Classy web-development dressed in a DSL (official / canonical repo)
This report summarizes scanner evidence for sinatra/sinatra, a Ruby project with 12,453 GitHub stars. SynthScan examined 30,319 lines of code across 172 source files, recording 146 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 6.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 143 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 3 finding(s).
Which changes need focused human review? 146 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 146 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/contest.rb | 1 | # Copyright (c) 2009 Damian Janowski and Michel Martens for Citrusbyte | COMMENT |
| LOW | test/views/hello.md | 1 | # Hello From Markdown | COMMENT |
| LOW | rack-protection/spec/spec_helper.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/spec/spec_helper.rb | 21 | # The `.rspec` file also contains a few flags that are not defaults but that | COMMENT |
| LOW | rack-protection/spec/spec_helper.rb | 41 | # Use the documentation formatter for detailed output, | COMMENT |
| LOW | rack-protection/spec/spec_helper.rb | 61 | # as the one that triggered the failure. | COMMENT |
| LOW | rack-protection/lib/rack/protection/base.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/base.rb | 21 | # [<tt>:message</tt>] - if set, this is the message sent when a request is rejected via <tt>deny</tt>. | COMMENT |
| LOW | rack-protection/lib/rack/protection/json_csrf.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/cookie_tossing.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/escaped_params.rb | 21 | # | COMMENT |
| LOW | rack-protection/lib/rack/protection/escaped_params.rb | 41 | # To avoid this, include the {<tt>escape_utils</tt>}[https://rubygems.org/gems/escape_utils] | COMMENT |
| LOW | rack-protection/lib/rack/protection/referrer_policy.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/frame_options.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/frame_options.rb | 21 | # {frame-ancestors directive}[https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-P | COMMENT |
| LOW | rack-protection/lib/rack/protection/http_origin.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | rack-protection/lib/rack/protection/http_origin.rb | 21 | # | COMMENT |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 21 | # | COMMENT |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 41 | # | COMMENT |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 61 | # use Rack::Session::Cookie, secret: 'CHANGEMEaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' | COMMENT |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 81 | # <h1>With Authenticity Token</h1> | COMMENT |
| LOW | rack-protection/lib/rack/protection/strict_transport.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | …tection/lib/rack/protection/content_security_policy.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | …tection/lib/rack/protection/content_security_policy.rb | 21 | # More info:: * W3C CSP Level 1 : https://www.w3.org/TR/CSP1/ (deprecated) | COMMENT |
| LOW | …tection/lib/rack/protection/content_security_policy.rb | 41 | # <tt>:report_to</tt> option. If you *do* set <tt>:report_to</tt>, you must | COMMENT |
| LOW | rack-protection/lib/rack/protection/form_token.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | …k-protection/lib/rack/protection/host_authorization.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | …k-protection/lib/rack/protection/host_authorization.rb | 21 | # [<tt>:permitted_hosts</tt>] an Array of hosts to allow. Elements can be as follows: | COMMENT |
| LOW | sinatra-contrib/spec/spec_helper.rb | 1 | ENV['RACK_ENV'] = 'test' | COMMENT |
| LOW | sinatra-contrib/spec/spec_helper.rb | 21 | # The settings below are suggested to provide a good initial experience | COMMENT |
| LOW | sinatra-contrib/spec/spec_helper.rb | 41 | COMMENT | |
| LOW | sinatra-contrib/spec/spec_helper.rb | 61 | # assertions if you prefer. | COMMENT |
| LOW | sinatra-contrib/spec/reloader_spec.rb | 21 | end | COMMENT |
| LOW | sinatra-contrib/spec/okjson.rb | 1 | # Copyright 2011 Keith Rarick | COMMENT |
| LOW | sinatra-contrib/spec/okjson.rb | 21 | # See https://github.com/kr/okjson for updates. | COMMENT |
| LOW | sinatra-contrib/spec/okjson.rb | 181 | end | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/json.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/json.rb | 21 | # get '/' do | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/json.rb | 41 | # | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/json.rb | 61 | # set :json_encoder, Whatever | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/respond_with.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/respond_with.rb | 21 | # halt haml(:index, :locals => data) | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/respond_with.rb | 41 | # | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/respond_with.rb | 61 | # | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 21 | COMMENT | |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 41 | # @return [Integer] HTTP status of the last response | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 61 | # @!scope class | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 81 | # @!scope class | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 101 | def_delegators :current_session, :env_for | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/test_helpers.rb | 141 | COMMENT | |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 21 | # | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 41 | # or both: | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 61 | # it. For instance, lets define a before filter to prevent the access of | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 81 | # Well, they actually also affect the nested namespaces: | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 101 | # | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 121 | # end | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 141 | # an extension. This includes defining the `registered(app)` method in the | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 161 | # end | COMMENT |
| 59 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | sinatra-contrib/lib/sinatra/namespace.rb | 148 | # module Routes # Define a new "Routes" module | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1397 | # Define a custom error handler. Optionally takes either an Exception | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1413 | # Define a named template. The block must return the template source. | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1419 | # Define the layout template. The block must return the template source. | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1483 | # Define a before filter; runs before all requests within the same | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1490 | # Define an after filter; runs after all requests within the same | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1656 | # Create a new instance without middleware in front of it. | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 1659 | # Create a new instance of the class fronted by its middleware | COMMENT |
| MEDIUM | lib/sinatra/base.rb | 2152 | # Create a new Sinatra application; the block is evaluated in the class scope. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | rack-protection/spec/spec_helper.rb | 27 | # with RSpec, but feel free to customize to your heart's content. | COMMENT |
| MEDIUM | sinatra-contrib/spec/spec_helper.rb | 22 | # with RSpec, but feel free to customize to your heart's content. | COMMENT |
| MEDIUM | sinatra-contrib/lib/sinatra/namespace.rb | 17 | # Once you have loaded the extension (see below), you can use the +namespace+ | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/namespace.rb | 182 | # Zomg::App.run! # Don't forget to start your app ;) | COMMENT |
| MEDIUM | sinatra-contrib/lib/sinatra/extension.rb | 11 | # module. This means you can use +get+ to define a route, +before+ | COMMENT |
| MEDIUM | sinatra-contrib/lib/sinatra/haml_helpers.rb | 18 | # # now you can use the helpers in your views | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/runner.rb | 39 | # **Don't forget to override #app_file specific to your application!** | COMMENT |
| MEDIUM | sinatra-contrib/lib/sinatra/webdav.rb | 18 | # # Now you can use any WebDAV verb: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …k-protection/lib/rack/protection/authenticity_token.rb | 191 | # Essentially the inverse of +mask_token+. | COMMENT |
| MEDIUM | …tection/lib/rack/protection/content_security_policy.rb | 36 | # section for CSP usage examples and best practices. | COMMENT |
| LOW | sinatra-contrib/lib/sinatra/json.rb | 63 | # To force +json+ to simply call +to_json+ on the object: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/compile_test.rb | 60 | parses "/:foo/:bar", "/user@example.com/name", "foo" => "user@example.com", "bar" => "name" | CODE |
| LOW | test/routing_test.rb | 488 | assert_equal 'user@example.com', body | CODE |
| LOW | test/routing_test.rb | 557 | assert_equal "John Doe", body | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 213 | def compare_with_global_token(token, session) | CODE |
| LOW | …k-protection/lib/rack/protection/authenticity_token.rb | 217 | def compare_with_per_form_token(token, session, request) | CODE |
| LOW | sinatra-contrib/lib/sinatra/streaming.rb | 208 | def enum_not_open_for_reading(*) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sinatra-contrib/lib/sinatra/content_for.rb | 138 | # Check if a block of content with the given key was defined. For | COMMENT |