This report summarizes scanner evidence for silvertakana/worldwideview, a TypeScript project with 1,916 GitHub stars. SynthScan examined 109,733 lines of code across 790 source files, recording 199 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 73 finding(s).
Are imports declared and package/API names verified? 11 finding(s).
Are wrappers, guards, and repeated structures necessary? 136 finding(s).
Which changes need focused human review? 199 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 199 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-entrypoint.sh | 2 | # ─── Docker Entrypoint ─────────────────────────────────────── | COMMENT |
| MEDIUM | docker-entrypoint.sh | 31 | # ─── PostgreSQL readiness wait ─────────────────────────────── | COMMENT |
| MEDIUM | tests/marketplace-from-instance.spec.ts | 21 | // ─── Marketplace capture side (no worldwideview auth needed) ──────────────── | COMMENT |
| MEDIUM | tests/marketplace-from-instance.spec.ts | 83 | // ─── Linked-instance API surface (anonymous, marketplace-only) ────────────── | COMMENT |
| MEDIUM | tests/marketplace-from-instance.spec.ts | 134 | // ─── InstanceCapture → server-link fire-and-forget ────────────────────────── | COMMENT |
| MEDIUM | tests/marketplace-from-instance.spec.ts | 154 | // ─── Full flow (worldwideview → marketplace, requires Docker + auth) ───────── | COMMENT |
| MEDIUM | tests/web-auth.spec.ts | 6 | // ─── /auth/reset-password ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/web-auth.spec.ts | 32 | // ─── /accounts unauthenticated redirect ────────────────────────────────────── | COMMENT |
| MEDIUM | tests/web-auth.spec.ts | 47 | // ─── /auth/verify without a code ───────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/web-auth.spec.ts | 60 | // ─── /auth/reset-password/confirm without a hash ───────────────────────────── | COMMENT |
| MEDIUM | tests/account-connect-e2e.spec.ts | 38 | // ── 1. Sign up at worldwideview-web ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 51 | // ── 2. Navigate to globe app ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 55 | // ── 3. Click "Connect to Marketplace" ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 60 | // ── 4. Verify redirect to marketplace /oauth/authorize ───────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 67 | // ── 5. Verify consent page shows user email and scope ────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 72 | // ── 6. Click "Approve" ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 77 | // ── 7. Wait for redirect back to globe app ───────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 80 | // ── 8. Verify "Connected as <email>" is visible ──────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 84 | // ── 9. Navigate to a page with a plugin that requires auth ───────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 90 | // ── 10. Verify ticketClient fetches from /api/auth/ticket ────────────── | COMMENT |
| MEDIUM | tests/account-connect-e2e.spec.ts | 114 | // ── 11. Verify WebSocket auth: auth message sent, welcome received ───── | COMMENT |
| MEDIUM | tests/account-connect-e2e.spec.ts | 122 | // ── 12. Verify data streams ─────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/account-connect-e2e.spec.ts | 135 | // ── 1. Sign up (fresh user, no marketplace connection) ───────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 146 | // ── 2. Navigate to globe app ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 150 | // ── 3. Navigate to plugins tab ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/account-connect-e2e.spec.ts | 155 | // ── 4. Listen for /api/auth/ticket — expect noCredential ────────────── | COMMENT |
| MEDIUM | tests/marketplace-sign-out.spec.ts | 27 | // ── Establish authenticated session ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/marketplace-sign-out.spec.ts | 39 | // ── Open avatar dropdown and click Sign Out ────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/marketplace-sign-out.spec.ts | 43 | // ── Assert redirect to marketplace home ────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/marketplace-sign-out.spec.ts | 49 | // ── Assert session is cleared on the server ────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-lib-incidents/src/index.test.ts | 26 | // ─── Minimal GeoEntity factory ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-lib-incidents/src/index.test.ts | 40 | // ─── Minimal concrete subclass ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-lib-incidents/src/index.test.ts | 88 | // ─── Subclass that DOES override mapWebsocketPayload ───────────────────────── | COMMENT |
| MEDIUM | packages/wwv-lib-incidents/src/index.test.ts | 100 | // ─── Helpers that mimic WsClient.handleDataMessage branching logic ──────────── | COMMENT |
| MEDIUM | packages/wwv-lib-incidents/src/index.test.ts | 122 | // ─── Test suite ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 68 | // ─── Re-export manifest types ───────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 71 | // ─── Categories ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 85 | // ─── Time ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 137 | // ─── Layer Config ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 149 | // ─── Cesium Entity Options ─────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 182 | // ─── Selection Behavior ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 192 | // ─── Server Plugin Config ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 203 | // ─── Plugin Context ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 237 | // ─── Filter Definitions ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 255 | // ─── Alert Definitions ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 353 | // ─── Aliases for backwards compatibility ───────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 356 | // ─── Data Bus Event Types ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 378 | // ─── Auth Contracts ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/wwv-plugin-sdk/src/index.ts | 381 | // ─── Tagged Property Helpers ───────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 13 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 15 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 106 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 108 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 199 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 201 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 293 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 295 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 323 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 325 | # -------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/docker-publish.yml | 364 | # -------------------------------------------------- | COMMENT |
| 55 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/workflows/researching-plugins/SKILL.md | 19 | ### Step 1: Check the Ecosystem Before the Web | COMMENT |
| LOW | .agents/workflows/researching-plugins/SKILL.md | 29 | ### Step 2: Validate Data Sources | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 12 | ## Step 1: Setting up your Workspace | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 56 | ## Step 2: Scaffold the Plugin and Backend Seeder | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 89 | ## Step 3: Write the Polling Logic (Backend Seeder) | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 142 | ## Step 4: Testing the Data Engine | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 156 | ## Step 5: Write the Plugin Logic (Frontend) | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 216 | ## Step 6: Connecting and Testing Everything | COMMENT |
| LOW | docs/iss-plugin-tutorial.md | 242 | ## Step 7: Publishing Your Plugin | COMMENT |
| LOW | docs/mcp-quickstart.md | 25 | ## Step 1: Install and configure | COMMENT |
| LOW | docs/mcp-quickstart.md | 40 | ## Step 2: Run the app | COMMENT |
| LOW | docs/mcp-quickstart.md | 63 | ## Step 3: Sign in and generate an API key | COMMENT |
| LOW | docs/mcp-quickstart.md | 77 | ## Step 4: Add the MCP server to your client | COMMENT |
| LOW | docs/mcp-quickstart.md | 100 | ## Step 5: Restart your client and verify | COMMENT |
| LOW⚡ | src/core/data/SmartFetcher.ts | 20 | // Step 1: Try Direct Fetch (Fastest) | COMMENT |
| LOW⚡ | src/core/data/SmartFetcher.ts | 30 | // Step 2: Local Server Proxy | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 145 | // Step 1: Geocode the place name (limit 1 result). | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 155 | // Step 2: Find matching streaming plugins by case-insensitive substring. | COMMENT |
| LOW | src/app/api/mcp/discoveryTools.ts | 177 | // Step 3: Compute bbox and query region for each matched plugin. | COMMENT |
| LOW | src/app/api/mcp/discoveryTools.ts | 189 | // Step 4: Pan camera when a session is active. | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 202 | // Step 5: Apply overall cap and record truncation metadata. | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 210 | // Step 6: Build prose summary using first matched plugin as representative. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/wwv-plugin-sdk/src/vite/wwvStaticCompiler.ts | 74 | function generateStaticPluginSource(manifest: any): string { | CODE |
| LOW | src/core/edition.ts | 167 | export function ticketAuthEnabledForPlugin(pluginId: string): boolean { | CODE |
| LOW | src/core/globe/InteractionHandler.ts | 42 | export function extractWwvEntityFromPicks(picks: unknown[]): GeoEntity | null { | CODE |
| LOW | src/core/globe/InteractionHandler.ts | 83 | export function findEntityByScreenDistance( | CODE |
| LOW | src/core/globe/types/GlobeCommand.ts | 46 | function isOptionalPluginOrLayerId(v: unknown): boolean { | CODE |
| LOW | src/core/state/mapDefaults.ts | 14 | export function resolveDefaultBaseLayerId(stored: string | null, envKey: string | undefined): string { | CODE |
| LOW | src/core/hooks/useMarketplaceSync.test.tsx | 196 | function duplicateRegistrationWarnings(warnSpy: ReturnType<typeof vi.spyOn>) { | CODE |
| LOW | src/app/setup/actions.ts | 153 | export async function activateProvisionedAccount( | CODE |
| LOW | src/app/api/mcp/globeCommandTools.ts | 62 | export function registerGlobeCommandTools( | CODE |
| LOW | src/app/api/mcp/pluginToolDispatch.ts | 62 | export async function registerPluginToolDispatch( | CODE |
| LOW | src/app/api/mcp/regionalAnalyticsTools.ts | 11 | export function registerRegionalAnalyticsTools( | CODE |
| LOW | src/app/api/service/tier/route.ts | 69 | async function countOrganizationInstances(orgId: string): Promise<number> { | CODE |
| LOW | src/components/layout/ConnectAgentHelper.test.tsx | 60 | function expectNoConcreteRemoteHost(values: string[]): void { | CODE |
| LOW | …components/marketplace/UnverifiedPluginBatchDialog.tsx | 13 | export default function UnverifiedPluginBatchDialog({ | CODE |
| LOW | src/lib/mcpRateLimitConfig.ts | 74 | export async function checkMcpInvocationsRateLimit( | CODE |
| LOW | src/lib/provisioning.ts | 196 | async function completeExistingProvisioning(email: string, name: string): Promise<ProvisionedAccount | null> { | CODE |
| LOW | src/lib/org-tier.ts | 322 | export async function findDueTierLockOrganizations(now: Date, limit: number): Promise<string[]> { | CODE |
| LOW | src/lib/cross-service/verify.ts | 13 | export async function verifyCrossServiceSignature( | CODE |
| LOW | src/lib/auth/migrate-legacy-user.ts | 9 | export async function migrateLegacyUserIfNeeded( | CODE |
| LOW | src/lib/mcp/tools.ts | 47 | function resolveDataQueryEmptyReason(serviceReason: EmptyReason | undefined): EmptyReason { | CODE |
| LOW | src/lib/mcp/server.ts | 119 | export async function registerOrientationPrompts( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-entrypoint.sh | 21 | if [ -f "prisma/dev.db" ]; then | COMMENT |
| LOW | docker/ci/docker-compose.plugin-ci.yml | 1 | # Reusable compose for plugin smoke CI (consumed by wwv-plugins repo). | COMMENT |
| LOW | docker/ci/docker-compose.plugin-ci.yml | 21 | # ─── Stub seeder source ─── | COMMENT |
| LOW | docker/ci/docker-compose.seeder-ci.yml | 1 | # Reusable compose for seeder smoke CI (consumed by wwv-seeders-* repos). | COMMENT |
| LOW | tests/bottom-panel.spec.ts | 141 | // Find the drag handle | COMMENT |
| LOW | tests/ci/boot-db.test.ts | 1 | import { describe, it, expect, afterAll } from "vitest"; | COMMENT |
| LOW | scripts/web-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/playwright.yml | 221 | - name: Build production bundle | COMMENT |
| LOW | .github/workflows/dependabot-automerge.yml | 1 | name: Dependabot Automerge | COMMENT |
| LOW | .github/workflows/publish-packages.yml | 1 | # Trigger model: merge to main with a version bump in the relevant package.json is the | COMMENT |
| LOW | src/proxy.ts | 121 | // API routes: DENY BY DEFAULT. Evaluated BEFORE the static-asset allowlist so | COMMENT |
| LOW | src/core/globe/useImageryManager.ts | 121 | console.error("[useImageryManager] OSM fallback also failed:", fallbackErr); | COMMENT |
| LOW | src/core/globe/hooks/useSatelliteFrustum.ts | 61 | // Wait, Cesium cylinder geometry aligns its local Z axis with the global Z (North Pole) | COMMENT |
| LOW | src/app/api/health/route.ts | 1 | import { NextResponse } from "next/server"; | COMMENT |
| LOW | src/app/api/mcp/route.test.ts | 161 | }); | COMMENT |
| LOW | src/app/api/mcp/route.ts | 121 | COMMENT | |
| LOW | src/app/api/mcp/route.ts | 161 | // ------------------------------------------------------------------ | COMMENT |
| LOW | src/app/api/mcp/route.ts | 181 | // Phase 29: discovery tools (list_available_plugins, get_globe_context, investigate_area) | COMMENT |
| LOW | src/lib/apiKeyAuth.ts | 1 | import { randomBytes, createHmac, timingSafeEqual } from "crypto"; | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/core/data/SmartFetcher.ts | 20 | // Step 1: Try Direct Fetch (Fastest) | COMMENT |
| LOW⚡ | src/core/data/SmartFetcher.ts | 30 | // Step 2: Local Server Proxy | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 145 | // Step 1: Geocode the place name (limit 1 result). | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 155 | // Step 2: Find matching streaming plugins by case-insensitive substring. | COMMENT |
| LOW | src/app/api/mcp/discoveryTools.ts | 177 | // Step 3: Compute bbox and query region for each matched plugin. | COMMENT |
| LOW | src/app/api/mcp/discoveryTools.ts | 189 | // Step 4: Pan camera when a session is active. | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 202 | // Step 5: Apply overall cap and record truncation metadata. | COMMENT |
| LOW⚡ | src/app/api/mcp/discoveryTools.ts | 210 | // Step 6: Build prose summary using first matched plugin as representative. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/tier-sync.spec.ts | 101 | const body = { email: 'test@test.com' }; | CODE |
| LOW | tests/ci/org-scoping.test.ts | 199 | where: { email: "test@test.com" }, | CODE |
| LOW | src/app/setup/actions.test.ts | 31 | fd.set("email", overrides.email ?? "admin@example.com"); | CODE |
| LOW | src/app/setup/page.tsx | 205 | <input id="email" name="email" type="email" required className={styles.input} placeholder="admin | CODE |
| LOW | src/app/api/marketplace/pkce.spec.ts | 149 | user: { id: "u1", email: "user@example.com", role: "user" }, | CODE |
| LOW | src/app/api/marketplace/pkce.spec.ts | 163 | user: { id: "u1", email: "admin@example.com", role: "admin" }, | CODE |
| LOW | src/app/api/marketplace/pkce.spec.ts | 195 | user: { id: "u1", email: "user@example.com", role: "user" }, | CODE |
| LOW | src/app/api/marketplace/pkce.spec.ts | 211 | user: { id: "u1", email: "admin@example.com", role: "demo-admin" }, | CODE |
| LOW | src/app/api/ba/[...all]/route.spec.ts | 54 | body: JSON.stringify({ email: "test@test.com", password: "password" }), | CODE |
| LOW | src/app/login/LoginForm.tsx | 116 | placeholder={isDemo ? "admin@worldwideview.local" : "admin@example.com"} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 174 | "Authorization": "Bearer <your-api-key>" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/plugin-new/SKILL.md | 35 | ## Stage 1: Isolated worktree + scaffold | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/pr-preview.yml | 49 | # permissions, never elevate them. shared-docker.yml declares | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | self-host/setup.sh | 6 | # Check if docker is actually available and running | COMMENT |