2.3

Adjusted Signal

2.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

10.8K

Stars

JavaScript

Language

67.1K

Lines of Code

166

Files

149

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 146 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 9.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 116 finding(s).

PR Review Velocity Impact 10.5/100 · LOW

Which changes need focused human review? 149 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 149

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 149 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers116 hits · 126 pts

Severity	File	Line	Snippet	Context
LOW	backend/src/core/proxy-utils/vmess-security.js	29	function canonicalizeVmessSecurity(security) {	CODE
LOW	backend/src/core/proxy-utils/vmess-security.js	57	export function normalizeClashVmessSecurity(security) {	CODE
LOW	backend/src/core/proxy-utils/vmess-security.js	75	export function formatSurgeVmessEncryptMethod(security) {	CODE
LOW	backend/src/core/proxy-utils/transport-path.js	89	export function getSafeIntegerPathQueryParam(rawPath, paramName) {	CODE
LOW	backend/src/core/proxy-utils/transport-path.js	125	export function normalizeWebSocketEarlyDataPath(wsOpts) {	CODE
LOW	backend/src/core/proxy-utils/transport-path.js	160	export function deleteHttpUpgradeEarlyDataMetadata(wsOpts) {	CODE
LOW	backend/src/core/proxy-utils/index.js	650	function isRootHeaderSensitiveProxy(proxy) {	CODE
LOW	backend/src/core/proxy-utils/xhttp-utils.js	1	function parseNormalizedXhttpRangeBounds(	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	61	function parseNormalizedXhttpPositiveRangeBounds(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	67	function parseNormalizedXhttpStrictPositiveRangeBounds(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	74	export function normalizeXhttpPositiveRange(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	84	export function normalizeXhttpStrictPositiveRangeString(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	94	export function normalizeXhttpStrictPositiveRangeValue(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	104	export function normalizeXhttpNonNegativeRange(value) {	CODE
LOW⚡	backend/src/core/proxy-utils/xhttp-utils.js	114	export function normalizeXhttpIntegerValue(	CODE
LOW	backend/src/core/proxy-utils/ech-utils.js	39	export function isSupportedXrayEchConfigList(echConfigList) {	CODE
LOW	backend/src/core/proxy-utils/ech-utils.js	43	export function isSupportedXrayEchForceQuery(forceQuery) {	CODE
LOW	backend/src/core/proxy-utils/ech-utils.js	60	export function buildMihomoEchOptsFromXrayFields({	CODE
LOW	backend/src/core/proxy-utils/ech-utils.js	93	export function buildXrayEchFieldsFromMihomo(	CODE
LOW	backend/src/core/proxy-utils/ech-utils.js	142	export function buildXrayEchConfigListFromMihomo(	CODE
LOW	backend/src/core/proxy-utils/parsers/index.js	57	function decodeShadowsocksUserInfo(rawUserInfoStr) {	CODE
LOW	backend/src/core/proxy-utils/parsers/index.js	121	function parseWireGuardURIAddressValue(value) {	CODE
LOW	backend/src/core/proxy-utils/parsers/peggy/surge.js	83	function startsWithQuotedHeaderKey(text) {	CODE
LOW	backend/src/core/proxy-utils/producers/shadowrocket.js	316	function hasShadowrocketSnellShadowTlsObfsConflict(proxy) {	CODE
LOW	backend/src/core/proxy-utils/producers/clashmeta.js	26	function warnMihomoUnsupportedEchDns(proxy, echOpts, echOptsPath) {	CODE
LOW	backend/src/core/proxy-utils/producers/clashmeta.js	39	function warnMihomoUnsupportedEchDnsFields(proxy, type) {	CODE
LOW	backend/src/core/proxy-utils/producers/clashmeta.js	482	function hasMihomoSnellShadowTlsObfsConflict(proxy) {	CODE
LOW	backend/src/core/proxy-utils/producers/clashmeta.js	492	function getMihomoShadowTlsVersion(proxy) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	59	export function normalizePluginMuxBooleanValue(mux) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	94	export function restoreShadowTLSProxyOpts(proxy) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	119	function parseWireGuardInterfaceAddress(value, family) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	135	function normalizeWireGuardInterfaceAddress(proxy, config) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	152	export function normalizeWireGuardInterface(proxy = {}) {	CODE
LOW	backend/src/core/proxy-utils/producers/utils.js	168	export function getWireGuardAddressWithCIDR(proxy = {}, family = 'ipv4') {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	54	function setHttpUpgradeEarlyDataPath(path, transportOpts) {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	66	function setWebSocketEarlyDataPath(path, transportOpts) {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	96	function getSerializableXhttpRangeValue(value) {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	171	function applyStructuredXhttpExtraFields(	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	286	function buildXhttpDownloadSettings(	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	435	function buildStructuredVlessExtraObject(proxy) {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	471	function mergeUnsupportedXhttpExtraValue(baseValue, unsupportedValue) {	CODE
LOW	backend/src/core/proxy-utils/producers/uri.js	487	function mergeUnsupportedXhttpExtraObject(baseObject, unsupportedObject) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	29	export function isResponseTransformerType(type) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	530	function AddProxiesFromSubscriptionOperator(	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	611	function normalizeResolveDomainConcurrency(concurrency) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	628	function normalizeResolveDomainCustomDnsConcurrency(concurrency) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	645	function normalizeResolveDomainTimeout(timeout, defaultTimeout) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	677	function normalizeResolveDomainCacheTtl(cacheTtl) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	703	function normalizeCustomDnsUrlList(url) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	707	async function resolveDomainsWithConcurrency(	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	725	async function resolveWithCustomDnsConcurrency(urls, concurrency, resolveUrl) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	801	function getCachedDomainResolverResult(	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	854	function packCustomDnsCachedResult(result, resolverUrl) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	861	function unpackCustomDnsCachedResult(cached) {	CODE
LOW	backend/src/core/proxy-utils/processors/index.js	873	function getCustomDnsResultResolverUrl(result) {	CODE
LOW	backend/src/test/utils/request-concurrency.spec.js	26	function setRequestConcurrencySettings(settings) {	CODE
LOW	backend/src/test/restful/download.spec.js	107	async function requestDownloadSubscription(query) {	CODE
LOW	backend/src/test/restful/download.spec.js	152	async function requestDownloadCollection(query) {	CODE
LOW	backend/src/utils/download.js	39	function maybePrefixGithubProxyUrl(url, githubProxy, githubProxyRegex) {	CODE
LOW	backend/src/utils/download.js	125	function formatPlainDownloadResult(result, returnRaw) {	CODE
56 more matches not shown…

Over-Commented Block30 hits · 27 pts

Severity	File	Line	Snippet	Context
LOW	backend/src/core/proxy-utils/producers/sing-box.js	1521	// proxy.cipher = 'none';	COMMENT
LOW	backend/src/core/proxy-utils/producers/clashmeta.js	261	// 会先把 flow 截断到 16 个字符，并且只接受	COMMENT
LOW	backend/src/utils/index.js	61		COMMENT
LOW	backend/src/utils/index.js	81	// (array[i++] & 0x3f);	COMMENT
LOW	scripts/demo.js	1	function operator(proxies = [], targetPlatform, context) {	COMMENT
LOW	scripts/demo.js	21	// 输出到 Clash/Stash 时, 会过滤掉配置了前置代理的节点, 并提示使用对应的功能.	COMMENT
LOW	scripts/demo.js	41	// 非空 certificate/certificate_path 不能与非空 certificate_sha256/certificate_public_key_sha256 共存, 冲突时会报错并过滤该节点; certif	COMMENT
LOW	scripts/demo.js	61	// 32. mihomo 中 Snell shadow-tls 字段与 ss shadow-tls 字段不同, 使用的是 obfs-opts 而不是 plugin+plugin-opts, 不能与 obfs http/tls 共存.	COMMENT
LOW	scripts/demo.js	81	// 43. sing-box WireGuard 支持 `_name` 设置系统接口名称 `name`, 配合 `system: true` 使用; 节点的 `name` 仍用于输出 `tag`. 例如: $server._name	COMMENT
LOW	scripts/demo.js	101	// 先这样处理 encodeURIComponent('arg1=a&arg2=b')	COMMENT
LOW	scripts/demo.js	121	// 则会在输出时设置响应头, 例如:	COMMENT
LOW	scripts/demo.js	141	// const ua = headers?.['user-agent'] \|\| headers?.['User-Agent']	COMMENT
LOW	scripts/demo.js	161	// 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/14	COMMENT
LOW	scripts/demo.js	181	// cache.get('a:1')	COMMENT
LOW	scripts/demo.js	201		COMMENT
LOW	scripts/demo.js	221	// 可参考 https://telegram.me/zhetengsha/1066	COMMENT
LOW	scripts/demo.js	241	// },	COMMENT
LOW	scripts/demo.js	261	// type: 'file',	COMMENT
LOW	scripts/demo.js	281	// 'age1...'	COMMENT
LOW	scripts/demo.js	301	// })	COMMENT
LOW	scripts/demo.js	321	// 3. clash.meta	COMMENT
LOW	scripts/demo.js	341	// const content = ProxyUtils.produce([...proxies], platform)	COMMENT
LOW	scripts/demo.js	361	// $content = ProxyUtils.Base64.encode($content ?? $files[0])	COMMENT
LOW	scripts/demo.js	381	// console.log(`User-Agent: ${ua}`);	COMMENT
LOW	scripts/demo.js	401	// 适用于 type: 'subscription' / 'sub' / 'collection' / 'col', 不传时仍直接返回处理结果	COMMENT
LOW	scripts/demo.js	421	// for (const [key, value] of Object.entries(context.source)) {	COMMENT
LOW	scripts/demo.js	441	// "icon": "",	COMMENT
LOW	scripts/demo.js	461	// "icon": "",	COMMENT
LOW	scripts/demo.js	481	// "process": [],	COMMENT
LOW	scripts/demo.js	501	// },	COMMENT

Fake / Example Data3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	backend/src/test/utils/gist.spec.js	122	content: 'placeholder',	CODE
LOW	backend/src/test/utils/gist.spec.js	129	content: 'placeholder',	CODE
LOW	backend/src/test/utils/gist.spec.js	174	content: 'placeholder',	CODE

sub-store-org/Sub-Store

Open-Source Code Quality, Security and Technical Debt Review