🐳 Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker
This report summarizes scanner evidence for spantaleev/matrix-docker-ansible-deploy, a Jinja project with 6,496 GitHub stars. SynthScan examined 93,467 lines of code across 866 source files, recording 469 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 5.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 448 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 43 finding(s).
Which changes need focused human review? 469 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 469 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | conf.py | 1 | # SPDX-FileCopyrightText: 2024 Slavi Pantaleev <slavi@devture.com> | COMMENT |
| LOW | bin/add-inventory-host.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | bin/molecule-clean.sh | 1 | #!/bin/bash | COMMENT |
| LOW | bin/molecule.sh | 1 | #!/bin/bash | COMMENT |
| LOW | bin/ansible-all-hosts.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 1 | # SPDX-FileCopyrightText: 2020 - 2022 Aaron Raimist | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 41 | matrix_client_element_container_src_dockerfile_path: "{{ matrix_client_element_container_src_files_path }}/apps/web/Dock | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 101 | # matrix_client_element_container_labels_additional_labels: | | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 141 | # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 281 | COMMENT | |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 301 | # Note that for a custom theme to work well, all Element Web instances that you use must have the same theme installed. | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 321 | # | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 341 | COMMENT | |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 361 | # If you need something more special, you can take full control by | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 381 | # "attribution": "", | COMMENT |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 401 | COMMENT | |
| LOW | roles/custom/matrix-client-element/defaults/main.yml | 421 | # ELEMENT_WEB_PORT=8080 | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 61 | # Authentication settings (`user.*` configuration keys). | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 81 | # Controls the `user.device_id` configuration setting. | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 101 | # - Set this variable to something like `/data/avatar.png` (the in-container path) | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 121 | # - Restart the bot | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 141 | # Example: | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 161 | # Changing this subsequently requires that you also throw away all data (see `matrix_bot_baibot_data_path`) | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 281 | matrix_bot_baibot_config_agents_static_definitions_groq_config_extension: "{{ matrix_bot_baibot_config_agents_static_def | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 341 | # This configuration extends the default starting configuration (`matrix_bot_baibot_config_agents_static_definitions_m | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 361 | # See: https://huggingface.co/docs/transformers/en/tasks/prompting | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 401 | # Example configuration extension follows: | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 461 | matrix_bot_baibot_config_agents_static_definitions_venice_provider: venice | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 501 | matrix_bot_baibot_config_agents_static_definitions_venice_config_text_generation_prompt_cache_retention: 24h | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 601 | # Let the model pull the latest info from the web for the image. Model-specific; costs extra credits. | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 621 | COMMENT | |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 641 | # | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 661 | COMMENT | |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 681 | matrix_bot_baibot_config_logging_level_mxlink: info | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 701 | # | COMMENT |
| LOW | roles/custom/matrix-bot-baibot/defaults/main.yml | 721 | matrix_bot_baibot_environment_variables_extension: '' | COMMENT |
| LOW | roles/custom/matrix-conduit/defaults/main.yml | 41 | # Controls how long to sleep for after starting the matrix-synapse container. | COMMENT |
| LOW | roles/custom/matrix-conduit/defaults/main.yml | 161 | # This value is automatically computed during installation based on whether | COMMENT |
| LOW | roles/custom/matrix-bot-buscarron/defaults/main.yml | 201 | # will be restarted (when true) or merely started (when false) by the | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 1 | # SPDX-FileCopyrightText: 2023 - 2024 Michael Hollister | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 61 | # Controls whether the matrix-media-repo container exposes its HTTP port (tcp/8000 in the container). | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 221 | | combine ({'X-Forwarded-Host': matrix_domain} if matrix_domain else {}) | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 241 | # ***************************************************************************** | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 261 | matrix_media_repo_json_logs: false | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 281 | # media repo will back off. This defaults to 20 if not given. Note that 404 errors from | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 341 | # be proxied through this process. They will also be called on the homeserver, and the response | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 361 | COMMENT | |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 381 | # # A note about regexes: it is best to suffix *all* namespaces with the homeserver | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 401 | # Shared secret auth is useful for applications building on top of the media repository, such | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 421 | # previous behavior of this role. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 441 | COMMENT | |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 461 | # | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 481 | COMMENT | |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 501 | # when `publicBaseUrl` is unset. Defaults to false (cached media will be served by MMR | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 521 | # of any file upload limits and will require a similar amount of memory when performing an export. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 541 | # This is purely for informational reasons and does not actually limit any functionality. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 561 | # Whether quotas are enabled/enforced. Note that even when disabled the media repo will | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 581 | # will prevent upload. Note that a user can still have uploads contributing to maxPending, | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 601 | # has passed, the media is able to be re-requested. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 641 | COMMENT | |
| 338 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | roles/custom/matrix-client-commet/defaults/main.yml | 54 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | roles/custom/matrix-client-commet/defaults/main.yml | 56 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | roles/custom/matrix-client-commet/defaults/main.yml | 90 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | roles/custom/matrix-client-commet/defaults/main.yml | 92 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | roles/custom/matrix-client-commet/defaults/main.yml | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | roles/custom/matrix-client-commet/defaults/main.yml | 100 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 57 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 59 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 124 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 126 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 167 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 169 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 325 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …tom/matrix-bridge-hookshot/molecule/default/verify.yml | 327 | # ------------------------------------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | bin/test-molecule-select-roles.py | 86 | def test_livekit_bump_only_runs_its_consumer(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 90 | def test_postgres_bump_follows_shared_task(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 94 | def test_curl_bump_runs_every_consumer(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 98 | def test_multiple_image_bumps_union_with_direct_role_changes(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 104 | def test_direct_changes_ignore_roles_without_scenarios(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 109 | def test_documentation_change_runs_nothing(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 113 | def test_image_pin_comments_and_quoting_do_not_run_scenarios(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 118 | def test_shared_task_change_only_runs_consumers(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 122 | def test_shared_fixture_change_follows_nested_references(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 126 | def test_deleted_helper_uses_previous_consumers(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 131 | def test_renamed_helper_unions_previous_and_current_consumers(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 137 | def test_deleted_role_is_not_selected(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 141 | def test_new_scenario_is_selected(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 145 | def test_global_changes_run_all(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 152 | def test_unknown_shared_file_runs_all(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 156 | def test_unconsumed_image_bump_runs_all(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 162 | def test_unsupported_pins_run_all(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 192 | def test_shared_reference_cycles_terminate(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 196 | def test_comments_do_not_introduce_unresolved_references(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 202 | def test_symlinked_shared_helper_is_followed(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 209 | def test_invalid_comparison_runs_all(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 212 | def test_manual_dispatch_all_or_one_role(self): | CODE |
| LOW⚡ | bin/test-molecule-select-roles.py | 219 | def test_event_comparison_bases(self): | CODE |
| LOW | bin/test-molecule-select-roles.py | 176 | def test_missing_pins_run_all(self): | CODE |
| LOW | bin/test-molecule-select-roles.py | 180 | def test_unresolved_references_run_all(self): | CODE |
| LOW | bin/test-molecule-select-roles.py | 232 | def test_cli_writes_github_output(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | docs/configuring-playbook-user-verification-service.md | 70 | It is possible to set an API Auth Token to restrict access to the UVS. If this is enabled, anyone making a request to UV | CODE |
| HIGH⚡ | docs/configuring-playbook-user-verification-service.md | 72 | By default, the token (`YOUR_TOKEN_HERE`) will be derived from `matrix_homeserver_generic_secret_key` in `group_vars/mat | CODE |
| HIGH⚡ | docs/configuring-playbook-user-verification-service.md | 74 | To set your own token, add the following configuration to your `vars.yml` file. Make sure to replace `YOUR_TOKEN_HERE` w | CODE |
| HIGH⚡ | docs/configuring-playbook-user-verification-service.md | 77 | matrix_user_verification_service_uvs_auth_token: "YOUR_TOKEN_HERE" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 406 | # Set this to true to enable shared secret auth. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 542 | # Set this to -1 to indicate that there is no limit. Zero will force the use of maxBytes. | COMMENT |
| LOW | roles/custom/matrix-media-repo/defaults/main.yml | 776 | # Set this to false if rate limiting is handled at a higher level or you don't want it enabled. | COMMENT |
| LOW | roles/custom/matrix-bot-draupnir/defaults/main.yml | 149 | # Set this to the Pantalaimon URL if you're using that. | COMMENT |
| LOW | roles/custom/matrix-bot-mjolnir/defaults/main.yml | 74 | # Set this to the pantalaimon URL if you're using that. | COMMENT |
| LOW | …es/custom/matrix-bridge-heisenbridge/defaults/main.yml | 28 | # Set this to your Matrix ID if you want to enforce the owner, otherwise first _local_ user becomes one | COMMENT |
| LOW | roles/custom/matrix-bot-meowlnir/defaults/main.yml | 179 | # Set these to strong, unique values. | COMMENT |
| LOW | …tom/matrix-user-verification-service/defaults/main.yml | 13 | # Set this to the display name for ansible used in Output e.g. fail_msg | COMMENT |
| LOW | molecule-shared/tasks/homeserver-stub.yml | 59 | # Set molecule_shared_stub_verbose to "1" to log every request the stub is asked for. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | roles/custom/matrix-bridge-sms/defaults/main.yml | 92 | # (optional) if you use a self signed certificate, you can add the public key here | COMMENT |
| LOW | roles/custom/matrix-synapse/vars/main.yml | 157 | # don't forget to actually configure it where appropriate (see worker.yaml.j2`, the nginx proxy configuration, etc). | COMMENT |
| LOW | roles/custom/matrix-synapse/vars/main.yml | 157 | # don't forget to actually configure it where appropriate (see worker.yaml.j2`, the nginx proxy configuration, etc). | COMMENT |
| MEDIUM | roles/custom/matrix-synapse/defaults/main.yml | 738 | # By default, all of the server's memory is taken into account, but you can adjust this. | COMMENT |
| MEDIUM | examples/reverse-proxies/haproxy/haproxy.cfg | 44 | # HAproxy wants the full chain and the private key in one file. For Letsencrypt manually generated certs (e.g., wild | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | bin/molecule-select-roles.py | 94 | except (KeyError, subprocess.CalledProcessError): | CODE |
| HIGH | bin/molecule-select-roles.py | 89 | except subprocess.CalledProcessError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/configuring-playbook-bot-baibot.md | 415 | # In this example, there's no need to define any of these below. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | roles/custom/matrix-synapse/vars/main.yml | 197 | # The following section contains content that had previously been generated by a script (`workers-doc-to-yaml.awk`) proc | COMMENT |
| MEDIUM | collections/requirements.yml | 2 | # This file is not used by the playbook's standard CLI installation flow. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | roles/custom/matrix-base/defaults/main.yml | 276 | # They are meant for orchestration concerns like container networking and systemd ordering, | COMMENT |
| MEDIUM | roles/custom/matrix-base/defaults/main.yml | 285 | # It is meant for orchestration concerns like container networking, systemd ordering, and database creation, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bin/molecule-clean.sh | 11 | # Usage: | COMMENT |
| LOW | bin/molecule.sh | 15 | # Usage: | COMMENT |
| LOW | roles/custom/matrix-synapse/defaults/main.yml | 51 | # Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bin/molecule-select-roles.py | 79 | CODE | |
| LOW | bin/molecule-select-roles.py | 154 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/tasks/validate_config_sqlite_legacy_migration_bug.yml | 54 | except Exception: | CODE |