AI Slop Code Risk Monitor

showdownjs/showdown

SlopCodeMonitor badge for showdownjs/showdown Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A bidirectional Markdown to HTML to Markdown converter written in Javascript

2.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for showdownjs/showdown, a JavaScript project with 14,874 GitHub stars. SynthScan examined 85,668 lines of code across 507 source files, recording 152 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 2.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.5
Adjusted Signal
2.5
Raw Pattern Score
100%
Time Factor
2026-10-29
Last Push
14.9K
Stars
JavaScript
Language
85.7K
Lines of Code
507
Files
152
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 46 finding(s).

Hallucinated Dependency & Supply Chain Risk 8.5/100 · LOW

Are imports declared and package/API names verified? 106 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 3 finding(s).

PR Review Velocity Impact 9.0/100 · LOW

Which changes need focused human review? 152 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 147

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 152 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data106 hits · 152 pts
SeverityFileLineSnippetContext
LOWtest/performance.testfile.md971Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est,CODE
LOWtest/performance.testfile.md971Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est,CODE
LOWtest/performance.testfile.md1797* This is a list item with two paragraphs. Lorem ipsum dolorCOMMENT
LOWtest/performance.testfile.md1808* This is a list item with two paragraphs. Lorem ipsum dolorCOMMENT
LOW⚡test/functional/makehtml/cases/karlcow.testsuite.json764 "markdown": "* This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing eCODE
LOW⚡test/functional/makehtml/cases/karlcow.testsuite.json765 "html": "<ul>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing CODE
LOW⚡test/functional/makehtml/cases/karlcow.testsuite.json774 "markdown": "* This is a list item with two paragraphs. Lorem ipsum dolor\n→sit amet, consectetuer adipiscing elitCODE
LOW⚡test/functional/makehtml/cases/karlcow.testsuite.json775 "html": "<ul>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing CODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json916 "markdown": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json916 "markdown": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json917 "html": "<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculiCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json917 "html": "<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praesent nisi est, \nullamcorper euismod iaculiCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json956 "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prettCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json956 "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prettCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json957 "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"httCODE
LOW⚡test/functional/makehtml/cases/features.testsuite.json957 "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"httCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json315 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elitCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json315 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elitCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json316 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json316 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json327 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json327 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json328 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json328 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json375 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\n Aliquam hendrerit mi posuere lectus.CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json375 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\n Aliquam hendrerit mi posuere lectus.CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json376 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json376 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json381 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json381 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json382 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json382 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json387 "markdown": "1. This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing eCODE
LOW⚡test/functional/makehtml/cases/original.testsuite.json388 "html": "<ol>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json557 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elitCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json557 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\n> consectetuer adipiscing elitCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json558 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json558 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json569 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json569 "markdown": "> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipiscing elit.\CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json570 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json570 "html": "<blockquote>\n<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,\nconsectetuer adipisCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json626 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json626 "markdown": "* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.\n* CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json627 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json627 "html": "<ul>\n<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.\nAliquam hendrerit mi posuere lectus.</CODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json632 "markdown": "1. This is a list item with two paragraphs. Lorem ipsum dolor\n sit amet, consectetuer adipiscing eCODE
LOW⚡test/functional/makehtml/cases/showdown.testsuite.json633 "html": "<ol>\n<li><p>This is a list item with two paragraphs. Lorem ipsum dolor\nsit amet, consectetuer adipiscing CODE
LOW⚡specs/original.md905> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md905> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md911<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md911<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md933> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md933> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md939<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md939<p>This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,CODE
LOW⚡specs/original.md1057* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.COMMENT
LOW⚡specs/original.md1057* Lorem ipsum dolor sit amet, consectetuer adipiscing elit.COMMENT
LOW⚡specs/original.md1063<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.CODE
LOW⚡specs/original.md1063<li>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.CODE
46 more matches not shown…
Over-Commented Block32 hits · 32 pts
SeverityFileLineSnippetContext
LOWtest/unit/showdown.events.js621 // at least once across a feature-rich conversion. This guards against a subparser being addedCOMMENT
LOWtest/unit/showdown.redos.js101COMMENT
LOWtest/unit/showdown.redos.js121 // end-of-input for every `\n\n<?` opener with no closer, O(n^2) in the opener countCOMMENT
LOWtest/unit/showdown.redos.js141 // remainder, so a run of openers cost one full scan each. An absent-closer check does notCOMMENT
LOWtest/functional/makehtml/testsuite.original.js21 let number = testsuite[section][i].number;COMMENT
LOWdocs/requirements.txt1# Toolchain for building the Showdown documentation site (mkdocs build / serve).COMMENT
LOW.github/workflows/codeql-analysis.yml1# For most projects, this workflow file will not need changing; you simply needCOMMENT
LOW.github/workflows/codeql-analysis.yml61 # ✏️ If the Autobuild fails above, remove it and uncomment the following three linesCOMMENT
LOWsrc/event.js261// and the document-level event sites in converter.js. Each helper builds aCOMMENT
LOWsrc/subParsers/makehtml/emoji.js81 scan.appendRaw(otp);COMMENT
LOWsrc/subParsers/makehtml/underline.js21 * and code-span backslashes; the scan resolves those constructs before the `_` handler runs, soCOMMENT
LOWsrc/subParsers/makehtml/strikethrough.js41});COMMENT
LOWsrc/subParsers/makehtml/strikethrough.js61// NODES' edge char (a hashed placeholder reads as `¨`/alnum, i.e. non-space-non-tilde, matching howCOMMENT
LOWsrc/subParsers/makehtml/autolink.js21// sets lastIndex before exec and the parse is not re-entrant within a single string.COMMENT
LOWsrc/subParsers/makehtml/taskListItem.js21 }COMMENT
LOWsrc/subParsers/makehtml/ghMentions.js81 // the legacy link.js policy (LEGACY_ANCHOR_URL_POLICY) so these anchors stay byte-identical toCOMMENT
LOWsrc/subParsers/makehtml/emphasis.js41 // for the lookaround only).COMMENT
LOWsrc/subParsers/makehtml/emphasis.js61 // Strikethrough pairing (place c): resolve tilde-run nodes inside this emphasis span into `<del>`,COMMENT
LOWsrc/subParsers/makehtml/table.js21 //COMMENT
LOWsrc/subParsers/makehtml/spanGamut.js21 * links, images, code spans and emphasis/strong spans it builds emit their own `makehtml.link.*` /COMMENT
LOWsrc/subParsers/makehtml/spanGamut.js381showdown.subParser('makehtml.spanGamut', function (text, options, globals) {COMMENT
LOWsrc/subParsers/makehtml/spanGamut.js401 autoLinkOn = !options.cmSpec && !!options.simplifiedAutoLink,COMMENT
LOWsrc/subParsers/makehtml/spanGamut.js441 // emoji / strikethrough passes here any more.COMMENT
LOWsrc/subParsers/makehtml/disallowedHtmlTags.js61 // matched here: matching it would strip characters out of the escaped text and leaveCOMMENT
LOWsrc/subParsers/makehtml/githubCodeBlock.js21COMMENT
LOWsrc/subParsers/makehtml/rawHtml.js21// simplifiedAutoLink naked-URL post-pass (mirrors the "hash the whole <a>" step legacyCOMMENT
LOWsrc/subParsers/makehtml/heading.js181 // list/block-quote parsers in blockGamut, a `-` underline would otherwise stealCOMMENT
LOWsrc/subParsers/makehtml/heading.js221 // - a one-line capture -> resolveOneLinerFalsePositive (HR edge / one-liner list /COMMENT
LOWsrc/subParsers/makehtml/heading.js321 line1 = '';COMMENT
LOWsrc/subParsers/makehtml/nakedUrl.js161 return showdown.helper.writeAnchorTag(subEvtName, pattern, wholeMatch, text, linkId, url, title, emptyCase,COMMENT
LOWsrc/subParsers/makemarkdown/input.js21 // leads a list item, so a naked checkbox (top level, or inside a `<p>`/`<div>`) wouldCOMMENT
LOWsrc/helpers/hashHTMLSpans.js21 // encodeAmpsAndAngles escapes their `<`/`>`. Inline raw HTML from the SOURCE is recognizedCOMMENT
Slop Phrases3 hits · 8 pts
SeverityFileLineSnippetContext
MEDIUMtest/functional/makehtml/cases/features.testsuite.json666 "markdown": " ## markdown doc\n \n you can use markdown for card documentation\n - foo\n CODE
MEDIUM⚡test/functional/makehtml/cases/features.testsuite.json956 "markdown": "Markdown test adapted from BitBucket\n====================\n\n[Markdown][fireball] for readmes is prettCODE
MEDIUM⚡test/functional/makehtml/cases/features.testsuite.json957 "html": "<h1 id=\"markdown-test-adapted-from-bitbucket\">Markdown test adapted from BitBucket</h1>\n<p><a href=\"httCODE
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtest/unit/showdown.Converter.js127 // robust to global ordering: an earlier suite may already have tripped the per-processCOMMENT
MEDIUMsrc/subParsers/makemarkdown/node.js74 // exactly (and is robust against ">" inside attribute values)COMMENT
Structural Annotation Overuse4 hits · 6 pts
SeverityFileLineSnippetContext
LOWdocs/tutorials/markdown-editor-with-showdown.md9## Step 1: Prepare projectCOMMENT
LOWdocs/tutorials/markdown-editor-with-showdown.md38## Step 2: Install ShowdownCOMMENT
LOWdocs/tutorials/markdown-editor-with-showdown.md48## Step 3: Update project filesCOMMENT
LOWdocs/tutorials/markdown-editor-with-showdown.md130## Step 4: Check the resultCOMMENT
Hyper-Verbose Identifiers3 hits · 3 pts
SeverityFileLineSnippetContext
LOWsrc/subParsers/makehtml/heading.js267 function resolveOneLinerFalsePositive (line1, line4) {CODE
LOWsrc/subParsers/makehtml/heading.js307 function resolveMultilineFalsePositive (headingText, line1, line2, line3) {CODE
LOWsrc/subParsers/makemarkdown/emphasis.js22function makeMarkdownWrapMarkerSubParser (name, marker) {CODE
Verbosity Indicators1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/subParsers/makehtml/paragraphs.js86 // we need to check if ghBlock is a false positiveCOMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/subParsers/makemarkdown/table.js95 // TODO: implement <caption> in tables https://developer.mozilla.org/pt-BR/docs/Web/HTML/Element/captionCOMMENT