Legacy full-app React on Rails tutorial repo and live demo. See reactonrails.com/examples for current maintained demos.
This report summarizes scanner evidence for shakacode/react-webpack-rails-tutorial, a JavaScript project with 1,720 GitHub stars. SynthScan examined 14,500 lines of code across 232 source files, recording 81 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 8.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 80 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 4 finding(s).
Which changes need focused human review? 81 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 81 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .overcommit.yml | 1 | # Use this file to configure the Overcommit hooks you wish to use. This will | COMMENT |
| LOW | .overcommit.yml | 21 | # on_warn: fail # Treat all warnings as failures | COMMENT |
| LOW | renderer/node-renderer.js | 41 | workersCount: parseIntegerEnv('RENDERER_WORKERS_COUNT', process.env.CI ? 2 : 3, { min: 0 }), | COMMENT |
| LOW | app/controllers/pages_controller.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/storage.yml | 1 | test: | COMMENT |
| LOW | config/storage.yml | 21 | # credentials: <%= Rails.root.join("path/to/gcs.keyfile") %> | COMMENT |
| LOW | config/application.rb | 21 | # Configuration for the application, engines, and railties goes here. | COMMENT |
| LOW | config/puma.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/puma.rb | 21 | # Global VM Lock (GVL) it has diminishing returns and will degrade the | COMMENT |
| LOW | config/puma.rb | 41 | # Run the Solid Queue supervisor inside of Puma for single-server deployments. | COMMENT |
| LOW | config/database.yml | 1 | # SQLite version 3.x | COMMENT |
| LOW | config/environments/production.rb | 61 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | config/environments/test.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/webpack/commonWebpackConfig.js | 1 | // The source code including full typescript support is available at: | COMMENT |
| LOW | config/initializers/backtrace_silencers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/mime_types.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/wrap_parameters.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/react_on_rails.rb | 21 | # If you are using the same file for client and server rendering, having this set probably does | COMMENT |
| LOW | config/initializers/react_on_rails.rb | 41 | # CLIENT RENDERING OPTIONS | COMMENT |
| LOW | config/initializers/react_on_rails.rb | 61 | COMMENT | |
| LOW | config/initializers/permissions_policy.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/content_security_policy.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/content_security_policy.rb | 21 | # # Generate session nonces for permitted importmap, inline scripts, and inline styles. | COMMENT |
| LOW | config/initializers/inflections.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | config/initializers/cors.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/spec_helper.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/spec_helper.rb | 21 | COMMENT | |
| LOW | spec/spec_helper.rb | 41 | # library (such as bogus or mocha) by changing the `mock_with` option here. | COMMENT |
| LOW | spec/spec_helper.rb | 61 | # - http://myronmars.to/n/dev-blog/2012/06/rspecs-new-expectation-syntax | COMMENT |
| LOW | spec/spec_helper.rb | 81 | # config.profile_examples = 10 | COMMENT |
| LOW | spec/rails_helper.rb | 21 | # run twice. It is recommended that you do not name files matching this glob to | COMMENT |
| LOW | spec/rails_helper.rb | 41 | config.include FactoryBot::Syntax::Methods | COMMENT |
| LOW | spec/rails_helper.rb | 61 | # explicitly tag your specs with their type, e.g.: | COMMENT |
| LOW | .controlplane/templates/postgres.yml | 41 | # | COMMENT |
| LOW | .controlplane/templates/postgres.yml | 61 | #} | COMMENT |
| LOW | .controlplane/templates/postgres.yml | 81 | # | COMMENT |
| LOW | .controlplane/templates/org.yml | 1 | # App secret dictionaries store sensitive information for apps in the | COMMENT |
| LOW | …hub/workflows/cpflow-promote-staging-to-production.yml | 21 | # Space-separated list of HTTP statuses considered healthy. The default accepts 301/302 | COMMENT |
| LOW | .github/workflows/claude.yml | 141 | COMMENT | |
| LOW | db/schema.rb | 1 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| LOW | db/seeds.rb | 1 | # This file should contain all the record creation needed to seed the database with its default values. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/controllers/pages_controller.rb | 9 | # NOTE: The below notes apply if you want to set the value of the props in the controller, as | COMMENT |
| LOW | .claude/commands/address-review.md | 9 | ## Step 1: Determine the Repository | COMMENT |
| LOW | .claude/commands/address-review.md | 17 | ## Step 2: Parse User Input | COMMENT |
| LOW | .claude/commands/address-review.md | 34 | ## Step 3: Fetch Review Comments | COMMENT |
| LOW | .claude/commands/address-review.md | 69 | ## Step 4: Triage Comments | COMMENT |
| LOW⚡ | .claude/commands/address-review.md | 84 | ## Step 5: Create Todo List | COMMENT |
| LOW⚡ | .claude/commands/address-review.md | 94 | ## Step 6: Present Triage to User | COMMENT |
| LOW⚡ | .claude/commands/address-review.md | 104 | ## Step 7: Address Items, Reply, and Resolve | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 73 | ### Step 1: Set Context | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 82 | ### Step 2: Check Workload Status | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 101 | ### Step 3: Check Events | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 112 | ### Step 4: Check Container Logs | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 122 | ### Step 5: Check GVC Environment | COMMENT |
| LOW | .controlplane/docs/debugging-deployment-failures.md | 134 | ### Step 6: Check Dependencies | COMMENT |
| LOW⚡ | .controlplane/docs/debugging-deployment-failures.md | 343 | # Step 1: Create a policy in the PRODUCTION org that grants access to the staging service account | COMMENT |
| LOW⚡ | .controlplane/docs/debugging-deployment-failures.md | 351 | # Step 2: Also grant access to workloads within the GVC | COMMENT |
| LOW⚡ | .controlplane/docs/debugging-deployment-failures.md | 360 | # Step 3: Grant access to view/manage secrets if needed | COMMENT |
| LOW | docs/verify-early-hints-manual.md | 15 | ### Step 1: Open the PR Review App | COMMENT |
| LOW | docs/verify-early-hints-manual.md | 23 | ### Step 2: Look for Early Hints Evidence | COMMENT |
| LOW | docs/verify-early-hints-manual.md | 65 | ### Step 3: Take Screenshots | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/initializers/wrap_parameters.rb | 5 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | config/initializers/permissions_policy.rb | 5 | # Define an application-wide HTTP permissions policy. For further | COMMENT |
| MEDIUM | config/initializers/content_security_policy.rb | 5 | # Define an application-wide content security policy. | COMMENT |
| MEDIUM | spec/rails_helper.rb | 3 | # This file is copied to spec/ when you run "rails generate rspec:install" | COMMENT |
| MEDIUM | db/schema.rb | 1 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| MEDIUM | db/schema.rb | 5 | # This file is the source Rails uses to define your schema when running `bin/rails | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .overcommit.yml | 13 | # For a complete list of options that you can use to customize hooks, see: | COMMENT |
| MEDIUM | spec/spec_helper.rb | 50 | # with RSpec, but feel free to customize to your heart's content. | COMMENT |
| LOW | …les/comments/containers/NonRouterCommentsContainer.jsx | 42 | // Don't forget to actually use connect! | COMMENT |
| LOW | …undles/comments/containers/RouterCommentsContainer.jsx | 41 | // Don't forget to actually use connect! | COMMENT |
| LOW | …bundles/comments/containers/NavigationBarContainer.jsx | 33 | // Don't forget to actually use connect! | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config/environments/production.rb | 61 | # Set this to true and configure the email server for immediate delivery to raise delivery errors. | COMMENT |
| LOW | config/environments/production.rb | 64 | # Set host to be used by links generated in mailer templates. | COMMENT |
| LOW | config/environments/development.rb | 41 | # Set localhost to be used by links generated in mailer templates. | COMMENT |
| LOW | config/environments/test.rb | 41 | # Set host to be used by links generated in mailer templates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/initializers/react_on_rails.rb | 32 | # BREAKING CHANGE in v16: React on Rails 14.2.1 had robust error handling that would | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | spec/requests/server_components_spec.rb | 28 | def discard_blank_frame_lines(body) | CODE |
| LOW | spec/requests/server_components_spec.rb | 33 | def parse_length_prefixed_chunk(body) | CODE |
| LOW | …server-components/components/LiveActivityRefresher.jsx | 43 | function toServerComponentFetchError(error, componentProps) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | check_early_hints.py | 81 | except Exception as e: | CODE |