess/lib/plugins/aws/dev/local/clients/python_client.py	441	except Exception:	CODE
MEDIUM	…ess/lib/plugins/aws/dev/local/clients/python_client.py	180	def text_of(value):	CODE
LOW	…ests/integration/mcp-cognito-prerequisite/template.yml	182	except Exception as error:	CODE
MEDIUM	…ests/integration/mcp-cognito-prerequisite/template.yml	166	def handler(event, context):	CODE

Modern AI Meta-Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/sf/providers/aws/guide/serverless.yml.md	37	# This is the name of your project/app/service/microservice (it's scope is up to you).	COMMENT
MEDIUM	packages/serverless/lib/plugins/agent/lib/select.js	6	// Replaces the stale single-axis scaffold (select-categories.js), which	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…ages/sf-core-installer/tests/e2e/proxy-only-network.sh	8	# Set E2E_LOG_DIR to keep the proxy and registry logs.	COMMENT

Slop Phrases1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…/lib/plugins/aws/package/compile/events/cloud-front.js	380	"Don't forget to manually remove your Lambda@Edge functions ",	CODE

Fake / Example Data1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…-core/tests/unit/utils/fs/get-config-file-path.test.js	9	await writeFile(path.join(dir, fileName), 'placeholder')	CODE

serverless/serverless

Open-Source Code Quality, Security and Technical Debt Review