1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-28

Last Push

15.6K

Stars

Rust

Language

557.1K

Lines of Code

1.7K

Files

278

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 224 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.3/100 · LOW

Are imports declared and package/API names verified? 44 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 13 finding(s).

PR Review Velocity Impact 5.4/100 · LOW

Which changes need focused human review? 278 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 36HIGH 1MEDIUM 6LOW 235

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 278 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators36 hits · 360 pts

Severity	File	Line	Snippet	Context
CRITICAL	crates/imap/src/core/mailbox.rs	115	verified_at: self.server.inner.cache.revalidate.now(),	CODE
CRITICAL	crates/imap/src/core/mailbox.rs	228	if !self.server.inner.cache.revalidate.is_within(verified_at) {	CODE
CRITICAL	crates/imap/src/core/mailbox.rs	289	let verified_at = self.server.inner.cache.revalidate.now();	CODE
CRITICAL	crates/imap/src/op/list.rs	229	mailbox_name: self.server.core.email.shared_folder.as_str().into(),	CODE
CRITICAL	crates/imap/src/op/create.rs	229	if path.first() == Some(&self.server.core.email.shared_folder.as_str()) {	CODE
CRITICAL	crates/imap/src/op/copy_move.rs	532	Some(is_spam) if self.server.core.spam.classifier.is_some() => Some(	CODE
CRITICAL	crates/imap/src/op/namespace.rs	28	Some(self.server.core.email.shared_folder.as_str().into())	CODE
CRITICAL	crates/spam-filter/src/analysis/domain.rs	56	email.element.email.domain_part.fqdn.clone(),	CODE
CRITICAL	crates/spam-filter/src/analysis/score.rs	260	if acc.decision().is_none() && !self.core.spam.rules.after_ai.is_empty() {	CODE
CRITICAL	crates/spam-filter/src/modules/expression.rs	200	ExpressionVariable::FromDomain => output.from.email.domain_part.fqdn.as_str().into(),	CODE
CRITICAL	crates/common/src/auth/access_token.rs	62	UserRoles::User => self.core.network.security.default_role_ids_user.as_slice(),	CODE
CRITICAL	crates/common/src/auth/access_token.rs	75	self.core.network.security.default_role_ids_admin.as_slice()	CODE
CRITICAL	crates/common/src/auth/access_token.rs	191	.unwrap_or(self.core.network.security.default_role_ids_group.as_slice());	CODE
CRITICAL	crates/common/src/auth/permissions.rs	121	UserRoles::User => self.core.network.security.default_role_ids_user.as_slice(),	CODE
CRITICAL	crates/common/src/auth/permissions.rs	134	self.core.network.security.default_role_ids_admin.as_slice()	CODE
CRITICAL	crates/common/src/auth/permissions.rs	144	.unwrap_or(self.core.network.security.default_role_ids_group.as_slice()),	CODE
CRITICAL	crates/common/src/auth/rate_limit.rs	131	self.core.network.http.rate_authenticated.is_some() && is_remote,	CODE
CRITICAL	crates/common/src/auth/oauth/cimd.rs	90	self.core.network.resources.registrable_domain.as_deref(),	CODE
CRITICAL	crates/common/src/network/security.rs	438	self.core.network.security.auth_fail_rate.is_some()	CODE
CRITICAL	crates/common/src/network/dns/update.rs	1301	match self.core.smtp.resolvers.dns.txt_raw_lookup(&name).await {	CODE
CRITICAL	crates/common/src/scripts/plugins/lookup.rs	32	_ => Some(ctx.server.core.storage.memory.clone()),	CODE
CRITICAL	crates/common/src/scripts/plugins/lookup.rs	61	_ => Some(ctx.server.core.storage.memory.clone()),	CODE
CRITICAL	crates/common/src/scripts/plugins/lookup.rs	85	_ => Some(ctx.server.core.storage.memory.clone()),	CODE
CRITICAL	crates/common/src/scripts/plugins/query.rs	25	_ => Some(ctx.server.core.storage.data.clone()),	CODE
CRITICAL	crates/http/src/request.rs	285	self.core.network.http.url_https.to_string(),	CODE
CRITICAL	crates/http/src/request.rs	1023	if !server.core.network.http.response_headers.is_empty() {	CODE
CRITICAL	crates/http/src/request.rs	1041	if server.core.network.http.remote_ip_source.is_peer() {	CODE
CRITICAL	crates/http/src/auth/oauth/authorize.rs	415	.unwrap_or_else(\|\| server.core.network.http.url_https.clone());	CODE
CRITICAL	crates/http/src/auth/oauth/openid.rs	100	let issuer = if strip_base_url && !self.core.network.http.url_https.is_empty() {	CODE
CRITICAL	crates/smtp/src/inbound/data.rs	538	let message_id = self.server.inner.data.queue_id_gen.generate();	CODE
CRITICAL	crates/smtp/src/inbound/data.rs	703	.set_variable("spam.is_spam", self.server.core.spam.scores.is_spam(score));	CODE
CRITICAL	crates/jmap/src/registry/mapping/action.rs	253	set.server.inner.data.applications.reload(&mut bp).await;	CODE
CRITICAL	crates/jmap/src/registry/mapping/action.rs	471	let (score, disposition) = match server.core.spam.lists.scores.get(&tag) {	CODE
CRITICAL	crates/jmap/src/registry/mapping/log.rs	36	let Some(path) = get.server.core.metrics.log_path.clone() else {	CODE
CRITICAL	crates/jmap/src/registry/mapping/log.rs	76	let Some(path) = req.server.core.metrics.log_path.clone() else {	CODE
CRITICAL	crates/jmap/src/api/session.rs	42	VecMap::with_capacity(self.core.jmap.capabilities.account.len() + 1);	CODE

Over-Commented Block207 hits · 190 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	241	# Uncomment and edit an entry to override its default.	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1	/*	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	581	/// When the rule has a non-empty number of BYDAY values, then this	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	621	}	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	761	})	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	781	.by_week_day	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	801	let start = dt.first_of_month();	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	861	/// where all the goods are.	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1001	// since we filter based on `until` when we pop from the	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1021	.tz()	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1041	// You'll never get back to a leap day. So instead, we track our	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1421	///	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1641	continue;	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1661	}	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1681	/// fn into_integer_iter(self) -> impl Iterator<Item = Self::Integer>;	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1701	/// * A single integer: `5`	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1721	pub trait IntoI16Iter {	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1741	///	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	1901	///	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	2021	}	COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	2061		COMMENT
LOW	crates/calcard/src/datecalc/recurrence.rs	2081	ByWeekday::Any(weekday) => Either::Left(iter_weekdays_between(weekday, start, end)),	COMMENT
LOW	crates/calcard/src/datecalc/weekdate.rs	21	#[derive(Clone, Copy, Debug)]	COMMENT
LOW	crates/calcard/src/datecalc/weekdate.rs	141	///	COMMENT
LOW	crates/calcard/src/datecalc/weekdate.rs	161	// > calendar year is the first week that contains at least four (4) days	COMMENT
LOW	crates/calcard/src/common/format.rs	321	#[cfg(all(test, stalwart_tests))]	COMMENT
LOW	crates/calcard/src/common/tzdb.rs	1	/*	COMMENT
LOW	crates/calcard/src/common/timezone.rs	21	/// A reference to the time zone a calendar value is interpreted in.	COMMENT
LOW	crates/calcard/src/icalendar/timezone.rs	701	#[cfg(all(test, stalwart_tests))]	COMMENT
LOW	crates/calcard/src/icalendar/builder.rs	761	#[cfg(all(test, stalwart_tests))]	COMMENT
LOW	crates/smtp-report/src/lib.rs	1	/*	COMMENT
LOW	crates/smtp-report/src/lib.rs	41	pub struct ReportEnvelope<'x> {	COMMENT
LOW	crates/smtp-report/src/arf/generate.rs	21	use std::{fmt::Write, io, time::SystemTime};	COMMENT
LOW	crates/smtp-report/src/arf/generate.rs	281	#[cfg(all(test, stalwart_tests))]	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	1	/*	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	21	use std::{borrow::Cow, net::IpAddr};	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	41	/// `Authentication-Results` field.	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	61	pub source_ip: Option<IpAddr>,	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	81	pub dkim_canonicalized_body: Option<Cow<'x, str>>,	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	141	/// Both mechanisms produced an aligned identifier (`dkim, spf`).	COMMENT
LOW	crates/smtp-report/src/arf/mod.rs	161	Other,	COMMENT
LOW	crates/smtp-report/src/arf/parse.rs	41	.and_then(\|offset\| source.get(offset..offset + bytes.len()))	COMMENT
LOW	crates/smtp-report/src/tlsrpt/generate.rs	21	struct ReportHeader {	COMMENT
LOW	crates/smtp-report/src/tlsrpt/generate.rs	41	/// Fields read from `envelope`:	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	41	pub contact_info: Option<String>,	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	61		COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	81	#[serde(rename = "policy-string")]	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	101	#[serde(rename = "total-successful-session-count")]	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	121	#[serde(rename = "sending-mta-ip")]	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	141	/// Number of sessions that failed this way (`failed-session-count`).	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	161	pub struct DateRange {	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	181	#[serde(rename = "sts")]	COMMENT
LOW	crates/smtp-report/src/tlsrpt/mod.rs	201	#[serde(rename = "certificate-host-mismatch")]	COMMENT
LOW	crates/smtp-report/src/tlsrpt/parse.rs	21	/// `result-type` values map to the `Other` variant.	COMMENT
LOW	crates/smtp-report/src/dmarc/generate.rs	21	use mail_builder::{MessageBuilder, headers::HeaderType, mime::make_boundary};	COMMENT
LOW	crates/smtp-report/src/dmarc/generate.rs	41	/// the file name.	COMMENT
LOW	crates/smtp-report/src/dmarc/generate.rs	61	/// },	COMMENT
LOW	crates/smtp-report/src/dmarc/generate.rs	81	/// },	COMMENT
LOW	crates/smtp-report/src/dmarc/generate.rs	101	/// };	COMMENT
LOW	crates/smtp-report/src/dmarc/mod.rs	1	/*	COMMENT
147 more matches not shown…

Excessive Try-Catch Wrapping10 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	resources/scripts/ossify.py	70	except Exception as e:	CODE
MEDIUM	resources/scripts/ossify.py	71	print(f"Error reading file {file_path}: {e}")	CODE
LOW	resources/scripts/ossify.py	167	except Exception as e:	STRING
MEDIUM	resources/scripts/ossify.py	205	print(f"Error: {args.directory} is not a valid directory")	STRING
LOW	resources/scripts/migrate_v016.py	1810	except Exception as exc:	CODE
MEDIUM⚡	resources/scripts/imap-log-sanitizer.py	132	print(f"Error: File '{args.input_file}' not found")	CODE
LOW⚡	resources/scripts/imap-log-sanitizer.py	134	except Exception as e:	CODE
MEDIUM⚡	resources/scripts/imap-log-sanitizer.py	135	print(f"Error reading file: {e}")	CODE
LOW	resources/scripts/imap-log-sanitizer.py	159	except Exception as e:	CODE
MEDIUM	resources/scripts/imap-log-sanitizer.py	160	print(f"Error writing output: {e}")	CODE

Deep Nesting8 hits · 8 pts

Severity	File	Line	Context
LOW	resources/scripts/ossify.py	23	CODE
LOW	resources/scripts/ossify.py	92	CODE
LOW	resources/scripts/ossify.py	131	CODE
LOW	resources/scripts/ossify.py	183	CODE
LOW	resources/scripts/migrate_v016.py	840	CODE
LOW	resources/scripts/list_active_blobs.py	92	CODE
LOW	resources/scripts/list_active_blobs.py	48	CODE
LOW	resources/scripts/imap-log-sanitizer.py	102	CODE

Structural Annotation Overuse4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	UPGRADING/v0_16.md	76	## Step 1: Convert existing settings into a configuration snapshot	COMMENT
LOW	UPGRADING/v0_16.md	149	## Step 2: Back up the database	COMMENT
LOW	UPGRADING/v0_16.md	213	## Step 3: Perform the migration	COMMENT
LOW	UPGRADING/v0_16.md	460	## Step 4: Post-migration tasks	COMMENT

Fake / Example Data4 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	crates/smtp-report/src/dmarc/generate.rs	105	/// to: vec!["dmarc-reports@example.org"],	COMMENT
LOW	crates/text-extract/src/odf.rs	161	(true, b"placeholder") => value == b"true",	CODE
LOW	crates/main/src/test_data.rs	146	address: "bob@example.org".into(),	CODE
LOW	crates/main/src/test_data.rs	166	orcpt: Some("bob@example.org".into()),	CODE

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/smtp/Cargo.toml	60	#harness = false	COMMENT

Unused Imports3 hits · 3 pts

Severity	File	Line	Context
LOW	resources/scripts/ossify.py	18	CODE
LOW	resources/scripts/migrate_v016.py	29	CODE
LOW	resources/scripts/imap-log-sanitizer.py	13	CODE

Hyper-Verbose Identifiers3 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	resources/scripts/ossify.py	92	def remove_proprietary_snippets(content: str) -> Tuple[str, int]:	STRING
LOW	resources/scripts/migrate_v016.py	953	def _tenant_default_domain_cid(self, p: dict[str, Any]) -> str \| None:	CODE
LOW	resources/scripts/migrate_v016.py	1287	def _is_same_kv_store_as_data(self, sub: dict[str, str]) -> bool:	CODE

Cross-Language Confusion1 hit · 2 pts

Severity	File	Line	Snippet	Context
HIGH	resources/scripts/repair_fdb_chunks.py	6	extra chunk, suffixed with a single byte: `key`, `key \|\| 0x00`, `key \|\| 0x01`,	STRING

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	969	# Check if curl supports the --retry flag, then pass it to the curl invocation.	COMMENT

stalwartlabs/stalwart

Open-Source Code Quality, Security and Technical Debt Review