Mobile music utility built with Flutter and Rust. High-quality audio management for your personal library. open source, no ads, no subscription.
This report summarizes scanner evidence for spotiflacapp/SpotiFLAC-Mobile, a Dart project with 7,561 GitHub stars. SynthScan examined 497,296 lines of code across 1917 source files, recording 171 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 0.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 155 finding(s).
Are imports declared and package/API names verified? 7 finding(s).
Are wrappers, guards, and repeated structures necessary? 47 finding(s).
Which changes need focused human review? 171 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 171 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | rust_backend/crates/core/src/native_palette.rs | 1 | // Copyright 2021 Google LLC | COMMENT |
| LOW | rust_backend/crates/core/src/fs.rs | 81 | /// Unix keeps the exact flags and modes; other platforms apply the closest | COMMENT |
| LOW | rust_backend/crates/core/src/media/hires.rs | 1 | //! Sampled Hi-Res analysis. A spectral roll-off is an observation, not proof | COMMENT |
| LOW | rust_backend/crates/core/src/media/hires.rs | 101 | pub cutoff_frequency_hz: f64, | COMMENT |
| LOW | rust_backend/crates/core/src/media/hires.rs | 121 | /// or empty when not measured. | COMMENT |
| LOW | rust_backend/crates/core/src/media/hires/evidence.rs | 1 | //! Evidence that separates a fake Hi-Res file from a genuine master that was | COMMENT |
| LOW | rust_backend/crates/core/src/media/hires/evidence.rs | 41 | const QUIET_FRAME_FRACTION: f64 = 0.1; | COMMENT |
| LOW | rust_backend/crates/desktop/src/dispatch.rs | 1 | //! The desktop method table: the one place that lists every MethodChannel | COMMENT |
| LOW | rust_backend/crates/desktop/src/discord.rs | 1 | //! Discord Rich Presence through the Discord client's local RPC IPC socket | COMMENT |
| LOW | rust_backend/crates/desktop/src/ffi.rs | 1 | //! The exported C functions. This is the only module that allows unsafe code: | COMMENT |
| LOW | rust_backend/crates/desktop/src/keep_awake.rs | 1 | //! Keeps the computer from idle sleeping while the download queue runs | COMMENT |
| LOW | …backend/crates/extensions/tests/windows_path_prefix.rs | 1 | // Exercise the production Windows path conversion on every host, including | COMMENT |
| LOW | rust_backend/crates/extensions/src/windows_path.rs | 1 | //! Windows rules for path names that an extension or a package controls. | COMMENT |
| LOW | third_party/audio_service/README.md | 181 | MediaAction.seekForward, | COMMENT |
| LOW | third_party/audio_service/pubspec.yaml | 21 | # Use these deps when pushing to origin (for the benefit of testers) | COMMENT |
| LOW | …ava/com/ryanheise/audioservice/AudioServicePlugin.java | 161 | } | COMMENT |
| LOW | …ava/com/ryanheise/audioservice/AudioServicePlugin.java | 181 | // stateMap.put("playing", AudioService.instance.isPlaying()); | COMMENT |
| LOW | …ava/com/ryanheise/audioservice/AudioServicePlugin.java | 201 | // | COMMENT |
| LOW | …ava/com/ryanheise/audioservice/AudioServicePlugin.java | 421 | private static class ClientInterface implements MethodCallHandler { | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 141 | /// The audio processing state e.g. [AudioProcessingState.buffering]. | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 161 | /// * [MediaAction.pause] | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 181 | /// * [MediaAction.seekBackward] (enable press-and-hold rewind control) | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 581 | final String? artist; | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 601 | /// image. | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 801 | COMMENT | |
| LOW | third_party/audio_service/lib/audio_service.dart | 821 | /// resources in `android/app/src/main/res`. Here, you will find a subdirectory | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 981 | COMMENT | |
| LOW | third_party/audio_service/lib/audio_service.dart | 1141 | } | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 2921 | return result; | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 2941 | /// mixins to provide default implementations of certain behaviours: | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 2961 | /// ### Start/stop transitions | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 2981 | /// | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3001 | COMMENT | |
| LOW | third_party/audio_service/lib/audio_service.dart | 3021 | /// media notification and other clients. Example usage: | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3041 | /// Example usage: | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3361 | /// instructions to start the new item playing. Some implementations may | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3421 | /// The configuration options to use when intializing the [AudioService]. | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3461 | /// Whether notification badges (also known as notification dots) should | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3481 | /// If not null, causes the artwork specified by [MediaItem.artUri] to be | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3561 | /// Key/value codes for use in [MediaItem.extras] and | COMMENT |
| LOW | …dio_service/Sources/audio_service/AudioServicePlugin.m | 321 | } | COMMENT |
| LOW | …layers_darwin/darwin/audioplayers_darwin/Package.swift | 21 | // TODO: If your plugin requires a privacy manifest | COMMENT |
| LOW | …dows_audio/media_kit_libs_windows_audio_plugin_c_api.h | 1 | #ifndef FLUTTER_PLUGIN_MEDIA_KIT_LIBS_WINDOWS_AUDIO_PLUGIN_C_API_H_ | COMMENT |
| LOW | …arty/ffmpeg_kit_flutter_new_audio/linux/CMakeLists.txt | 61 | COMMENT | |
| LOW | …o/lib/media_information_session_complete_callback.dart | 21 | COMMENT | |
| LOW | …r_new_audio/lib/ffprobe_session_complete_callback.dart | 21 | COMMENT | |
| LOW | …er_new_audio/lib/ffmpeg_session_complete_callback.dart | 21 | COMMENT | |
| LOW | …rd_party/ffmpeg_kit_flutter_new_audio/lib/session.dart | 81 | /// set for sessions that end with COMPLETED state. If a session is not | COMMENT |
| LOW | …_flutter_new_audio/windows/ffmpeg_kit_flutter_plugin.h | 1 | #ifndef FLUTTER_PLUGIN_FFMPEG_KIT_FLUTTER_PLUGIN_H_ | COMMENT |
| LOW | …ty/ffmpeg_kit_flutter_new_audio/windows/CMakeLists.txt | 81 | # windows/flutter/ephemeral/.plugin_symlinks/<plugin> at the cached package, so | COMMENT |
| LOW | …ty/ffmpeg_kit_flutter_new_audio/windows/CMakeLists.txt | 101 | # soxr, speex, twolame. The variant name is an emergent property of that library | COMMENT |
| LOW | …ty/ffmpeg_kit_flutter_new_audio/windows/CMakeLists.txt | 201 | endif() | COMMENT |
| LOW | …lutter_new_audio/windows/ffmpeg_kit_flutter_plugin.cpp | 1 | #include "ffmpeg_kit_flutter_plugin.h" | COMMENT |
| LOW | …g_kit_flutter_new_audio/windows/src/fftools_cmdutils.c | 81 | #include "libavformat/avformat.h" | COMMENT |
| LOW | …_kit_flutter_new_audio/windows/src/ffmpegkit_c_api.cpp | 1 | #define FFMPEGKIT_EXPORTS | COMMENT |
| LOW | …t_flutter_new_audio/windows/src/fftools_ffmpeg_demux.c | 41 | #include "libavutil/avassert.h" | COMMENT |
| LOW | …_kit_flutter_new_audio/windows/src/FFmpegKitConfig.cpp | 21 | #include <sys/stat.h> | COMMENT |
| LOW | …_kit_flutter_new_audio/windows/src/FFmpegKitConfig.cpp | 41 | #include "FFprobeKit.h" | COMMENT |
| LOW | …kit_flutter_new_audio/windows/src/fftools_ffmpeg_mux.h | 41 | #define FFTOOLS_FFMPEG_MUX_H | COMMENT |
| LOW | …eg_kit_flutter_new_audio/windows/src/ffmpegkit_c_api.h | 1 | #ifndef FFMPEGKIT_C_API_H | COMMENT |
| 42 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/test_check_backend_apk.py | 43 | def test_compressed_assets_pass(self): | CODE |
| LOW | scripts/test_check_backend_apk.py | 60 | def test_corrupt_deflate_asset_fails_with_entry_name(self): | CODE |
| LOW | scripts/test_check_backend_apk.py | 72 | def test_corrupt_library_past_valid_elf_header_fails(self): | CODE |
| LOW⚡ | scripts/test_check_backend_apk.py | 83 | def test_missing_backend_in_either_abi_fails(self): | CODE |
| LOW⚡ | scripts/test_check_backend_apk.py | 93 | def test_wrong_architecture_fails(self): | CODE |
| LOW⚡ | scripts/test_check_backend_apk.py | 100 | def test_disabled_sdk_cannot_leak_from_build_cache(self): | CODE |
| LOW⚡ | scripts/test_check_backend_apk.py | 108 | def test_enabled_sdk_requires_both_libraries_for_each_abi(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 54 | def test_unstripped_binary_needs_no_dsym(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 58 | def test_stripped_binary_requires_symbol_evidence(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 62 | def test_matching_dsym_verifies_stripped_binary(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 65 | def test_dsym_from_another_build_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 70 | def test_dsym_from_another_architecture_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 75 | def test_missing_dsym_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 80 | def test_matching_dsym_without_defined_rust_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 85 | def test_matching_dsym_does_not_hide_go_in_shipped_binary(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 90 | def test_matching_dsym_with_go_symbols_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_check_backend_ios.py | 95 | def test_debug_artifacts_remain_forbidden_with_dsym(self): | CODE |
| LOW | scripts/test_prepare_discord_sdk.py | 49 | def test_root_and_prefixed_archives_extract_only_mobile_files(self): | CODE |
| LOW | scripts/test_prepare_discord_sdk.py | 57 | def test_source_directory_and_verified_cache(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 68 | def test_corrupt_cache_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 75 | def test_bad_archive_does_not_replace_verified_sdk(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 85 | def test_each_missing_mobile_component_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 94 | def test_duplicate_file_is_rejected(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 101 | def test_oversized_file_is_rejected_before_writing_output(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 108 | def test_missing_configuration_names_the_required_secret(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 112 | def test_decryption_failure_does_not_echo_key(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 120 | def test_missing_gpg_is_actionable(self): | CODE |
| LOW⚡ | scripts/test_prepare_discord_sdk.py | 126 | def test_encrypted_archive_roundtrip_and_wrong_key(self): | CODE |
| LOW | scripts/test_build_android.py | 92 | def test_default_full_audits_two_splits_and_universal(self): | STRING |
| LOW | scripts/test_build_android.py | 109 | def test_lite_single_abi_ignores_and_preserves_previous_artifacts(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 128 | def test_explicit_sdk_disable_is_honored_without_lite_argument(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 138 | def test_fvm_fallback_uses_pinned_version(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 147 | def test_production_requires_full_even_with_inherited_sdk_disable(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 157 | def test_production_rejects_lite_in_either_argument_order(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 164 | def test_production_missing_sdk_components_stops_before_flutter(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 182 | def test_wrong_flutter_version_stops_before_build_or_audit(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 189 | def test_failed_flutter_patch_stops_before_build_or_audit(self): | STRING |
| LOW⚡ | scripts/test_build_android.py | 198 | def test_invalid_or_overridden_abis_stop_before_flutter(self): | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | integration_test/download_queue_workers_test.dart | 0 | create table $_queuetable ( id text primary key, item_json text not null, status text not null, created_at text not null | STRING |
| HIGH | test/download_queue_read_test.dart | 0 | create table $_queuetable ( id text primary key, item_json text not null, status text not null, created_at text not null | STRING |
| HIGH | test/download_queue_legacy_migration_test.dart | 0 | create table $_queuetable ( id text primary key, item_json text not null, status text not null, created_at text not null | STRING |
| HIGH | lib/services/app_state_database.dart | 0 | create table $_queuetable ( id text primary key, item_json text not null, status text not null, created_at text not null | STRING |
| HIGH | integration_test/download_queue_workers_test.dart | 0 | create trigger reject_queue before insert on download_queue_items when new.id = 'reject' begin select raise(abort, 'fixt | STRING |
| HIGH | test/download_queue_read_test.dart | 0 | create trigger reject_queue before insert on download_queue_items when new.id = 'reject' begin select raise(abort, 'fixt | STRING |
| HIGH | test/download_queue_legacy_migration_test.dart | 0 | create trigger reject_queue before insert on download_queue_items when new.id = 'reject' begin select raise(abort, 'fixt | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …_backend/crates/providers/src/lyrics/builtin/direct.rs | 338 | if parser.tokenizer.sink.sink.0.borrow().tree.nodes().len() > 100_000 { | CODE |
| CRITICAL | rust_backend/crates/providers/src/resolver/client.rs | 435 | if parser.tokenizer.sink.sink.0.borrow().tree.nodes().len() > 100_000 { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | lib/utils/progress_stream_poller.dart | 3 | /// Shared scaffold for consuming a native progress stream (EventChannel-backed) | COMMENT |
| MEDIUM | lib/screens/extension_collection_screens.dart | 45 | /// Shared loading/error+retry scaffold for extension album/playlist/artist | COMMENT |
| MEDIUM | lib/screens/extension_collection_screens.dart | 181 | /// Defers swapping the loading scaffold for the loaded screen until the push | COMMENT |
| MEDIUM | lib/widgets/scroll_edge_fade.dart | 12 | /// Fades the content itself instead of painting the scaffold background | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | third_party/audio_service/lib/audio_service.dart | 2940 | /// You can choose to implement all methods yourself, or you may leverage some | COMMENT |
| MEDIUM | lib/services/audio_analysis_ffmpeg.dart | 434 | // Apply only light smoothing after the robust frequency aggregation. This | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | third_party/audio_service/lib/audio_service.dart | 3041 | /// Example usage: | COMMENT |
| LOW | third_party/audio_service/lib/audio_service.dart | 3050 | /// Example usage: | COMMENT |
| LOW | scripts/setup_macos_signing.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/package_linux.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/local_library_artwork_test.dart | 135 | return Text(path ?? 'placeholder'); | CODE |
| LOW | test/local_library_artwork_test.dart | 164 | builder: (_, path) => Text(path ?? 'placeholder'), | CODE |
| LOW | test/local_library_artwork_test.dart | 185 | builder: (_, cover) => Text(cover ?? 'placeholder'), | CODE |
| LOW | rust_backend/crates/extensions/src/manifest.rs | 154 | placeholder: String => "placeholder", | CODE |
| LOW | lib/models/extension.dart | 422 | placeholder: json['placeholder'] as String?, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/prepare_discord_sdk.py | 89 | CODE | |
| LOW | scripts/test_check_backend_apk.py | 83 | CODE | |
| LOW | scripts/check_backend_apk.py | 69 | CODE | |
| LOW | scripts/check_backend_apk.py | 127 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/support/sqlite_process_database.dart | 37 | except Exception as error: | CODE |
| MEDIUM | third_party/audio_service/lib/audio_service.dart | 1267 | print('Error loading artUri: $e\n$st'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/release.yml | 41 | # Check if version contains -preview, -beta, -rc, or -alpha (NOT -hotfix) | COMMENT |