0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

2.4K

Stars

TypeScript

Language

672.0K

Lines of Code

2.8K

Files

469

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 448 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 21 finding(s).

Agent Over-Engineering Ratio 2.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 341 finding(s).

PR Review Velocity Impact 4.2/100 · LOW

Which changes need focused human review? 469 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 3MEDIUM 30LOW 432

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 469 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers341 hits · 342 pts

Severity	File	Line	Snippet	Context
LOW	tools/config-api-compare.ts	410	function renderShallowHistorySkippedSummary(	CODE
LOW	tools/config-release-gate.ts	367	function hasRemovedDeclarationLines(entries: readonly FileEntry[]): boolean {	CODE
LOW	tools/config-release-gate.ts	502	function renderFirstPublishSummary(nextVersion: string): string {	CODE
LOW	packages/config/scripts/build-artifacts.unit.test.ts	15	function findAnyOfWithNonFiniteEnum(node: unknown, into: Array<unknown>): void {	CODE
LOW	…nfig/scripts/semantic-release-path-filter.unit.test.ts	85	function fakeAnalyzeCommitsContext(commits: Commit[], cwd: string): AnalyzeCommitsContext {	CODE
LOW	packages/config/src/entrypoint-purity.unit.test.ts	86	function isStaticSpecifierArgument(argument: string): boolean {	CODE
LOW	packages/config/src/entrypoint-purity.unit.test.ts	95	function findUnresolvableDynamicSpecifiers(rawSource: string): string[] {	CODE
LOW	packages/config/src/errors.ts	44	export function formatProjectConfigParseErrorMessage(	CODE
LOW	packages/config/src/json-schema-document.ts	19	export function toPublishedJsonSchemaDocument(	CODE
LOW	packages/config/src/json-schema-document.ts	101	function acceptEnvReferencesInUnion(members: ReadonlyArray<unknown>): Array<unknown> {	CODE
LOW	packages/config/src/config-edit.ts	451	function scanMultilineLiteralString(source: string, pos: number): number \| null {	CODE
LOW	packages/config/src/config-edit.ts	853	function placementOffsetForNewTable(	CODE
LOW	packages/config/src/config-edit.ts	902	function renderMissingTableCluster(	CODE
LOW	packages/config/src/config-document.ts	132	function getDefaultEncodedCliConfig(): ReturnType<typeof encodeCliConfig> {	CODE
LOW	packages/config/src/config-document.ts	146	function stripFunctionRecordDefaults(value: unknown): unknown {	CODE
LOW	packages/config/src/config-document.ts	190	export function encodeCliConfigToJsonDocument(	CODE
LOW	packages/config/src/config-document.ts	197	export function encodeCliConfigToTomlDocument(	CODE
LOW	packages/config/src/io.ts	309	function mergeSelectedRemoteForValidation(	CODE
LOW	packages/config/src/auth/sms.ts	81	function validateSmsProviderSwitch(value: SmsProviderSwitchInput) {	CODE
LOW	packages/config/src/project-config/registry-row.ts	170	export function canonicalizeCommaJoinedArray(value: unknown): unknown {	CODE
LOW	packages/config/src/project-config/project-schema.ts	167	export function toProjectConfigJsonSchema() {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	231	function canonicalizeDurationString(value: unknown): unknown {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	249	function roundTripThroughHoursPayload(ns: number): number {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	263	function truncateLikePushFormatter(ns: number): number {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	285	function canonicalizeWholeSecondsDurationString(value: unknown): unknown {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	662	function smtpExplicitlyDisabledInAttributes(attributes: Record<string, unknown>): boolean {	CODE
LOW	packages/config/src/project-config/registry-auth.ts	842	function smsProviderExplicitlyUnset(attributes: Record<string, unknown>): boolean {	CODE
LOW	…/config/src/project-config/project-config.unit.test.ts	681	function isExcludedOrAncestorExcluded(path: ReadonlyArray<string>): boolean {	CODE
LOW	packages/config/src/project-config/project-config.ts	81	function copyHostedValueForDocument(value: unknown, path: ReadonlyArray<string>): unknown {	CODE
LOW	packages/config/src/project-config/project-config.ts	117	function applyDocumentNormalizations(output: Record<string, unknown>): void {	CODE
LOW	packages/config/src/project-config/project-config.ts	136	function removePathAndEmptiedAncestors(	CODE
LOW	packages/config/src/project-config/project-config.ts	199	function readConfigDocumentSourceProperty(input: Record<string, unknown>, key: string): unknown {	CODE
LOW	packages/config/src/project-config/project-config.ts	218	function unwrapConfigDocumentSource(input: Record<string, unknown>): {	CODE
LOW	packages/config/src/project-config/project-config.ts	330	function foldProviderSignupAliases(	CODE
LOW	packages/config/src/project-config/project-config.ts	355	function applySmsProviderPrecedence(result: Record<string, unknown>): void {	CODE
LOW	packages/config/src/project-config/project-config.ts	616	function assertProjectConfigResourceType(envelope: Record<string, unknown>): void {	CODE
LOW	packages/config/src/project-config/project-config.ts	660	function schemaDecodeFailureMessage(cause: unknown): {	CODE
LOW	packages/config/src/project-config/project-config.ts	808	function assertRawAttributesDepthWithinBound(	CODE
LOW	packages/config/src/project-config/project-config.ts	1169	function sanitizeNonFiniteArrayLeaf(value: unknown, depth: number): unknown {	CODE
LOW	packages/config/src/project-config/project-config.ts	1335	export function isComparableProjectConfigPath(path: ReadonlyArray<string>): boolean {	CODE
LOW	packages/config/src/project-config/registry.ts	424	function canonicalizeFileSizeLimit(value: unknown): unknown {	CODE
LOW	…/config/src/project-config/project-schema.unit.test.ts	261	function isKnownAllLocalOnlyContainer(parentPattern: ReadonlyArray<string>): boolean {	CODE
LOW	…/config/src/project-config/project-schema.unit.test.ts	318	function navigateToParentProperties(	CODE
LOW	packages/config/src/lib/secret-paths.ts	5	function collectSecretPathPatterns(	CODE
LOW⚡	packages/config/src/lib/provider-signup.ts	89	export function normalizeDeprecatedProviderSignupKeys(	CODE
LOW⚡	packages/config/src/lib/provider-signup.ts	92	export function normalizeDeprecatedProviderSignupKeys(	CODE
LOW⚡	packages/config/src/lib/provider-signup.ts	95	export function normalizeDeprecatedProviderSignupKeys(	CODE
LOW	packages/config/src/lib/provider-signup.ts	111	export function writeProviderSignupPreferredKeys(document: DocumentLayer): DocumentLayer {	CODE
LOW	packages/config/src/lib/env.ts	291	export function interpolateEnvReferencesAgainstSchema(	CODE
LOW	packages/config/src/lib/resolve.ts	111	export function resolveCliConfigValueAtPath(	CODE
LOW	packages/api/scripts/download-openapi.ts	67	function unescapeJsonPointerSegment(segment: string): string {	CODE
LOW	packages/api/scripts/generate.ts	429	function containsOpenableStringEnum(value: unknown): boolean {	CODE
LOW	packages/api/scripts/generate.ts	519	export function normalizeNullableJsonSchema(schema: JsonSchema.JsonSchema): JsonSchema.JsonSchema {	CODE
LOW	packages/api/scripts/generate.ts	592	export function normalizeQueryParameterSchema(	CODE
LOW	packages/api/scripts/generate.ts	799	function assertOperationVersionAgreement(operation: {	CODE
LOW	packages/api/src/generated-contract-sync.unit.test.ts	36	function extractSnapshotOperations(	CODE
LOW	packages/api/src/generated-contract-sync.unit.test.ts	63	function methodNameFromSdkOperationId(sdkOperationId: string): string {	CODE
LOW	packages/api/src/generated-contract-sync.unit.test.ts	93	function versionedOperationFunction(version: string, methodName: string): unknown {	CODE
LOW	packages/api/src/internal/client.ts	246	function isRetryableTransportError(error: unknown): error is HttpClientError.HttpClientError {	CODE
LOW	.github/scripts/sync-artifacts-catalog.ts	679	export function validateSlimReleasePublishedPayload(input: {	CODE
281 more matches not shown…

Modern AI Meta-Vocabulary29 hits · 87 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/adr/0005-openapi-driven-code-generation.md	26	#### Layer 2: Command scaffold generator (one-shot, then hand-owned)	COMMENT
MEDIUM	docs/cli/dev-alpha-command-structure.md	98	### `new` means local authoring and scaffolding	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	19	// Vendored copies of the init-template scaffold files. Dotted file	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	30	// The config.toml scaffold renders through text/template, so	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	39	// Emulates what the scaffold writes to disk for a fresh `supabase init` project.	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	56	// The vendored scaffold still describes `auto_expose_new_tables` as unset-means-	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	76	// The vendored scaffold describes the per-provider `enable_signup` keys as signup switches; the	COMMENT
MEDIUM	…li/src/shared/init/project-init.templates.unit.test.ts	229	// `applyConfigEdits` must edit the scaffold exactly as intended and nothing	COMMENT
MEDIUM	apps/cli/src/shared/init/project-init.ts	303	// Requires text mode (json/stream-json stay payload-only and never scaffold	COMMENT
MEDIUM	apps/cli/src/shared/compute/compute-paths.unit.test.ts	133	// subdirectory — so without this it would be authorized as a scaffold	COMMENT
MEDIUM	apps/cli/src/shared/compute/compute-paths.unit.test.ts	234	// entry if the user quoted it. Trimming it pointed the scaffold at a different	COMMENT
MEDIUM	apps/cli/src/shared/compute/compute-paths.ts	133	// (only the trailing path separator is) — trimming could silently retarget the scaffold.	COMMENT
MEDIUM	apps/cli/src/shared/compute/compute-config.unit.test.ts	289	// out after the scaffold is written is exactly what the plan/commit split	COMMENT
MEDIUM	apps/cli/src/shared/compute/compute-config.unit.test.ts	314	// leave a scaffold on disk that nothing records.	COMMENT
MEDIUM	…nds/experimental/compute/push/push.integration.test.ts	1270	// already carries — so the answer is the absent directory, not a scaffold.	COMMENT
MEDIUM	…i/src/commands/experimental/compute/new/new.handler.ts	328	// scaffold on disk that nothing records.	COMMENT
MEDIUM	…i/src/commands/experimental/compute/new/new.handler.ts	406	// Leads with a declarative line the way every other scaffold does	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	247	// The count a scaffold cannot guess: `--instances` has no prompt, so it is	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	300	// the scaffold does not commit a line that says nothing.	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	361	// The written entry has to be loadable, or the scaffold leaves behind a project whose	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	537	// is the established bare-directory scaffold, unaffected by the fix.	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	706	// Every dial the scaffold settled, not just the two it is named for: a	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	724	// can read what this scaffold will actually deploy as.	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	775	// scaffold on disk that nothing records.	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	978	// directory the scaffold never created, while the scaffold itself lands under	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	995	// The workdir got both the entry and the scaffold it points at.	COMMENT
MEDIUM	…mands/experimental/compute/new/new.integration.test.ts	1009	// scaffold is written, like every other refusal here.	COMMENT
MEDIUM	…i/src/commands/bootstrap/bootstrap.integration.test.ts	183	// The scratch/downloaded-template fixtures never scaffold migrations/seed.sql/roles.sql, so	COMMENT
MEDIUM	apps/cli/src/commands/functions/new/new.handler.ts	111	// never scaffold IDE settings as an undisclosed side effect.	COMMENT

Over-Commented Block58 hits · 58 pts

Severity	File	Line	Snippet	Context
LOW	pnpm-workspace.yaml	61	# peer only. These consumers reach vitest through their own `vitest` peer inside a	COMMENT
LOW	packages/config/testdata/legacy-config.toml	161	# If disabled, the refresh token will never expire.	COMMENT
LOW	.github/dependabot.yml	21	# NOTE: this ecosystem's `versions` strings are parsed as Ruby	COMMENT
LOW	.github/workflows/verify-install-channels.yml	81	set -euo pipefail	COMMENT
LOW	.github/workflows/ai-review.yml	161	fi	COMMENT
LOW	.github/workflows/ai-review.yml	181	--globalconfig "${RUNNER_TEMP}/ai-review-npmrc-global" \	COMMENT
LOW	.github/workflows/ai-review.yml	461	bun .github/scripts/ai-review/generate-next-context.ts "$base_ref"	COMMENT
LOW	.github/workflows/mirror-template-images.yml	1	name: Mirror template images	COMMENT
LOW	.github/workflows/release-config.yml	81	echo "dry_run=false" >> "$GITHUB_OUTPUT"	COMMENT
LOW	.github/workflows/cli-bench.yml	1	name: CLI benchmark	COMMENT
LOW	.github/workflows/mirror-slim-image.yml	1	name: Mirror Slim Image	COMMENT
LOW	.github/actions/setup/action.yml	141	key: ${{ github.repository }}-pnpm-store-v3-${{ runner.arch }}	COMMENT
LOW	apps/cli/tests/helpers/command-mocks.ts	501	// Platform API factory — hybrid surface. Precedence (high → low): `network: "fail"` >	COMMENT
LOW	apps/cli/scripts/backfill-release-notes.ts	1	#!/usr/bin/env bun	COMMENT
LOW	apps/cli/scripts/render-service-dockerfile.ts	1	// Rewrites the slim-capable `FROM ... AS <alias>` lines of	COMMENT
LOW	…/cli/src/command-internal/edge-runtime-script.layer.ts	61	// Host networking is the default so pg-delta reaches the local stack directly, but an	COMMENT
LOW	apps/cli/src/command-internal/migration-apply.ts	381	forceNoVersion: boolean,	COMMENT
LOW	apps/cli/src/command-internal/db-config.parse.ts	521	// Keep each call inside `Effect.try` so a bad escape yields a normal parse failure	COMMENT
LOW	apps/cli/src/command-internal/connect-errors.ts	221	"CERT_REJECTED",	COMMENT
LOW	…/command-internal/db-bootstrap/reset-local-database.ts	341	// the defaults silently. `resolvedConfig` reuses the config already resolved via	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	21	max_rows = 1000	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	81	# Defaults to allow all IPv4 connections. Set empty array to block all IPs.	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	121	# The maximum file size allowed (e.g. "5MB", "500KB").	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	161	# The base URL of your website. Used as an allow-list for redirects and for constructing URLs used	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	181	# Allow/disallow anonymous sign-ins to your project.	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	201	[auth.rate_limit]	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	241	# Use a production-ready SMTP server	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	261		COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	281	# timebox = "24h"	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	321	# Configure MFA via WebAuthn	COMMENT
LOW	apps/cli/src/shared/init/project-init.templates.ts	361	# tenant = "my-auth0-tenant"	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	1	# For detailed configuration reference documentation, visit:	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	21	# without explicit GRANTs. When unset, new entities are NOT auto-exposed, matching the new cloud	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	81	# List of IPv6 CIDR blocks allowed to connect to the database.	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	121		COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	161	site_url = "http://127.0.0.1:3000"	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	181	# Allow/disallow testing manual linking of accounts	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	201	email_sent = 2	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	221	[auth.email]	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	241	# host = "smtp.sendgrid.net"	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	261	enable_signup = false	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	281	# This hook runs before a new user is created and allows developers to reject the request based on the incoming user obj	COMMENT
LOW	apps/cli/src/shared/init/testdata/templates/config.toml	401	# Configures S3 bucket region, eg. us-east-1	COMMENT
LOW	…src/commands/experimental/compute/push/push.handler.ts	441		COMMENT
LOW	apps/cli/src/commands/start/start.integration.test.ts	3501	);	COMMENT
LOW	apps/cli/src/commands/start/start.handler.ts	1141	};	COMMENT
LOW	apps/cli/src/commands/start/start.handler.ts	1481	// `rollbackStart` calls would miss a pure fiber interrupt between steps (see the `bringUp`	COMMENT
LOW	apps/cli/src/commands/completion/completion-scripts.ts	321	# Before checking if the completion matches what the user typed,	COMMENT
LOW	apps/cli/src/commands/completion/completion-scripts.ts	1101	# store temporary because switch will overwrite $_	COMMENT
LOW	…commands/completion/__fixtures__/powershell.nodesc.txt	181	__supabase_debug "Mode: $Mode"	COMMENT
LOW	…c/commands/completion/__fixtures__/powershell.desc.txt	181	__supabase_debug "Mode: $Mode"	COMMENT
LOW	apps/cli/src/commands/stop/stop.handler.ts	121		COMMENT
LOW	apps/cli/src/commands/feedback/feedback-project-ref.ts	1	import { Effect, FileSystem, Option, Path } from "effect";	COMMENT
LOW	apps/cli/src/commands/sso/update/update.handler.ts	221	const linkedProjectCache = yield* LinkedProjectCache;	COMMENT
LOW	apps/cli/src/commands/sso/add/add.handler.ts	181	// A bare value-taking flag as the final token (e.g. `--domains` with	COMMENT
LOW	apps/cli/src/commands/db/diff/diff.integration.test.ts	141	readonly diffFailWith?: string;	COMMENT
LOW	apps/cli/src/commands/db/diff/diff.integration.test.ts	161	readonly resolveFailsWith?: DbConfigIpv6Error;	COMMENT
LOW	apps/cli/src/telemetry/command-telemetry.ts	81	// Flag names (kebab-case) whose values are safe to log verbatim. Boolean flag values are always	COMMENT

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	apps/cli/src/command-internal/seed-remote-consent.ts	37	return CliConfigKeys.db.seed.enabled.codec.fromConfig(declared) === true;	CODE
CRITICAL	…/command-internal/db-bootstrap/reset-local-database.ts	137	const composition = yield* opened.value.stack.composition.describe.pipe(	CODE
CRITICAL	…/command-internal/db-bootstrap/reset-local-database.ts	169	yield* opened.value.stack.composition.stop.pipe(	CODE
CRITICAL	…/command-internal/db-bootstrap/reset-local-database.ts	216	yield* opened.value.stack.composition.start.pipe(	CODE

Structural Annotation Overuse10 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	docs/adr/0001-cli-dx-architecture-pillars.md	460	// Step 1: list projects	COMMENT
LOW	docs/adr/0001-cli-dx-architecture-pillars.md	469	// Step 2: use output from step 1 to query a specific project	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	175	// Step 1: declarative files must exist; in a TTY, offer to generate them.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	215	// Step 2: diff migrations state vs declarative; on error, save a debug bundle.	COMMENT
LOW⚡	…rc/commands/db/schema/declarative/sync/sync.handler.ts	442	// Step 3: empty diff.	COMMENT
LOW⚡	…rc/commands/db/schema/declarative/sync/sync.handler.ts	450	// Step 4: resolve migration name (prompt in TTY when --name unset).	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	461	// Step 5: write the timestamped migration file.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	483	// Step 6: drop warnings.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	494	// Step 7: apply decision.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	517	// Step 8: apply the migration to the local database (native).	COMMENT

Cross-Language Confusion (JS/TS)3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	apps/cli/src/commands/completion/completion-scripts.ts	150	elif (((directive & shellCompDirectiveFilterDirs) != 0)); then	CODE
HIGH	apps/cli/src/commands/completion/completion-scripts.ts	214	elif [ $COMP_TYPE -eq 37 ] \|\| [ $COMP_TYPE -eq 42 ]; then	CODE
HIGH	apps/cli/src/commands/completion/completion-scripts.ts	617	elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then	CODE

Fake / Example Data14 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	…/config/src/project-config/project-config.unit.test.ts	285	admin_email: "admin@example.com",	CODE
LOW	…/config/src/project-config/project-config.unit.test.ts	3108	admin_email: "admin@example.com",	CODE
LOW	…/config/src/project-config/project-config.unit.test.ts	3120	smtp_admin_email: "admin@example.com",	CODE
LOW	…/cli/src/command-internal/config-validate.unit.test.ts	998	adminEmail: "admin@example.com",	CODE
LOW	…s/cli/src/config/cli-config-values.integration.test.ts	1202	admin_email = "admin@example.com"	CODE
LOW	…i/src/commands/bootstrap/bootstrap.integration.test.ts	80	const ORGS = [{ id: "org-1", slug: "acme", name: "Acme Inc" }];	CODE
LOW	…/bootstrap/bootstrap.workdir-cache.integration.test.ts	80	const ORGS = [{ id: "org-1", slug: "acme", name: "Acme Inc" }];	CODE
LOW	apps/cli/src/commands/whoami/SIDE_EFFECTS.md	78	"email": "user@example.com",	CODE
LOW	…cli/src/commands/config/push/push.secrets.unit.test.ts	35	admin_email: "admin@example.com",	CODE
LOW	…rc/commands/projects/create/create.integration.test.ts	46	{ id: "org-abc", slug: "acme", name: "Acme Inc" },	CODE
LOW	apps/cli/src/commands/start/start.integration.test.ts	2067	admin_email = "admin@example.com"	CODE
LOW	apps/cli/src/commands/start/start.integration.test.ts	4705	'project_id = "demo"\n[auth.email.smtp]\nhost = "smtp.example.com"\nport = 587\nuser = "smtp-user"\npass =	CODE
LOW	…rc/commands/start/services/gotrue.service.unit.test.ts	332	adminEmail: "admin@example.com",	CODE
LOW	…rc/commands/start/services/gotrue.service.unit.test.ts	341	expect(env["GOTRUE_SMTP_ADMIN_EMAIL"]).toBe("admin@example.com");	CODE

Verbosity Indicators8 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	175	// Step 1: declarative files must exist; in a TTY, offer to generate them.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	215	// Step 2: diff migrations state vs declarative; on error, save a debug bundle.	COMMENT
LOW⚡	…rc/commands/db/schema/declarative/sync/sync.handler.ts	442	// Step 3: empty diff.	COMMENT
LOW⚡	…rc/commands/db/schema/declarative/sync/sync.handler.ts	450	// Step 4: resolve migration name (prompt in TTY when --name unset).	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	461	// Step 5: write the timestamped migration file.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	483	// Step 6: drop warnings.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	494	// Step 7: apply decision.	COMMENT
LOW	…rc/commands/db/schema/declarative/sync/sync.handler.ts	517	// Step 8: apply the migration to the local database (native).	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/test.yml	392	# The e2e harness invokes `node apps/cli/dist/supabase.js` with	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	apps/cli/src/commands/completion/completion-scripts.ts	552	# Check if this is an activeHelp statement (i.e., prefixed with $activeHelpMarker)	COMMENT

supabase/cli

Open-Source Code Quality, Security and Technical Debt Review