AI Slop Code Risk Monitor

supabase/supabase

SlopCodeMonitor badge for supabase/supabase Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

The Postgres development platform. Supabase gives you a dedicated Postgres database to build your web, mobile, and AI applications.

1.2 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for supabase/supabase, a TypeScript project with 114,368 GitHub stars. SynthScan examined 1,587,374 lines of code across 10384 source files, recording 1344 pattern matches distributed across 17 syntactic categories. The legacy adjusted pattern signal is 1.2 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.2
Adjusted Signal
1.2
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
114.4K
Stars
TypeScript
Language
1.6M
Lines of Code
10.4K
Files
1.3K
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1060 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 137 finding(s).

Agent Over-Engineering Ratio 3.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 930 finding(s).

PR Review Velocity Impact 5.5/100 · LOW

Which changes need focused human review? 1344 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 23MEDIUM 175LOW 1146

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1344 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers783 hits · 799 pts
SeverityFileLineSnippetContext
LOW.agents/skills/safe-sql-execution/SKILL.md300function markFunctionDefinitionSafe(CODE
LOW.agents/skills/safe-sql-execution/SKILL.md322function markFunctionDefinitionSafe(CODE
LOW…mples/ai/aws_bedrock_image_search/image_search/main.py33def construct_bedrock_image_body(base64_string):CODE
LOW…mples/ai/aws_bedrock_image_search/image_search/main.py46def get_embedding_from_titan_multimodal(body):CODE
LOW…management/expo-push-notifications/components/Push.tsx38async function registerForPushNotificationsAsync() {CODE
LOWscripts/bump-package.ts62function findHighestVersionInLockfile(packageName: string): string | null {CODE
LOWscripts/bump-package.ts82function handleMinimumReleaseAgeError(output: string): void {CODE
LOWscripts/authorizeVercelDeploys.ts49function extractJobInfoFromTargetUrl(targetUrl: string): JobInfo {CODE
LOWscripts/waitForVercelPreview.js23function deploymentIdFromTargetUrl(targetUrl) {CODE
LOWscripts/waitForVercelPreview.js96async function resolveFromEarlierCommits(clients, { headSha, prNumber, statusContext, log }) {CODE
LOWpackages/ui/src/components/shadcn/ui/chart.tsx300function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key: string) {CODE
LOWpackages/ui-patterns/src/FilterBar/utils.ts292export function updateNestedLogicalOperator(group: FilterGroup, path: number[]): FilterGroup {CODE
LOW…s/ui-patterns/src/CommandMenu/api/CommandMenuInput.tsx14function useFocusInputOnWiderScreens(ref: React.ForwardedRef<HTMLInputElement>) {CODE
LOW…rns/src/CommandMenu/api/hooks/useCrossCompatRouter.tsx13function useCrossCompatRouterContext() {CODE
LOW…mmandMenu/api/hooks/useCommandMenuTelemetryContext.tsx14export function useCommandMenuTelemetryContext() {CODE
LOW…rc/SqlToRest/syntax-highlighter/transform-renderer.tsx237function elementToRendererElementNode(CODE
LOWpackages/common/first-referrer-cookie.ts214export function serializeFirstReferrerCookie(data: FirstReferrerData): string {CODE
LOWpackages/common/sentry.ts12export function isSentryErrorBoundaryCrash(event: SentryEventTags): boolean {CODE
LOWpackages/common/consented-url-cookie.ts109export function createConsentedUrlCookieSync() {CODE
LOWpackages/common/telemetry-utils.ts4export function getTelemetryCookieOptions() {CODE
LOWpackages/common/posthog-client.ts45export function buildSessionRecordingConfig(CODE
LOWpackages/common/page-telemetry.ts7function getFirstTouchAttributionProps(telemetryData: SharedTelemetryData) {CODE
LOWpackages/common/safe-storage.test.ts47function installUnavailableStorage(name: StorageName) {CODE
LOWpackages/common/enabled-features/overrides.ts28export function getEnabledFeaturesOverrideDisabledList(CODE
LOWpackages/pg-meta/test/db/utils.ts87export async function createDatabaseWithAuthSchema(CODE
LOWpackages/pg-meta/src/helpers.ts36export function exceptionIdentifierNotFound(entityName: string, whereClause: string) {CODE
LOWpackages/pg-meta/src/query/table-row-query.ts94export function formatPatternMatchFilterValue(CODE
LOWpackages/pg-meta/src/sql/studio/role-impersonation.ts3function getPostgrestRoleImpersonationSql({CODE
LOWpackages/pg-meta/src/sql/studio/role-impersonation.ts19function getCustomRoleImpersonationSql(roleName: string): SafeSqlFragment {CODE
LOWpackages/pg-meta/src/sql/studio/database/privileges.ts238export function getExposedFunctionCountsSql({CODE
LOWpackages/pg-meta/src/sql/studio/database/privileges.ts262export function getDefaultPrivilegesStateSql({CODE
LOWpackages/pg-meta/src/sql/studio/database/privileges.ts283export function buildDefaultPrivilegesSql(action: 'grant' | 'revoke'): SafeSqlFragment {CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts113function buildCreateForeignTableSql(CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts140function buildRenameForeignTableSql(CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts201function buildAlterForeignTableSql(CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts287export function getCreateForeignDataWrapperSql(CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts431 function createImportForeignSchemaSql(): SafeSqlFragment {CODE
LOWpackages/pg-meta/src/sql/studio/database/fdw.ts723export function getImportForeignSchemaSql({CODE
LOWpackages/pg-meta/src/sql/studio/database/triggers.ts14export function getDatabaseTriggerUpdateSQL({CODE
LOWe2e/studio/utils/wait-for-response.ts116export async function waitForSchemaVisualizerToLoad(page: Page, ref: string, schema?: string) {CODE
LOWe2e/studio/utils/realtime-helpers.ts4export async function navigateToRealtimeInspector(page: Page, ref: string) {CODE
LOWe2e/studio/utils/filter-bar-helpers.ts53export async function addFilterWithDropdownValue(CODE
LOWe2e/studio/utils/wait-for-response-with-timeout.ts13export async function waitForApiResponseWithTimeout(CODE
LOWe2e/docs/utils/resolve-docs-scope.ts32async function assertFederatedSectionsInSync(repoRoot: string): Promise<void> {CODE
LOWe2e/docs/utils/resolve-docs-scope.ts101function partialRelPathFromChangedFile(filePath: string): string | null {CODE
LOWapps/studio/vite.config.ts378function workersFollowClientAssetsDir(): Plugin {CODE
LOWapps/studio/compat/sentry-nextjs.ts40export function captureRouterTransitionStart(_href: string, _navigationType: string): void {}CODE
LOWapps/studio/compat/next/router.ts119export function resolveSearchOrHashOnlyTarget(to: string, currentPathname: string): string {CODE
LOWapps/studio/compat/next/navigation.ts114export function useSelectedLayoutSegments(_parallelRouteKey?: string): string[] {CODE
LOW…nization/TeamSettings/InviteMemberButton.utils.test.ts172function makeEmailListSpaceSeparated(count: number): string {CODE
LOWapps/studio/tests/lib/branch-test-utils.ts66export function mockParentProjectPermissions(permissions: FgaPermissions[]) {CODE
LOW…s/pages/project/[ref]/settings/infrastructure.test.tsx146function mockInfrastructureEndpoints() {CODE
LOWapps/studio/state/metrics-preview.ts10export function getMemoryCommitmentPreview(CODE
LOWapps/studio/state/metrics-preview.ts17export function setMemoryCommitmentPreview(projectRef: string, preview: MemoryCommitmentPreview) {CODE
LOWapps/studio/state/metrics-preview.ts32export function useMemoryCommitmentPreview(projectRef: string | undefined) {CODE
LOWapps/studio/state/table-editor-operation-queue.types.ts113export function isEditCellContentOperation(op: QueuedOperation): op is EditCellContentOperation {CODE
LOWapps/studio/state/database-settings.tsx5export function createDatabaseSettingsState() {CODE
LOWapps/studio/state/database-settings.tsx36export function useDatabaseSettingsStateSnapshot(options?: Parameters<typeof useSnapshot>[1]) {CODE
LOWapps/studio/state/database-selector.tsx5export function createDatabaseSelectorState() {CODE
LOWapps/studio/state/database-selector.tsx32export function useDatabaseSelectorStateSnapshot(options?: Parameters<typeof useSnapshot>[1]) {CODE
723 more matches not shown…
Decorative Section Separators140 hits · 429 pts
SeverityFileLineSnippetContext
MEDIUM⚡docker/tests/test-self-hosted.sh117# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-self-hosted.sh119# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-self-hosted.sh129# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-self-hosted.sh131# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh94# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh96# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh206# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh208# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh222# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh224# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh258# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh260# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh352# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh354# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh447# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh449# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh478# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh480# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh500# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh502# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh518# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh520# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh551# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-self-hosted.sh553# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh94# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh96# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh103# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh105# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh128# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh130# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh140# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh142# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh151# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh153# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh163# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh165# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh175# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3.sh177# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh191# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh193# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh204# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh206# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh229# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh231# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh247# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh249# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh263# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh265# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh278# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh280# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh291# ---------------------------------------------COMMENT
MEDIUMdocker/tests/test-s3.sh293# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh152# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh154# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh164# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh166# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh175# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh177# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh187# ---------------------------------------------COMMENT
MEDIUM⚡docker/tests/test-s3-backend.sh189# ---------------------------------------------COMMENT
80 more matches not shown…
Over-Commented Block193 hits · 191 pts
SeverityFileLineSnippetContext
LOWdocker/setup.sh1#!/bin/shCOMMENT
LOWdocker/run.sh1#!/bin/shCOMMENT
LOWdocker/run.sh21# sh run.sh recreate --except <svc>... # force-recreate all services except the named onesCOMMENT
LOWdocker/update.sh1#!/bin/shCOMMENT
LOWdocker/update.sh21#COMMENT
LOWdocker/update.sh41# -> build manifest gate -> confirm_gate (before any writes)COMMENT
LOWdocker/docker-compose.envoy.yml1# DEPRECATED: Envoy is now the default API gateway defined directly inCOMMENT
LOWdocker/docker-compose.pg15.yml1# Postgres 15 override for self-hosted Supabase.COMMENT
LOWdocker/docker-compose.pg17.yml1# Postgres 17 override for self-hosted Supabase.COMMENT
LOWdocker/docker-compose.yml181 # GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}COMMENT
LOWdocker/docker-compose.yml201COMMENT
LOWdocker/docker-compose.yml221 # GOTRUE_SAML_ALLOW_ENCRYPTED_ASSERTIONS: ${SAML_ALLOW_ENCRYPTED_ASSERTIONS}COMMENT
LOWdocker/docker-compose.pgbouncer.yml1# PgBouncer override for self-hosted SupabaseCOMMENT
LOWdocker/tests/test-self-hosted.sh1#!/bin/shCOMMENT
LOWdocker/tests/test-self-hosted.sh221COMMENT
LOWdocker/tests/test-update.sh1#!/bin/shCOMMENT
LOWdocker/tests/test-s3.sh1#!/bin/shCOMMENT
LOWdocker/tests/test-s3-backend.sh1#!/bin/shCOMMENT
LOWdocker/tests/test-auth-keys.sh1#!/bin/shCOMMENT
LOWdocker/tests/test-pg17-upgrade.sh1#!/bin/shCOMMENT
LOWdocker/tests/docker-compose.s3.test.yml1# Test override: exposes the S3 backend port for direct testing.COMMENT
LOWdocker/tests/test-upgrades-manifest.sh1#!/bin/shCOMMENT
LOWdocker/utils/upgrade-pg17.sh1#!/usr/bin/env bashCOMMENT
LOWdocker/utils/upgrade-pg17.sh21# Backup:COMMENT
LOWdocker/utils/upgrade-pg17.sh641 17.*) ;;COMMENT
LOWdocker/utils/upgrade-pg17.sh661# - 20260413000000_fix-authenticator-session-preload-libraries.sqlCOMMENT
LOWdocker/utils/upgrade-pg17.sh721 # extensions only get updated to .063's versions. The final image ships newerCOMMENT
LOWdocker/utils/rotate-new-api-keys.sh1#!/bin/shCOMMENT
LOWdocker/utils/reassign-owner.sh1#!/bin/shCOMMENT
LOWdocker/utils/db-passwd.sh1#!/bin/shCOMMENT
LOWdocker/utils/add-new-auth-keys.sh1#!/bin/shCOMMENT
LOWdocker/utils/generate-keys.sh1#!/bin/shCOMMENT
LOWdocker/volumes/api/kong.yml361 endCOMMENT
LOWdocker/volumes/api/kong.yml421 ## Not used - Studio and Vector talk directly to analytics via Docker networking.COMMENT
LOWdocker/volumes/api/kong-entrypoint.sh1#!/bin/shCOMMENT
LOWdocker/volumes/api/envoy/lds.template.yaml661 #rbac:COMMENT
LOWsupabase/config.toml81# enabled = trueCOMMENT
LOWsupabase/functions/common/helpers.ts21 hour: 'numeric',COMMENT
LOWexamples/database/employees/supabase/config.toml1# For detailed configuration reference documentation, visit:COMMENT
LOW…amples/todo-list/nextjs-todo-list/supabase/config.toml61# If enabled, users need to confirm their email address before signing in.COMMENT
LOW…amples/todo-list/nextjs-todo-list/supabase/config.toml81# admin_email = "admin@email.com"COMMENT
LOWexamples/todo-list/sveltejs-todo-list/src/vite-env.d.ts1/// <reference types="svelte" />COMMENT
LOWexamples/auth/hono-full/supabase/config.toml61# Port to use for Supabase Studio.COMMENT
LOWexamples/auth/hono-full/supabase/config.toml81enabled = trueCOMMENT
LOWexamples/auth/hono-full/supabase/config.toml101# A list of *exact* URLs that auth providers are permitted to redirect to post authentication.COMMENT
LOWexamples/auth/hono-full/supabase/config.toml141# enabled = trueCOMMENT
LOWexamples/auth/hono-full/supabase/config.toml161# Controls the minimum amount of time that must pass before sending another sms otp.COMMENT
LOWexamples/auth/hono-full/supabase/config.toml241# user_pool_id = "my-user-pool-id"COMMENT
LOWexamples/auth/hono-full/src/database.types.ts1// Replace this file by running:COMMENT
LOWexamples/auth/sveltekit/src/database.types.ts1// Replace this file by running:COMMENT
LOWexamples/auth/sveltekit-full/src/database.types.ts1// Replace this file by running:COMMENT
LOWexamples/auth/hono/src/database.types.ts1// Replace this file by running:COMMENT
LOWexamples/auth/nextjs/lib/supabase/proxy.ts61 // myNewResponse.cookies.setAll(supabaseResponse.cookies.getAll())COMMENT
LOWexamples/auth/nextjs-full/supabase/config.toml81# Allows refresh tokens to be reused after expiry, up to the specified interval in seconds.COMMENT
LOWexamples/auth/nextjs-full/lib/supabase/proxy.ts61 // myNewResponse.cookies.setAll(supabaseResponse.cookies.getAll())COMMENT
LOW…/auth/flutter-native-google-auth/analysis_options.yaml1# This file configures the analyzer, which statically analyzes Dart code toCOMMENT
LOW…/auth/flutter-native-google-auth/analysis_options.yaml21 # or a specific dart file by using the `// ignore: name_of_lint` andCOMMENT
LOWexamples/auth/flutter-mfa/analysis_options.yaml1# This file configures the analyzer, which statically analyzes Dart code toCOMMENT
LOWexamples/auth/flutter-mfa/analysis_options.yaml21 # or a specific dart file by using the `// ignore: name_of_lint` andCOMMENT
LOWexamples/storage/protomaps/supabase/config.toml21enabled = trueCOMMENT
133 more matches not shown…
Fake / Example Data118 hits · 138 pts
SeverityFileLineSnippetContext
LOW.agents/skills/safe-sql-execution/SKILL.md89 InputProps, 'placeholder' | 'value' | 'onChange'CODE
LOWexamples/todo-list/nextjs-todo-list/pages/api/hello.ts9 res.status(200).json({ name: 'John Doe' })CODE
LOW…edge-functions/supabase/functions/oak-server/README.md17--data-raw '{ "name": "John Doe" }'CODE
LOW…ng/with-nextjs-13-server-components/pages/api/hello.ts9 res.status(200).json({ name: 'John Doe' })CODE
LOWexamples/caching/with-nextjs-13/pages/api/hello.ts9 res.status(200).json({ name: 'John Doe' })CODE
LOWpackages/ui/src/lib/MarkdownSample.md71 Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece ofCODE
LOWpackages/pg-meta/test/db/00-init.sql18 ('Jane Doe');CODE
LOWpackages/pg-meta/test/query/table-row-query.test.ts1428 ('Small text', repeat('Lorem ipsum ', 100), '{"key": "value", "nested": {"data": true}}'),CODE
LOWpackages/pg-meta/test/query/table-row-query.test.ts1429 ('Another small text', repeat('Dolor sit amet ', 100), '{"array": [1, 2, 3], "bool": false}');CODE
LOWpackages/pg-meta/test/query/table-row-query.test.ts1474 expect(queryResult[0].large_text.startsWith('Lorem ipsum')).toBe(true)CODE
LOWpackages/pg-meta/test/query/table-row-query.test.ts1475 expect(queryResult[1].large_text.startsWith('Dolor sit amet')).toBe(true)CODE
LOWpackages/pg-meta/test/query/advanced-query.test.ts64 ('John Doe'),CODE
LOWpackages/pg-meta/test/query/advanced-query.test.ts347 (12, 'John Doe'),CODE
LOW⚡packages/pg-meta/test/query/advanced-query.test.ts368 expect(result[0].name).toBe('John Doe') // Alphabetically firstCODE
LOW⚡packages/pg-meta/test/query/advanced-query.test.ts378 .insert([{ name: 'John Doe' }], { returning: true })CODE
LOW⚡packages/pg-meta/test/query/advanced-query.test.ts382 `"insert into public.normal_table (name) select name from jsonb_populate_recordset(null::public.normal_table, '[CODE
LOW⚡packages/pg-meta/test/query/advanced-query.test.ts387 expect(result[0].name).toBe('John Doe')CODE
LOWpackages/pg-meta/test/query/advanced-query.test.ts453 VALUES ('John Smith'), ('John Doe'), ('Jane Doe');CODE
LOWpackages/pg-meta/test/query/advanced-query.test.ts453 VALUES ('John Smith'), ('John Doe'), ('Jane Doe');CODE
LOW…es/pg-meta/test/sql/studio/get-users-paginated.test.ts101 ('${searchUserId}', 'john.doe@supabase.io', NULL, '00000000-0000-0000-0000-000000000000', '{"full_name": "John DoeCODE
LOW.github/workflows/docs-tests.yml91 echo "GITHUB_CLIENT_ID=dummy-id" >> .envCODE
LOWe2e/studio/utils/auth-helpers.ts16 await page.getByRole('textbox', { name: 'user@example.com' }).fill(email)CODE
LOW…nization/TeamSettings/InviteMemberButton.utils.test.ts15 expect(parseEmails('user@example.com')).toStrictEqual(['user@example.com'])CODE
LOW…nization/TeamSettings/InviteMemberButton.utils.test.ts178 expect(emailSchema.safeParse('user@example.com').success).toBe(true)CODE
LOW…/Organization/TeamSettings/InviteMemberButton.test.tsx349 target: { value: 'admin@example.com' },CODE
LOW…/Organization/TeamSettings/InviteMemberButton.test.tsx358 expect(invitePayloads[0]).toEqual({ emails: ['admin@example.com'], role_id: roleId })CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx38 billing_name: 'Acme Inc',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx40 line1: '123 Main St',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx225 billing_name: 'Acme Inc',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx264 name: 'Acme Inc',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx277 billing_name: 'Acme Inc',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx522 name: 'Acme Inc',CODE
LOW…components/Billing/useBillingCustomerDataForm.test.tsx535 billing_name: 'Acme Inc',CODE
LOWapps/studio/components/ui/SafeSqlInput.tsx7export type SafeSqlInputProps = Omit<InputProps, 'placeholder' | 'value' | 'onChange'> & {CODE
LOW…rganization/OAuthApps/OAuthAppsAuthorizedList.test.tsx56 await userEvent.click(await screen.findByText('admin@example.com'))CODE
LOW…nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts52 const { params } = parse(buildUnifiedLogsUrl({ projectRef: 'abc', user: 'user@example.com' }))CODE
LOW…nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts53 expect(params.get('user')).toBe('user@example.com')CODE
LOW…nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts356 user: 'user@example.com',CODE
LOW…nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts373 user: 'user@example.com',CODE
LOW…tinationPanel/DestinationForm/DestinationForm.utils.ts381 ? { accessKey: 'placeholder', secretKey: 'placeholder' }CODE
LOW…/components/interfaces/Auth/SmtpForm/SmtpForm.test.tsx33 SMTP_ADMIN_EMAIL: 'admin@example.com',CODE
LOW…o/components/interfaces/Auth/Users/CreateUserModal.tsx94 placeholder="user@example.com"CODE
LOW…ents/interfaces/Auth/Users/UserPanel.platform.test.tsx23 email: 'user@example.com',CODE
LOW…tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx132 client_secret: 'placeholder',CODE
LOW…tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx144 client_secret: 'placeholder',CODE
LOW…tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx200 if (values.client_secret !== 'placeholder') {CODE
LOW…es/OrganizationInvite/OrganizationInvite.utils.test.ts16 organization_name: 'Acme Corp',CODE
LOW…erfaces/OrganizationInvite/OrganizationInvite.test.tsx68 organization_name: 'Acme Corp',CODE
LOW…es/Account/Preferences/AccountIdentities.utils.test.ts32 const email = 'user@example.com'CODE
LOW…erfaces/Account/Preferences/AccountIdentities.test.tsx44const EMAIL = 'user@example.com'CODE
LOW…erfaces/Account/AccessTokens/AccessToken.roles.test.ts318 organizations: [{ ...ORG, name: 'Acme Corp' }],CODE
LOW…erfaces/Account/AccessTokens/AccessToken.roles.test.ts328 label: 'Acme Corp',CODE
LOW…udio/components/grid/utils/queueOperationUtils.test.ts118 row: { id: 1, email: 'test@test.com' },CODE
LOW…udio/components/grid/utils/queueOperationUtils.test.ts119 identifiers: { id: 1, email: 'test@test.com' },CODE
LOW…udio/components/grid/utils/queueOperationUtils.test.ts137 identifiers: { id: 1, email: 'test@test.com' },CODE
LOW…io/public/monaco-editor/vs/language/html/htmlWorker.js440**Note:** Do not use this attribute, as it is non-standard and only implemented in some versions of Microsoft Internet ECODE
LOW…udio/public/monaco-editor/vs/base/worker/workerMain.js29`||e===" "}}),X(J[69],Z([0,1]),function(W,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.WrappingIndCODE
LOWapps/studio/lib/session-replay.test.ts59 ['placeholder', 'Search in customer-invoices...'],CODE
LOWapps/studio/lib/session-replay.test.ts196 expect(maskReplayAttribute('placeholder', storageSearch)).toBe('*')CODE
LOWapps/studio/lib/session-replay.test.ts199 expect(maskReplayAttribute('placeholder', authCallback)).toBe('*')CODE
58 more matches not shown…
Cross-Language Confusion (JS/TS)19 hits · 128 pts
SeverityFileLineSnippetContext
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx93 print("Connection successful!")CODE
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx101 print("Current Time:", result)CODE
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx106 print("Connection closed.")CODE
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx109 print(f"Failed to connect: {e}")`,CODE
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx145 print("Connection successful!")CODE
HIGH⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx147 print(f"Failed to connect: {e}")`,CODE
HIGH⚡…es/ConnectSheet/content/steps/direct-files/content.tsx209 print("Connection successful!")CODE
HIGH⚡…es/ConnectSheet/content/steps/direct-files/content.tsx211 print(f"Failed to connect: {e}")`,CODE
HIGH…tails/CreateTable/CreateTableInstructions.constants.ts57print("Creating catalog 'default'...")CODE
HIGH⚡…tails/CreateTable/CreateTableInstructions.constants.ts68print("Creating table 'events'...")CODE
HIGH⚡…tails/CreateTable/CreateTableInstructions.constants.ts72print("Preparing sample data to be inserted...")CODE
HIGH⚡…tails/CreateTable/CreateTableInstructions.constants.ts81print("Inserting data into 'events'...")CODE
HIGH⚡…tails/CreateTable/CreateTableInstructions.constants.ts84print("Completed!")CODE
HIGH⚡…tails/CreateTable/CreateTableInstructions.constants.ts87print(df)CODE
HIGHapps/docs/features/directives/CodeSample.test.ts232 print(f"add_numbers(3, 5) = {result1}") # Expected output: 8CODE
HIGHapps/docs/features/directives/CodeSample.test.ts451 print(f"add_numbers(3, 5) = {result1}") # Expected output: 8CODE
HIGHapps/docs/features/directives/CodeSample.test.ts750 print(f"add_numbers(3, 5) = {result1}") # Expected output: 8CODE
HIGHapps/www/app/(products)/auth/_components/ApiSection.tsx294 print(event, session)CODE
HIGH…stem/registry/default/example/markdown-code-blocks.tsx12 print("Hello, World!")CODE
AI Slop Vocabulary17 hits · 44 pts
SeverityFileLineSnippetContext
LOWdocker/volumes/api/kong.yml373 ## alike), so unknown/invalid keys simply pass to the runtime, which handlesCOMMENT
MEDIUM.github/workflows/braintrust-evals.yml17 # Cheap, always-on gate: verifies the eval harness can reach the MCP serverCOMMENT
MEDIUM.github/workflows/docs-e2e.yml128 # Vercel skips the docs preview when a PR only changes the harnessCOMMENT
MEDIUM.github/workflows/kb-e2e.yml70 # Vercel skips the kb preview when a PR only changes the harness, so waitCOMMENT
MEDIUM.github/workflows/www-e2e.yml122 # Vercel skips the preview when only the harness changed, so wait for oneCOMMENT
MEDIUM.github/workflows/studio-e2e-test.yml95 # See here for caching with `yarn`, `bun` or other package managers https://github.com/actions/cache/blob/mainCOMMENT
MEDIUM.github/workflows/studio-e2e-test.yml95 # See here for caching with `yarn`, `bun` or other package managers https://github.com/actions/cache/blob/mainCOMMENT
MEDIUM…eamSettings/UpdateRolesPanel/UpdateRolesPanel.utils.ts106// [Joshen] Essentially spit out 3 arraysCOMMENT
MEDIUM…ridEditor/SidePanelEditor/RowEditor/RowEditor.utils.ts143 // [Joshen] Definitely can find a better way to parse the description, but this suffices for nowCOMMENT
MEDIUM…udio/public/monaco-editor/vs/language/css/cssWorker.js73This is used to produce an effect that is known as tate-ch\u016B-yoko (\u7E26\u4E2D\u6A2A) in Japanese, or as \u76F4\u66CODE
MEDIUM…io/public/monaco-editor/vs/language/html/htmlWorker.js259 * To learn about this declaration in Firefox for Mobile, see [this article](https://developer.mozilla.org/en-US/doCOMMENT
MEDIUM…io/public/monaco-editor/vs/language/html/htmlWorker.js270Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{naCODE
MEDIUM…io/public/monaco-editor/vs/language/html/htmlWorker.js270Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{naCODE
MEDIUM…io/public/monaco-editor/vs/language/html/htmlWorker.js288**Note**: Sites that automatically play audio (or videos with an audio track) can be an unpleasant experience for users,CODE
MEDIUMapps/studio/pages/api/ai/code/complete.ts219 // avoids fetching DDL for table aliases or other false matches. This is robust toCOMMENT
MEDIUMapps/docs/scripts/search/sources/lint-warnings-guide.ts124 return `# Database Advisor: Lint ${this.lint.path}\n\nThis is a database lint rule for Supabase, targeting the lint CODE
MEDIUM…/state-of-startups/components/ParticipantsCarousel.tsx48 // Duplicate so the loop is seamless: translateX(-50%) lands the start ofCOMMENT
Slop Phrases13 hits · 31 pts
SeverityFileLineSnippetContext
LOWsitemaps/json_output/youtube_videos.json907 "title": "Don't forget to switch this off if using Drizzle!",CODE
MEDIUMexamples/auth/nextjs/proxy.ts15 * Feel free to modify this pattern to include more paths.COMMENT
MEDIUMexamples/auth/nextjs-full/proxy.ts15 * Feel free to modify this pattern to include more paths.COMMENT
MEDIUMexamples/realtime/nextjs-authorization-demo/proxy.ts16 * Feel free to modify this pattern to include more paths.COMMENT
MEDIUM…amples/user-management/nextjs-user-management/proxy.ts16 * Feel free to modify this pattern to include more paths.COMMENT
MEDIUMpackages/ui/src/lib/Hooks.tsx30 // It's worth noting that because passed in handler is a new ...COMMENT
LOW…udio/public/monaco-editor/vs/language/css/cssWorker.js32`),[{language:"html",value:r}]}doPrint(e,t){for(let r of e)this.doPrintElement(r,t),r.children&&this.doPrint(r.children,CODE
MEDIUM…io/public/monaco-editor/vs/language/html/htmlWorker.js306**Usage note:** Do not use this attribute, as it has been deprecated. The [\`<caption>\`](https://developer.mozilla.org/CODE
MEDIUM…pts/__snapshots__/build-reference-content.dart.v2.json3457 "notes": "- Before you can call this method you need to [establish a connection](/docs/guides/auth/sso/auth-sso-saCODE
MEDIUMapps/ui-library/public/r/social-auth-nextjs.json47 "content": "import { type NextRequest } from 'next/server'\n\nimport { updateSession } from '@/registry/default/clCODE
MEDIUM…ps/ui-library/public/r/password-based-auth-nextjs.json49 "content": "import { type NextRequest } from 'next/server'\n\nimport { updateSession } from '@/registry/default/clCODE
MEDIUM…gistry/default/blocks/social-auth-nextjs/middleware.ts16 * Feel free to modify this pattern to include more paths.COMMENT
MEDIUM…efault/blocks/password-based-auth-nextjs/middleware.ts17 * Feel free to modify this pattern to include more paths.COMMENT
Example Usage Blocks22 hits · 31 pts
SeverityFileLineSnippetContext
LOWdocker/setup.sh15# Usage:COMMENT
LOWdocker/docker-compose.logs.yml5# Usage:COMMENT
LOWdocker/run.sh15# Usage:COMMENT
LOWdocker/update.sh22# Usage:COMMENT
LOWdocker/docker-compose.pg15.yml9# Usage:COMMENT
LOWdocker/docker-compose.pgbouncer.yml5# Usage:COMMENT
LOWdocker/tests/test-self-hosted.sh5# Usage:COMMENT
LOWdocker/tests/test-container-logs.sh5# Usage:COMMENT
LOWdocker/tests/test-update.sh18# Usage:COMMENT
LOWdocker/tests/test-s3.sh9# Usage:COMMENT
LOWdocker/tests/test-s3-backend.sh9# Usage:COMMENT
LOWdocker/tests/test-auth-keys.sh5# Usage:COMMENT
LOWdocker/tests/test-pg17-upgrade.sh8# Usage:COMMENT
LOWdocker/tests/docker-compose.s3.test.yml3# Usage:COMMENT
LOWdocker/tests/docker-compose.rustfs.test.yml3# Usage:COMMENT
LOWdocker/tests/test-upgrades-manifest.sh17# Usage:COMMENT
LOWdocker/utils/rotate-new-api-keys.sh8# Usage:COMMENT
LOWdocker/utils/reassign-owner.sh11# Usage:COMMENT
LOWdocker/utils/add-new-auth-keys.sh10# Usage:COMMENT
LOWdocker/utils/generate-keys.sh8# Usage:COMMENT
LOW.agents/skills/test-the-docs/sandbox/run.sh4# Usage:COMMENT
LOW…ps/docs/app/guides/ai-tools/ai-prompts/[slug]/page.tsx28 ## How to useCOMMENT
Structural Annotation Overuse12 hits · 20 pts
SeverityFileLineSnippetContext
LOWexamples/prompts/use-realtime.md392### Step 1: Replace Client CodeCOMMENT
LOWexamples/prompts/use-realtime.md411### Step 2: Add Database Trigger (Only if using broadcast)COMMENT
LOWexamples/prompts/use-realtime.md419### Step 3: Setup Authorization (Only if using broadcast)COMMENT
LOWe2e/studio/features/api-access-toggle.spec.ts269 // Step 1: Create a table with API access on (default — full grants)COMMENT
LOWe2e/studio/features/api-access-toggle.spec.ts296 // Step 2: Navigate back and edit only the descriptionCOMMENT
LOWe2e/studio/features/api-access-toggle.spec.ts324 // Step 3: Verify the full privileges are unchanged after the description editCOMMENT
LOWe2e/studio/features/cron-jobs.spec.ts630 // Step 1: Click "Delete rows now" to run the cleanupCOMMENT
LOW…Integrations/CronJobs/CronJobsTab.useCleanupActions.ts77 // Step 1: Get the total number of pages in the tableCOMMENT
LOW…Integrations/CronJobs/CronJobsTab.useCleanupActions.ts108 // Step 2: Iterate through pages in batchesCOMMENT
LOW⚡apps/studio/data/branches/branch-merge-mutation.ts22 // Step 1: Get the diff output from the branchCOMMENT
LOW⚡apps/studio/data/branches/branch-merge-mutation.ts27 // Step 2: If there are changes, create a migration before mergingCOMMENT
LOWapps/studio/data/branches/branch-merge-mutation.ts42 // Step 3: Call POST /v1/branches/id/merge to merge the branchCOMMENT
Verbosity Indicators9 hits · 15 pts
SeverityFileLineSnippetContext
LOWe2e/studio/features/api-access-toggle.spec.ts269 // Step 1: Create a table with API access on (default — full grants)COMMENT
LOWe2e/studio/features/api-access-toggle.spec.ts296 // Step 2: Navigate back and edit only the descriptionCOMMENT
LOWe2e/studio/features/api-access-toggle.spec.ts324 // Step 3: Verify the full privileges are unchanged after the description editCOMMENT
LOWe2e/studio/features/cron-jobs.spec.ts630 // Step 1: Click "Delete rows now" to run the cleanupCOMMENT
LOW…Integrations/CronJobs/CronJobsTab.useCleanupActions.ts77 // Step 1: Get the total number of pages in the tableCOMMENT
LOW…Integrations/CronJobs/CronJobsTab.useCleanupActions.ts108 // Step 2: Iterate through pages in batchesCOMMENT
LOW⚡apps/studio/data/branches/branch-merge-mutation.ts22 // Step 1: Get the diff output from the branchCOMMENT
LOW⚡apps/studio/data/branches/branch-merge-mutation.ts27 // Step 2: If there are changes, create a migration before mergingCOMMENT
LOWapps/studio/data/branches/branch-merge-mutation.ts42 // Step 3: Call POST /v1/branches/id/merge to merge the branchCOMMENT
Cross-File Repetition3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHapps/docs/spec/supabase_kt_v1.yml0content, from: sender_id(name), to: receiver_id(name)STRING
HIGHapps/docs/spec/supabase_kt_v2.yml0content, from: sender_id(name), to: receiver_id(name)STRING
HIGHapps/docs/spec/supabase_kt_v3.yml0content, from: sender_id(name), to: receiver_id(name)STRING
Self-Referential Comments4 hits · 14 pts
SeverityFileLineSnippetContext
MEDIUM⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx95 # Create a cursor to execute SQL queriesCOMMENT
MEDIUM⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx136# Create the SQLAlchemy engineCOMMENT
MEDIUM⚡…es/ConnectSheet/content/steps/direct-files/content.tsx200# Create the SQLAlchemy engineCOMMENT
MEDIUM…www/app/(products)/database/_components/ApiSection.tsx199 Python: `# Create a room and its first messageSTRING
Modern AI Meta-Vocabulary4 hits · 11 pts
SeverityFileLineSnippetContext
MEDIUM.agents/skills/test-the-docs/reference/sandbox-setup.md7## Threat model and guardrailsCOMMENT
MEDIUMsitemaps/json_output/sitemap_www.json18 "https://supabase.com/blog/agentic-coding-on-supabase-with-opencode",CODE
MEDIUM…ngs/Infrastructure/ReadReplicas/ReadReplicaDetails.tsx69 // [Joshen] This is unused but intentional to scaffold the usage for now, refer to comment belowCOMMENT
MEDIUM…ditor/UtilityPanel/QuerySourceMenu/QuerySourceMenu.tsx81 // `/sql/new` tab is a blank scaffold with nothing to preserve.COMMENT
Excessive Try-Catch Wrapping4 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx108except Exception as e:CODE
LOW⚡…s/interfaces/ConnectSheet/DirectConnectionExamples.tsx146except Exception as e:CODE
LOW⚡…es/ConnectSheet/content/steps/direct-files/content.tsx210except Exception as e:CODE
LOWapps/docs/spec/supabase_py_v2.yml3773 except Exception as exception:CODE
Synthetic Comment Markers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHapps/www/data/surveys/state-of-startups-2026.tsx538 title: 'What percentage of your codebase was generated by AI?',CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWscripts/upload-static-assets.sh101# Check if directory existsCOMMENT
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOWapps/docs/app/api/graphql/route.ts253async function handleRequest(request: Request): Promise<NextResponse> {CODE