A bidirectional Markdown to HTML to Markdown converter written in Javascript
This report summarizes scanner evidence for showdownjs/showdown, a JavaScript project with 14,874 GitHub stars. SynthScan examined 85,668 lines of code across 507 source files, recording 152 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 2.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 46 finding(s).
Are imports declared and package/API names verified? 106 finding(s).
Are wrappers, guards, and repeated structures necessary? 3 finding(s).
Which changes need focused human review? 152 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 152 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/performance.testfile.md | 971 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, | CODE |
| LOW | test/performance.testfile.md | 971 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, | CODE |
| LOW | test/performance.testfile.md | 1797 | * This is a list item with two paragraphs. Lorem ipsum dolor | COMMENT |
| LOW | test/performance.testfile.md | 1808 | * This is a list item with two paragraphs. Lorem ipsum dolor | COMMENT |
| LOW⚡ | test/functional/makehtml/cases/karlcow.testsuite.json | 764 | "markdown": "* This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing e | CODE |
| LOW⚡ | test/functional/makehtml/cases/karlcow.testsuite.json | 765 | "html": "<ul>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing | CODE |
| LOW⚡ | test/functional/makehtml/cases/karlcow.testsuite.json | 774 | "markdown": "* This is a list item with two paragraphs. Lorem ipsum dolor\n→sit amet, consectetuer adipiscing elit | CODE |
| LOW⚡ | test/functional/makehtml/cases/karlcow.testsuite.json | 775 | "html": "<ul>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 916 | "markdown": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iacul | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 916 | "markdown": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iacul | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 917 | "html": "<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculi | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 917 | "html": "<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculi | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 956 | "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prett | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 956 | "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prett | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 957 | "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"htt | CODE |
| LOW⚡ | test/functional/makehtml/cases/features.testsuite.json | 957 | "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"htt | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 315 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elit | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 315 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elit | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 316 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 316 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 327 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 327 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 328 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 328 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 375 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\n Aliquam hendrerit mi posuere lectus. | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 375 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\n Aliquam hendrerit mi posuere lectus. | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 376 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 376 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 381 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 381 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 382 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 382 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 387 | "markdown": "1. This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing e | CODE |
| LOW⚡ | test/functional/makehtml/cases/original.testsuite.json | 388 | "html": "<ol>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 557 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elit | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 557 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elit | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 558 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 558 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 569 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\ | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 569 | "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\ | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 570 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 570 | "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipis | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 626 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 626 | "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 627 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 627 | "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</ | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 632 | "markdown": "1. This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing e | CODE |
| LOW⚡ | test/functional/makehtml/cases/showdown.testsuite.json | 633 | "html": "<ol>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing | CODE |
| LOW⚡ | specs/original.md | 905 | > This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 905 | > This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 911 | <p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 911 | <p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 933 | > This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 933 | > This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 939 | <p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 939 | <p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | specs/original.md | 1057 | * Lorem ipsum dolor sit amet, consectetuer adipiscing elit. | COMMENT |
| LOW⚡ | specs/original.md | 1057 | * Lorem ipsum dolor sit amet, consectetuer adipiscing elit. | COMMENT |
| LOW⚡ | specs/original.md | 1063 | <li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. | CODE |
| LOW⚡ | specs/original.md | 1063 | <li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. | CODE |
| 46 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/unit/showdown.events.js | 621 | // at least once across a feature-rich conversion. This guards against a subparser being added | COMMENT |
| LOW | test/unit/showdown.redos.js | 101 | COMMENT | |
| LOW | test/unit/showdown.redos.js | 121 | // end-of-input for every `\n\n<?` opener with no closer, O(n^2) in the opener count | COMMENT |
| LOW | test/unit/showdown.redos.js | 141 | // remainder, so a run of openers cost one full scan each. An absent-closer check does not | COMMENT |
| LOW | test/functional/makehtml/testsuite.original.js | 21 | let number = testsuite[section][i].number; | COMMENT |
| LOW | docs/requirements.txt | 1 | # Toolchain for building the Showdown documentation site (mkdocs build / serve). | COMMENT |
| LOW | .github/workflows/codeql-analysis.yml | 1 | # For most projects, this workflow file will not need changing; you simply need | COMMENT |
| LOW | .github/workflows/codeql-analysis.yml | 61 | # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines | COMMENT |
| LOW | src/event.js | 261 | // and the document-level event sites in converter.js. Each helper builds a | COMMENT |
| LOW | src/subParsers/makehtml/emoji.js | 81 | scan.appendRaw(otp); | COMMENT |
| LOW | src/subParsers/makehtml/underline.js | 21 | * and code-span backslashes; the scan resolves those constructs before the `_` handler runs, so | COMMENT |
| LOW | src/subParsers/makehtml/strikethrough.js | 41 | }); | COMMENT |
| LOW | src/subParsers/makehtml/strikethrough.js | 61 | // NODES' edge char (a hashed placeholder reads as `¨`/alnum, i.e. non-space-non-tilde, matching how | COMMENT |
| LOW | src/subParsers/makehtml/autolink.js | 21 | // sets lastIndex before exec and the parse is not re-entrant within a single string. | COMMENT |
| LOW | src/subParsers/makehtml/taskListItem.js | 21 | } | COMMENT |
| LOW | src/subParsers/makehtml/ghMentions.js | 81 | // the legacy link.js policy (LEGACY_ANCHOR_URL_POLICY) so these anchors stay byte-identical to | COMMENT |
| LOW | src/subParsers/makehtml/emphasis.js | 41 | // for the lookaround only). | COMMENT |
| LOW | src/subParsers/makehtml/emphasis.js | 61 | // Strikethrough pairing (place c): resolve tilde-run nodes inside this emphasis span into `<del>`, | COMMENT |
| LOW | src/subParsers/makehtml/table.js | 21 | // | COMMENT |
| LOW | src/subParsers/makehtml/spanGamut.js | 21 | * links, images, code spans and emphasis/strong spans it builds emit their own `makehtml.link.*` / | COMMENT |
| LOW | src/subParsers/makehtml/spanGamut.js | 381 | showdown.subParser('makehtml.spanGamut', function (text, options, globals) { | COMMENT |
| LOW | src/subParsers/makehtml/spanGamut.js | 401 | autoLinkOn = !options.cmSpec && !!options.simplifiedAutoLink, | COMMENT |
| LOW | src/subParsers/makehtml/spanGamut.js | 441 | // emoji / strikethrough passes here any more. | COMMENT |
| LOW | src/subParsers/makehtml/disallowedHtmlTags.js | 61 | // matched here: matching it would strip characters out of the escaped text and leave | COMMENT |
| LOW | src/subParsers/makehtml/githubCodeBlock.js | 21 | COMMENT | |
| LOW | src/subParsers/makehtml/rawHtml.js | 21 | // simplifiedAutoLink naked-URL post-pass (mirrors the "hash the whole <a>" step legacy | COMMENT |
| LOW | src/subParsers/makehtml/heading.js | 181 | // list/block-quote parsers in blockGamut, a `-` underline would otherwise steal | COMMENT |
| LOW | src/subParsers/makehtml/heading.js | 221 | // - a one-line capture -> resolveOneLinerFalsePositive (HR edge / one-liner list / | COMMENT |
| LOW | src/subParsers/makehtml/heading.js | 321 | line1 = ''; | COMMENT |
| LOW | src/subParsers/makehtml/nakedUrl.js | 161 | return showdown.helper.writeAnchorTag(subEvtName, pattern, wholeMatch, text, linkId, url, title, emptyCase, | COMMENT |
| LOW | src/subParsers/makemarkdown/input.js | 21 | // leads a list item, so a naked checkbox (top level, or inside a `<p>`/`<div>`) would | COMMENT |
| LOW | src/helpers/hashHTMLSpans.js | 21 | // encodeAmpsAndAngles escapes their `<`/`>`. Inline raw HTML from the SOURCE is recognized | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/functional/makehtml/cases/features.testsuite.json | 666 | "markdown": " ## markdown doc\n \n you can use markdown for card documentation\n - foo\n | CODE |
| MEDIUM⚡ | test/functional/makehtml/cases/features.testsuite.json | 956 | "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prett | CODE |
| MEDIUM⚡ | test/functional/makehtml/cases/features.testsuite.json | 957 | "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"htt | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/unit/showdown.Converter.js | 127 | // robust to global ordering: an earlier suite may already have tripped the per-process | COMMENT |
| MEDIUM | src/subParsers/makemarkdown/node.js | 74 | // exactly (and is robust against ">" inside attribute values) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/tutorials/markdown-editor-with-showdown.md | 9 | ## Step 1: Prepare project | COMMENT |
| LOW | docs/tutorials/markdown-editor-with-showdown.md | 38 | ## Step 2: Install Showdown | COMMENT |
| LOW | docs/tutorials/markdown-editor-with-showdown.md | 48 | ## Step 3: Update project files | COMMENT |
| LOW | docs/tutorials/markdown-editor-with-showdown.md | 130 | ## Step 4: Check the result | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/subParsers/makehtml/heading.js | 267 | function resolveOneLinerFalsePositive (line1, line4) { | CODE |
| LOW | src/subParsers/makehtml/heading.js | 307 | function resolveMultilineFalsePositive (headingText, line1, line2, line3) { | CODE |
| LOW | src/subParsers/makemarkdown/emphasis.js | 22 | function makeMarkdownWrapMarkerSubParser (name, marker) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/subParsers/makehtml/paragraphs.js | 86 | // we need to check if ghBlock is a false positive | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/subParsers/makemarkdown/table.js | 95 | // TODO: implement <caption> in tables https://developer.mozilla.org/pt-BR/docs/Web/HTML/Element/caption | COMMENT |