Home / square / leakcanary
AI Slop Code Risk Monitor

square/leakcanary

SlopCodeMonitor badge for square/leakcanary Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A memory leak detection library for Android.

1.4 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for square/leakcanary, a Kotlin project with 30,003 GitHub stars. SynthScan examined 132,425 lines of code across 889 source files, recording 78 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.4
Adjusted Signal
1.4
Raw Pattern Score
100%
Time Factor
2026-10-21
Last Push
30.0K
Stars
Kotlin
Language
132.4K
Lines of Code
889
Files
78
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 74 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.2/100 · LOW

Are imports declared and package/API names verified? 4 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 6.1/100 · LOW

Which changes need focused human review? 78 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 0MEDIUM 31LOW 44

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 78 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

AI Slop Vocabulary28 hits · 102 pts
SeverityFileLineSnippetContext
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh3# Follows what the harness's agent is doing, live: every call it makes, and everything that comes back.COMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh5# What this is for: `start-harness.sh` shows you the agent's *answer* — the text a `--print` run prints when itCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh14# ./watch-transcript.sh follow the newest harness run in this terminalCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh19# harness: 17 lines two seconds in, 36 by the time the client exited eleven seconds later. It is not writtenCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh23# **Which file it is, is knowable before the run starts, and only because the harness pins the session id.**COMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh26# is what `start-harness.sh` passes to close that, and `session-id.txt` beside the prompt is where it writesCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh29# **Don't compute the path from the harness directory — glob for the id.** The client keys the directory onCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh30# the *physical* working directory, and on macOS `$TMPDIR` is a symlink into `/private/var`, so the harness'sCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh32# harness ever mentions. A path built by hand is therefore right on Linux and wrong here. The id is unique, soCOMMENT
MEDIUM…hark-dive/shark-dive-agent/harness/watch-transcript.sh98# started. Named explicitly when it isn't: harness directories are never deleted — see `start-harness.sh` onCOMMENT
MEDIUM…hark-dive/shark-dive-agent/harness/watch-transcript.sh124# Empty when the run was staged before `start-harness.sh` wrote one down, which `wait_for_the_transcript`COMMENT
MEDIUM…hark-dive/shark-dive-agent/harness/watch-transcript.sh134# this globs for the id rather than building the path from the harness directory.COMMENT
MEDIUM…hark-dive/shark-dive-agent/harness/watch-transcript.sh216 # The description before the command for Bash, which on this harness is very nearly every call: an agentCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh229# the person's own `~/.claude`. That is the whole of what keeps a harness run readable on its own: the clientCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh230# is already isolated to `$HARNESS_DIRECTORY/claude` — see `run_the_agent` in start-harness.sh — so theCOMMENT
MEDIUM⚡…hark-dive/shark-dive-agent/harness/watch-transcript.sh234# hand, since nothing pushes. `--port 0` because several harness runs being read at once is the normal caseCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh11# thing it has to get right — which is the first thing a person has to get right too. A harness that handedCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh13# `harness/eval/run-eval.sh` opens nothing. See `write_prompt`.COMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh56# for the same reason the directory does: two harness runs both tiled `Agent harness` are two windows nobodyCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh82# harness directories are never deleted and two runs at once is the normal case, so the newest is the rightCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh146# harness windows at once are indistinguishable on screen. Renaming the copy names the tile; the two plistCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh203# harness's own shape breaks: the app is a copy of a build in a temporary directory, in neither of the twoCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh241# tool would be scored on something else; a harness is not scoring anything. **So this runs a model's shellCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/start-harness.sh246# answer for a harness that is about the surface rather than about a model — a name written down here is a nameCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh283# `start-harness.sh` dropped it, having nothing to score. This comment claimed it was doing that job aloneCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh289# a heap dump. `start-harness.sh`'s `run_the_agent` has the measurement and why it is invisible from inside anCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh316# the run is about, which reads like a harness leaking the other scenarios and not this one. And the clientCOMMENT
MEDIUM…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh419# A copy for the two reasons `start-harness.sh` copies — `build/compose` is deleted by the next Compose task,COMMENT
Over-Commented Block40 hits · 40 pts
SeverityFileLineSnippetContext
LOWconfig/detekt-config.yml61 LabeledExpression:COMMENT
LOWgradle/libs.versions.toml1# Copyright (C) 2021 Square, Inc.COMMENT
LOW.github/workflows/promote-shark-dive.yml1# Tells every running Shark Dive that a release exists, which is a separate act from publishing it.COMMENT
LOW.github/workflows/main.yml101 # whether to show error dialogs from the configuration alone and ignore it.COMMENT
LOW…hark-dive/shark-dive-agent/harness/watch-transcript.sh1#!/bin/bashCOMMENT
LOW…hark-dive/shark-dive-agent/harness/watch-transcript.sh21# it and a reader that starts early blocks until there is more.COMMENT
LOW…hark-dive/shark-dive-agent/harness/watch-transcript.sh41# dropped by the file, it never arrives.COMMENT
LOW…hark-dive/shark-dive-agent/harness/watch-transcript.sh121 echo "${newest%/}"COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh1#!/bin/bashCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh21# and still not a blind one. **So a run that is meant to show whether the surface carries an investigationCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh61readonly CLIENT_CONFIG_DIRECTORY="$HARNESS_DIRECTORY/claude"COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh141COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh181# real name is what somebody reading a staged directory afterwards is looking for.COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh201#COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh221# second lock whose comment claims to be load-bearing is the kind of thing somebody later reasons from.COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh241# tool would be scored on something else; a harness is not scoring anything. **So this runs a model's shellCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/start-harness.sh281 --permission-mode bypassPermissions \COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh1#!/bin/bashCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh21#COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh41# Every invocation gets a directory of its own, named for when it started, because notes and verdicts are keptCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh181# shell:COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh201#COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh221 mkdir -p "$directory/cwd"COMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh261ENDCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh281# and one on a scratch directory has none. Which makes `--strict-mcp-config` below redundant rather thanCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh301# and the final answer — and it is **not** a transcript: the model's own turns, and the thinking between twoCOMMENT
LOW…k/shark-dive/shark-dive-agent/harness/eval/run-eval.sh341}COMMENT
LOWshark/shark-dive/shark-dive-app/icons/render-icons.sh1#!/usr/bin/env bashCOMMENT
LOW…k-dive-app/src/test/java/shark/dive/app/DiveAppTest.kt761COMMENT
LOW…-dive-app/src/main/java/shark/dive/app/HeapDumpDive.kt501 }COMMENT
LOW…ve/shark-dive-app/src/main/java/shark/dive/app/Main.kt81 // Launched from a terminal, so Shark's own diagnostics and any failure to open a heap dump belong onCOMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt261 */COMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt281 //COMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt301 //COMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt321 ownedObjects = InstancesOf(LayoutNodeChildReferenceReader.LAYOUT_NODE_CLASS_NAME),COMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt341 // Compose's modifier nodes point back at their coordinators, which point back at their layers andCOMMENT
LOW…-dive-core/src/main/java/shark/dive/OwnerReferences.kt361 // of a Dagger and a Metro component: every scoped instance came out under the root, and under thisCOMMENT
LOW…-dive-core/src/main/java/shark/dive/CachedMapValues.kt181 // library's — nine SQLite prepared statement caches, a job cache, a typeface cache, two empty onesCOMMENT
LOW…-core/src/main/java/shark/dive/HeapDominatorTreemap.kt1221 // A section a strength names, or an object nothing reaches: either way there is nothing to fix for theseCOMMENT
LOWshark/shark/src/main/java/shark/HeapAnalyzer.kt101 // TODO Callers should add to analysisStartNanoTimeCOMMENT
Hallucination Indicators3 hits · 30 pts
SeverityFileLineSnippetContext
CRITICAL…e-core/src/test/java/shark/dive/DeviceHeapDumpsTest.kt299 at com.android.server.am.ActivityManagerService.enforceDebuggable(ActivityManagerService.java:1)CODE
CRITICAL…ve/shark-dive-core/src/test/java/shark/dive/AdbTest.kt139 at com.android.server.am.ActivityManagerService.enforceDebuggable(ActivityManagerService.java:1)CODE
CRITICAL…ve/shark-dive-core/src/test/java/shark/dive/AdbTest.kt140 at com.android.server.am.ActivityManagerService.dumpHeap(ActivityManagerService.java:2)CODE
Slop Phrases4 hits · 6 pts
SeverityFileLineSnippetContext
LOW…d-core/src/main/java/leakcanary/internal/tv/TvToast.kt22 * Don't forget to call [Toast.show] to display the toast!COMMENT
LOW…-release/src/main/java/leakcanary/BackgroundTrigger.kt25 * Defaults to logging to [SharkLog] (don't forget to set [SharkLog.logger] if you do want to seeCOMMENT
LOW…d-release/src/main/java/leakcanary/ScreenOffTrigger.kt34 * Defaults to logging to [SharkLog] (don't forget to set [SharkLog.logger] if you do want to seeCOMMENT
MEDIUMdocs/theme/main.html4 Upgrade to <a href="{{ base_url }}/changelog/">LeakCanary <strong>{{config.extra.leak_canary.release}}</strong></a> 🐤CODE
Modern AI Meta-Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMgradle/libs.versions.toml59# The two dependency injection runtimes Shark Dive has an owner rule about, on the test classpath ofCOMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/main.yml73 # Create the AVD and boot it from scratch on every run, rather than restoring a cachedCOMMENT
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…rk-dive-core/src/test/java/shark/dive/ReferrersTest.kt258 field["placeholder"] = payloadCODE