4.0

Adjusted Signal

4.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

8.9K

Stars

Rust

Language

622.2K

Lines of Code

1.6K

Files

1.9K

Pattern Hits

2026-10-31

Scan Date

0.04

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1338 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.8/100 · LOW

Are imports declared and package/API names verified? 375 finding(s).

Agent Over-Engineering Ratio 7.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 582 finding(s).

PR Review Velocity Impact 18.9/100 · LOW

Which changes need focused human review? 1917 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 10HIGH 57MEDIUM 155LOW 1695

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1917 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block890 hits · 866 pts

Severity	File	Line	Snippet	Context
LOW	deny.toml	1	# This template contains all of the possible sections and their default values	COMMENT
LOW	deny.toml	21	targets = [	COMMENT
LOW	deny.toml	41	# The lint level for unmaintained crates	COMMENT
LOW	deny.toml	81	]	COMMENT
LOW	deny.toml	141	# This section is considered when running `cargo deny check bans`.	COMMENT
LOW	deny.toml	181	{ name = "windows_x86_64_gnu" },	COMMENT
LOW	deny.toml	201	# in the allow list is encountered	COMMENT
LOW	AGENTS.md	221		COMMENT
LOW	.config/nextest.toml	1	# nextest configuration.	COMMENT
LOW	crates/metrics/lib/layout.rs	1	//! Binary layout of the shared-memory metrics registry.	COMMENT
LOW	crates/metrics/lib/layout.rs	21	//! \| 0x08 version u32 layout version (3) \|	COMMENT
LOW	crates/metrics/lib/layout.rs	41	//! \| 0x30 sampled_at_ms AI64 0 until first sample \|	COMMENT
LOW	crates/metrics/lib/layout.rs	61	//! \| 0x130 _tail [u8; 208] \|	COMMENT
LOW	crates/metrics/lib/layout.rs	81		COMMENT
LOW	crates/metrics/lib/layout.rs	101	pub const READABLE_REGISTRY_ABI_VERSIONS: &[u32] = &[2, REGISTRY_ABI_VERSION];	COMMENT
LOW	crates/metrics/lib/layout.rs	121		COMMENT
LOW	crates/metrics/lib/layout.rs	141	/// Slot state: runtime attached and writing samples.	COMMENT
LOW	crates/metrics/lib/layout.rs	161	/// Sample flag: `upper_free_bytes` contains a valid protected guest filesystem value.	COMMENT
LOW	crates/metrics/lib/layout.rs	221	pub sample_flags: AtomicU32,	COMMENT
LOW	crates/metrics/lib/layout.rs	261		COMMENT
LOW	crates/metrics/lib/registry.rs	121		COMMENT
LOW	crates/metrics/lib/registry.rs	421	/// If `seq` stays odd past the wait budget, release fails and leaves	COMMENT
LOW	crates/metrics/lib/error.rs	1	//! Error type used by the metrics registry.	COMMENT
LOW	crates/metrics/lib/snapshot.rs	1	//! In-memory snapshot types produced by registry reads.	COMMENT
LOW	crates/metrics/lib/snapshot.rs	21	/// Carries both identity (sandbox_id, run_id, pid, name) and the metric	COMMENT
LOW	crates/metrics/lib/snapshot.rs	41	/// Guest vCPU usage as a percentage.	COMMENT
LOW	crates/metrics/lib/snapshot.rs	81	/// Guest-used memory in bytes; 0 when `memory_bytes_reported` is false.	COMMENT
LOW	crates/network/lib/lib.rs	21		COMMENT
LOW	crates/network/lib/proxy/types.rs	81	}	COMMENT
LOW	crates/network/lib/proxy/types.rs	141	/// An HTTP CONNECT username or password is invalid.	COMMENT
LOW	crates/network/lib/proxy/types.rs	181	ExtraComponentsNotSupported,	COMMENT
LOW	crates/network/lib/model/tls.rs	1	//! TLS configuration models and optional engine state.	COMMENT
LOW	crates/network/lib/model/config/types.rs	21	// Types	COMMENT
LOW	crates/network/lib/model/config/types.rs	41	#[serde(try_from = "u32", into = "u32")]	COMMENT
LOW	crates/network/lib/model/config/types.rs	81	#[serde(default)]	COMMENT
LOW	crates/network/lib/model/config/types.rs	101		COMMENT
LOW	crates/network/lib/model/config/types.rs	121	/// Trust, Zscaler, Netskope, etc.) whose gateway CA is installed on	COMMENT
LOW	crates/network/lib/model/config/types.rs	141	#[doc(hidden)]	COMMENT
LOW	crates/network/lib/model/config/types.rs	181	}	COMMENT
LOW	crates/network/lib/model/config/types.rs	221		COMMENT
LOW	crates/network/lib/model/config/builder.rs	81	/// )	COMMENT
LOW	crates/network/lib/model/config/builder.rs	781	}	COMMENT
LOW	crates/network/lib/model/secrets/mod.rs	1	//! Placeholder-based secret injection for TLS-intercepted connections.	COMMENT
LOW	crates/network/lib/model/dns/mod.rs	1	//! DNS configuration contracts and engine implementation facade.	COMMENT
LOW	crates/network/lib/model/dns/nameserver/parse.rs	1	//! User-facing nameserver type and parsing.	COMMENT
LOW	crates/network/lib/model/dns/nameserver/parse.rs	41		COMMENT
LOW	crates/network/lib/model/policy/types.rs	1	//! Policy types: rules, actions, destinations, and protocol matching.	COMMENT
LOW	crates/network/lib/model/policy/types.rs	41	/// Rules carry a [`Direction`] field that determines which evaluator	COMMENT
LOW	crates/network/lib/model/policy/types.rs	61	#[serde(default)]	COMMENT
LOW	crates/network/lib/model/policy/types.rs	81	}	COMMENT
LOW	crates/network/lib/model/policy/types.rs	141	/// whose construction enforces the canonical form (lowercase ASCII,	COMMENT
LOW	crates/network/lib/model/policy/types.rs	161	DomainSuffix(DomainName),	COMMENT
LOW	crates/network/lib/model/policy/types.rs	221	#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]	COMMENT
LOW	crates/network/lib/model/policy/types.rs	641	/// IP-based destinations (`Cidr`, most `Group` variants) cannot	COMMENT
LOW	crates/network/lib/model/policy/types.rs	861	Self {	COMMENT
LOW	crates/network/lib/model/policy/types.rs	1001	/// Check if an egress IP / hostname source matches a destination specification.	COMMENT
LOW	crates/network/lib/model/policy/name.rs	1	//! Validated DNS name type used in [`super::Destination`] rules.	COMMENT
LOW	crates/network/lib/model/policy/name.rs	21	//! similarly underscore-bearing names through, matching what the	COMMENT
LOW	crates/network/lib/model/policy/name.rs	41	/// never end up "matching" a name no DNS responder will ever return.	COMMENT
LOW	crates/network/lib/model/policy/name.rs	61	/// chars, invalid UTF-8 for an ASCII name, etc.).	COMMENT
830 more matches not shown…

Hyper-Verbose Identifiers378 hits · 429 pts

Severity	File	Line	Snippet	Context
LOW	sdk/python/integration/test_create_kwargs.py	19	async def test_create_kwargs_affect_guest_defaults(sandbox_name):	CODE
LOW	sdk/python/integration/test_create_kwargs.py	58	async def test_create_kwargs_round_trip_through_config_json(sandbox_name):	CODE
LOW	sdk/python/integration/test_create_kwargs.py	169	async def test_create_kwargs_validate_bad_values(	CODE
LOW	sdk/python/integration/test_lifecycle.py	25	async def test_create_get_list_connect_stop_start_and_remove(sandbox_name):	CODE
LOW	sdk/python/integration/test_lifecycle.py	126	async def test_replace_rejects_duplicate_then_replaces(sandbox_name):	CODE
LOW	sdk/python/integration/conftest.py	16	def _prepare_integration_home() -> None:	CODE
LOW⚡	sdk/python/integration/test_images.py	9	async def test_image_list_returns_cached_handles() -> None:	CODE
LOW⚡	sdk/python/integration/test_images.py	19	async def test_image_get_missing_raises_typed_error() -> None:	CODE
LOW⚡	sdk/python/integration/test_images.py	24	async def test_image_save_missing_raises_typed_error(tmp_path) -> None:	CODE
LOW⚡	sdk/python/integration/test_images.py	32	async def test_image_save_and_load_round_trips_archive(sandbox_factory, tmp_path) -> None:	CODE
LOW	sdk/python/integration/test_images.py	54	async def test_image_management_round_trips_pulled_sandbox_image(sandbox_factory) -> None:	CODE
LOW	sdk/python/integration/test_metrics_logs.py	39	async def test_metrics_snapshot_stream_and_all_sandbox_metrics(sandbox_factory):	CODE
LOW	sdk/python/integration/test_metrics_logs.py	61	async def test_logs_snapshot_filters_and_stream_resume(sandbox_factory):	CODE
LOW	sdk/python/integration/test_volumes.py	11	async def test_volume_lifecycle_metadata_and_host_fs(volume_factory):	CODE
LOW	sdk/python/integration/test_volumes.py	38	async def test_disk_volume_metadata_uses_enums(volume_factory):	CODE
LOW	sdk/python/integration/test_volumes.py	47	async def test_named_volume_mount_into_sandbox(volume_factory, sandbox_factory):	CODE
LOW	sdk/python/integration/test_volumes.py	62	async def test_tmpfs_mount_enforces_size_limit(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	14	async def test_exec_kwargs_and_options_dict(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	63	async def test_shell_timeout_and_user_env_overrides(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	79	async def test_exec_stream_iteration_collect_wait_and_signal(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	130	async def test_exec_stream_tty_resize_while_receiving(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	160	async def test_exec_stream_missing_binary_surfaces_failure(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	175	async def test_stdin_modes_and_take_stdin_contract(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	201	async def test_empty_stdin_write_keeps_stdin_open(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	223	async def test_rlimits_reject_raw_dicts(sandbox_factory):	CODE
LOW	sdk/python/integration/test_exec.py	234	async def test_exec_stream_backpressure_preserves_output(sandbox_factory):	CODE
LOW	sdk/python/integration/test_fs.py	13	async def test_fs_file_directory_and_metadata_operations(sandbox_factory):	CODE
LOW	sdk/python/integration/test_fs.py	51	async def test_fs_streams_and_host_copy_roundtrip(sandbox_factory, tmp_path):	CODE
LOW	sdk/python/integration/test_network.py	24	async def test_network_policy_and_port_config_create(sandbox_factory):	CODE
LOW	sdk/python/integration/test_network.py	50	async def test_ip_destination_allows_specific_egress(label, destination, sandbox_factory):	CODE
LOW	sdk/python/integration/test_snapshots.py	25	async def test_snapshot_create_open_list_and_boot(sandbox_name, tmp_path, source_kind):	CODE
LOW	sdk/python/integration/test_patches.py	11	async def test_rootfs_patches_are_applied(sandbox_factory):	CODE
LOW	sdk/python/integration/test_pull_progress.py	14	async def test_create_with_progress_emits_events_and_returns_sandbox(sandbox_name):	CODE
LOW	sdk/python/integration/test_pull_progress.py	59	async def test_create_with_progress_result_rejects_on_second_call(sandbox_name):	CODE
LOW	sdk/python/integration/test_pull_progress.py	87	async def test_create_with_progress_detached_returns_detached_sandbox(sandbox_name):	CODE
LOW	sdk/python/integration/test_pull_progress.py	142	async def test_create_with_progress_failure_surfaces_from_result(sandbox_name):	CODE
LOW⚡	sdk/python/tests/test_image_source.py	19	def test_oci_accepts_root_disk_int() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	29	def test_oci_accepts_managed_root_disk() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	36	def test_oci_accepts_tmpfs_root_disk() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	43	def test_oci_accepts_disk_image_root_disk() -> None:	CODE
LOW	sdk/python/tests/test_image_source.py	58	def test_oci_accepts_flat_root_disk() -> None:	CODE
LOW	sdk/python/tests/test_image_source.py	73	def test_oci_accepts_deprecated_upper_size_mib_alias() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	84	def test_oci_rejects_root_disk_and_upper_size_mib_together() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	89	def test_oci_rejects_raw_root_disk_dict() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	94	def test_oci_rejects_bool_root_disk_size() -> None:	CODE
LOW⚡	sdk/python/tests/test_image_source.py	99	def test_direct_image_source_rejects_bool_root_disk_size() -> None:	CODE
LOW	sdk/python/tests/test_image_source.py	110	def test_image_namespace_includes_cache_management() -> None:	CODE
LOW	sdk/python/tests/test_volume_fs_signature.py	6	def test_copy_and_rename_expose_usable_source_keywords() -> None:	CODE
LOW	sdk/python/tests/test_snapshot_stub.py	9	def test_batch_load_preserves_single_load_options_and_returns_handles() -> None:	CODE
LOW	sdk/python/tests/test_guest_flush.py	12	async def test_invalid_flush_is_rejected_before_source_lookup():	CODE
LOW⚡	sdk/python/tests/test_connection_limits.py	10	def test_omission_is_not_unlimited(self):	CODE
LOW⚡	sdk/python/tests/test_connection_limits.py	19	def test_canonical_tcp_and_udp(self):	CODE
LOW⚡	sdk/python/tests/test_connection_limits.py	29	def test_limits_preserve_secret_violation_action(self):	CODE
LOW⚡	sdk/python/tests/test_connection_limits.py	38	def test_legacy_tcp_warns_and_preserves_udp(self):	CODE
LOW⚡	sdk/python/tests/test_connection_limits.py	46	def test_both_tcp_names_are_rejected(self):	CODE
LOW⚡	sdk/python/tests/test_mount_policies.py	81	def test_bind_owner_omitted_when_unset() -> None:	CODE
LOW⚡	sdk/python/tests/test_mount_policies.py	87	def test_owner_must_be_paired() -> None:	CODE
LOW⚡	sdk/python/tests/test_mount_policies.py	93	def test_owner_rejected_on_tmpfs() -> None:	CODE
LOW⚡	sdk/python/tests/test_mount_policies.py	100	def test_owner_rejects_invalid_python_values(value: object) -> None:	CODE
LOW⚡	sdk/python/tests/test_mount_policies.py	165	def test_tmpfs_rejects_stat_virt_at_serialization() -> None:	CODE
318 more matches not shown…

Decorative Section Separators140 hits · 384 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/network/lib/engine/tcp/proxy.rs	2073	// ── extract_http_host ──────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/tcp/proxy.rs	2132	// ── plain-HTTP secret substitution ────────────────────────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	354	// ── Phase 1: Drain all guest frames with pre-inspection ──────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	549	// ── Phase 2: Ingress egress + maintenance ─────────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	566	// ── Phase 3: Service connections + relay data ────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	711	// ── Phase 4: Flush relay data + sleep ────────────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	1909	// ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/network/lib/engine/netstack/poll.rs	1922	// ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	251	// ── Layer EROFS paths (keyed by diff_id) ─────────────────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	280	// ── fsmeta EROFS paths (keyed by manifest digest) ─────────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	304	// ── VMDK descriptor paths (keyed by manifest digest) ────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	468	// ── Flat ext4 artifact paths (manifest ref → content blob) ───────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	599	// ── Staging/tmp paths (downloads, work dirs) ─────────────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	623	// ── Manifest metadata cache ──────────────────────────────────────	COMMENT
MEDIUM	crates/image/lib/cache/store.rs	862	// ── Blob cache paths ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	crates/metrics-collector/lib/lib.rs	28	//! ┌─ run loop ─────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	crates/metrics-collector/lib/lib.rs	32	//! └────┬───────────────────────────────────────┬───────────┘	COMMENT
MEDIUM⚡	crates/metrics-collector/lib/lib.rs	38	//! ┌─────────────┐ ┌─────────────┐ ┌─────────────┐	COMMENT
MEDIUM⚡	crates/metrics-collector/lib/lib.rs	44	//! └──────┬──────┘ └──────┬──────┘ └──────┬──────┘	COMMENT
MEDIUM	…s/migration/lib/m20260410_000001_erofs_image_schema.rs	154	// ── Drop old tables (FK-safe order) ──────────────────────────────	COMMENT
MEDIUM	…s/migration/lib/m20260410_000001_erofs_image_schema.rs	193	// ── Create new tables ────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	1660	// ── Block Root ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	1769	// ── File Mounts ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	1818	// ── Tmpfs ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	1843	// ── Disk Mounts ───────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	1965	// ── Network ───────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	2060	// ── Rlimits ───────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/config.rs	2106	// ── Handoff Init ──────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/network.rs	227	// ── ioctl helpers ──────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/network.rs	323	// ── netlink helpers ────────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/network.rs	531	// ── hostname + hosts + resolv.conf ──────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/network.rs	593	// ── low-level helpers ──────────────────────────────────────────────	COMMENT
MEDIUM	crates/agentd/lib/network.rs	625	// ── netlink constants and helpers ──────────────────────────────────	COMMENT
MEDIUM⚡	sdk/python/microsandbox/types.py	13	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	sdk/python/microsandbox/types.py	15	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	sdk/python/microsandbox/types.py	20	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	sdk/python/microsandbox/types.py	22	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	366	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	368	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	522	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	524	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	546	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	548	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	559	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	561	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	608	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	610	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	633	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	635	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	666	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	668	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	877	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	879	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1019	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1021	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1161	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1163	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1275	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1277	# --------------------------------------------------------------------------------------------------	COMMENT
MEDIUM	sdk/python/microsandbox/types.py	1977	# --------------------------------------------------------------------------------------------------	COMMENT
80 more matches not shown…

Cross-Language Confusion46 hits · 266 pts

Severity	File	Line	Snippet	Context
HIGH	sdk/python/integration/test_volumes.py	69	"dd if=/dev/zero of=/scratch/small bs=1M count=1 status=none && echo small-ok",	CODE
HIGH	sdk/python/integration/test_network.py	74	"nc -zv -w 5 1.1.1.1 443 >/dev/null 2>&1 \|\| echo cloudflare-failed; "	CODE
HIGH	sdk/python/integration/test_network.py	75	"nc -zv -w 5 8.8.8.8 443 >/dev/null 2>&1 \|\| echo google-failed"	CODE
HIGH	sdk/python/integration/test_patches.py	23	"test -d /opt/py-sdk && cat /opt/py-sdk/config.txt && cat /opt/py-sdk/link.txt"	CODE
HIGH	sdk/python/tests/test_jobs_integration.py	64	jobs.append(null)	CODE
HIGH⚡	examples/python/net-secrets/main.py	28	"wget -q -O /dev/null --timeout=10 https://example.com && echo OK \|\| echo FAIL"	CODE
HIGH⚡	examples/python/net-secrets/main.py	28	"wget -q -O /dev/null --timeout=10 https://example.com && echo OK \|\| echo FAIL"	CODE
HIGH⚡	examples/python/net-secrets/main.py	36	"https://cloudflare.com 2>&1 && echo OK \|\| echo BLOCKED"	CODE
HIGH⚡	examples/python/net-secrets/main.py	36	"https://cloudflare.com 2>&1 && echo OK \|\| echo BLOCKED"	CODE
HIGH	examples/python/net-tls/main.py	18	output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND \|\| echo MISSING")	CODE
HIGH	examples/python/net-tls/main.py	18	output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND \|\| echo MISSING")	CODE
HIGH⚡	examples/python/net-tls/main.py	29	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH⚡	examples/python/net-tls/main.py	29	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH⚡	examples/python/net-tls/main.py	35	"wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK \|\| echo FAIL"	CODE
HIGH⚡	examples/python/net-tls/main.py	35	"wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK \|\| echo FAIL"	CODE
HIGH⚡	examples/python/net-tls/main.py	41	"wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK \|\| echo FAIL"	CODE
HIGH⚡	examples/python/net-tls/main.py	41	"wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK \|\| echo FAIL"	CODE
HIGH	examples/python/net-policy/main.py	17	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH	examples/python/net-policy/main.py	17	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH	examples/python/net-policy/main.py	30	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH	examples/python/net-policy/main.py	30	output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK \|\| echo FAIL")	CODE
HIGH	examples/python/net-policy/main.py	43	output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK \|\| echo BLOCKED")	CODE
HIGH	examples/python/net-policy/main.py	43	output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK \|\| echo BLOCKED")	CODE
HIGH⚡	examples/python/net-dns/main.py	22	output = await sb.shell("nslookup example.com 2>&1 \| grep -c Address \|\| echo 0")	CODE
HIGH⚡	examples/python/net-dns/main.py	26	output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED \|\| echo BLOCKED")	CODE
HIGH⚡	examples/python/net-dns/main.py	26	output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED \|\| echo BLOCKED")	CODE
HIGH⚡	examples/python/net-dns/main.py	30	output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED \|\| echo BLOCKED")	CODE
HIGH⚡	examples/python/net-dns/main.py	30	output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED \|\| echo BLOCKED")	CODE
HIGH⚡	examples/python/net-dns/main.py	34	output = await sb.shell("nslookup cloudflare.com 2>&1 \| grep -c Address \|\| echo 0")	CODE
HIGH	examples/python/snapshot-fork/main.py	16	await baseline.shell("echo 'shipped via snapshot' > /root/marker.txt && sync")	CODE
HIGH	scripts/smoke/managed-job-terminal.py	248	job = launch("sh", "-c", "stty raw -echo && printf 'tty-ready\\n' && sleep 120", tty=True)	CODE
HIGH	scripts/smoke/cli/incremental-full-archive.py	81	blob_hash = guest("prepare", source_home, source, "dd if=/dev/urandom of=/dev/shm/blob bs=1M count=24 2>/dev/null; s	CODE
HIGH⚡	scripts/smoke/cli/transport-checkpoint.py	640	# null, never zero. No catalog PID is signalled by the harness.	STRING
HIGH	scripts/smoke/cli/checkpoint-memory-growth.py	54	run("exec", child, "--", "sh", "-ec", "sha256sum -c /work/hash; grep MemTotal /proc/meminfo; for i in 1 2 3 4 5;	CODE
HIGH	scripts/smoke/cli/branch-batch.py	270	self.guest("seed", "source", f"echo original > /marker; dd if=/dev/urandom of=/data bs=1M count={self.args.data_	STRING
HIGH	scripts/smoke/cli/root-disk-growth.py	76	guest(f"{layout}-seed", name, "dd if=/dev/urandom of=/payload bs=1048576 count=8 2>/dev/null; sha256sum /payload	CODE
HIGH	scripts/smoke/cli/root-disk-growth.py	78	guest(f"{layout}-new-space", name, "dd if=/dev/zero of=/space bs=1048576 count=600 conv=fsync && test $(stat -c	CODE
HIGH	scripts/smoke/cli/root-disk-growth.py	99	guest(f"{layout}-defer-space", name, "dd if=/dev/zero of=/space bs=1048576 count=1800 conv=fsync && rm /space &&	CODE
HIGH	scripts/smoke/cli/root-disk-growth.py	107	guest(f"{layout}-{suffix}-restored-data", child, "sha256sum -c /expected && test $(cat /dev/shm/grow-marker)	CODE
HIGH	scripts/smoke/cli/guest-flush.py	106	f"dd if=/dev/urandom of=/flush-data bs=1M count={args.owned_disk_mib} 2>/dev/null; "	CODE
HIGH	scripts/smoke/cli/guest-flush.py	175	"dd if=/dev/urandom of=/flush-data bs=1M count=8 2>/dev/null; "	CODE
HIGH	scripts/smoke/cli/guest-flush.py	219	shell(source, "dd if=/dev/urandom of=/flush-data bs=1M count=8 2>/dev/null; "	CODE
HIGH	scripts/smoke/cli/guest-flush.py	238	restored = shell(child, "sha256sum /flush-data 2>/dev/null \|\| true").stdout.split()	CODE
HIGH	scripts/smoke/cli/guest-flush.py	323	shell(source, "dd if=/dev/urandom of=/data/data bs=1M count=8 2>/dev/null; "	CODE
HIGH	scripts/smoke/sdk/disk-compaction-export.py	34	result = await child.exec("sh", ["-c", "sha256sum -c /expected && test $(cat /version) = 4"])	CODE
HIGH	scripts/smoke/sdk/disk-compaction-cancel.py	36	"sh", ["-c", "sha256sum -c /expected && test $(cat /version) = 4"]	CODE

Unused Imports249 hits · 156 pts

Severity	File	Line	Context
LOW	sdk/python/integration/test_create_kwargs.py	3	CODE
LOW	sdk/python/integration/test_lifecycle.py	3	CODE
LOW	sdk/python/integration/conftest.py	3	CODE
LOW	sdk/python/integration/test_images.py	1	CODE
LOW	sdk/python/integration/test_metrics_logs.py	3	CODE
LOW	sdk/python/integration/test_volumes.py	3	CODE
LOW	sdk/python/integration/test_exec.py	3	CODE
LOW	sdk/python/integration/test_fs.py	3	CODE
LOW	sdk/python/integration/test_network.py	3	CODE
LOW	sdk/python/integration/test_snapshots.py	3	CODE
LOW	sdk/python/integration/test_patches.py	3	CODE
LOW	sdk/python/integration/helpers.py	3	CODE
LOW	sdk/python/integration/test_pull_progress.py	3	CODE
LOW	sdk/python/tests/test_image_source.py	3	CODE
LOW	sdk/python/tests/test_snapshot_stub.py	3	CODE
LOW	sdk/python/tests/test_mount_policies.py	7	CODE
LOW	sdk/python/tests/test_image_archive.py	3	CODE
LOW	sdk/python/tests/test_patch_file.py	3	CODE
LOW	sdk/python/tests/test_rate_limiters.py	3	CODE
LOW	sdk/python/tests/test_vsock.py	3	CODE
LOW	sdk/python/tests/test_storage.py	3	CODE
LOW	sdk/python/tests/test_types_enums.py	8	CODE
LOW	sdk/python/tests/test_modify_stub.py	3	CODE
LOW	sdk/python/tests/test_pull_session.py	3	CODE
LOW	sdk/python/tests/test_registry_overrides.py	3	CODE
LOW	sdk/python/tests/test_secret_passthrough.py	3	CODE
LOW	sdk/python/tests/test_network_destinations.py	3	CODE
LOW	sdk/python/tests/test_runtime_binary.py	3	CODE
LOW	sdk/python/microsandbox/events.py	3	CODE
LOW	sdk/python/microsandbox/events.py	3	CODE
LOW	sdk/python/microsandbox/events.py	4	CODE
LOW	sdk/python/microsandbox/events.py	4	CODE
LOW	sdk/python/microsandbox/_cli.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
LOW	sdk/python/microsandbox/__init__.py	3	CODE
189 more matches not shown…

Hallucination Indicators10 hits · 115 pts

Severity	File	Line	Snippet	Context
CRITICAL	crates/network/lib/model/config/builder.rs	473	&& (self.config.tls.intercept_ca.cert_path.is_some()	CODE
CRITICAL	crates/network/lib/model/config/builder.rs	474	!= self.config.tls.intercept_ca.key_path.is_some())	CODE
CRITICAL⚡	crates/cli/lib/sandbox_config.rs	2818	config.spec.network.http.deny_message.as_deref(),	CODE
CRITICAL⚡	crates/cli/lib/sandbox_config.rs	2822	config.spec.network.http.network_deny_message.as_deref(),	CODE
CRITICAL⚡	crates/cli/lib/sandbox_config.rs	2826	config.spec.network.http.secret_deny_message.as_deref(),	CODE
CRITICAL	sdk/rust/lib/sandbox/restore_builder.rs	435	assert!(restore.inner.config.spec.security_profile.is_some());	CODE
CRITICAL	sdk/rust/lib/sandbox/restore_builder.rs	452	assert!(restore.inner.config.spec.security_profile.is_none());	CODE
CRITICAL	sdk/rust/lib/sandbox/restore_builder.rs	472	assert!(restore.inner.config.spec.security_profile.is_none());	CODE
CRITICAL	sdk/rust/lib/sandbox/mod.rs	1154	self.config.spec.runtime.entrypoint.as_deref(),	CODE
CRITICAL	sdk/rust/lib/sandbox/mod.rs	1155	self.config.spec.runtime.cmd.as_deref(),	CODE

Fake / Example Data70 hits · 74 pts

Severity	File	Line	Snippet	Context
LOW	crates/network/lib/model/policy/name.rs	266	"user@example.com", // userinfo@host	CODE
LOW	crates/network/lib/engine/secrets/handler.rs	3502	"env_var":"KEY", "value":"real-secret", "placeholder":"$KEY",	CODE
LOW	crates/network/lib/engine/secrets/handler.rs	3565	"env_var":"KEY", "value":"real-secret", "placeholder":"$KEY",	CODE
LOW	crates/runtime/lib/client/compat/tests.rs	345	"env_var":"API_KEY", "value":"test-secret", "placeholder":"$MSB_test",	CODE
LOW	crates/runtime/lib/client/compat/tests.rs	424	let policy = json!({"secrets":[{"env_var":"KEY","placeholder":"$KEY",	CODE
LOW	crates/runtime/lib/client/compat/tests.rs	438	"env_var":"KEY","placeholder":"$KEY","value":"private-marker",	CODE
LOW	crates/cli/lib/sandbox_config.rs	2969	"env_var": "TOKEN", "placeholder": "$TOKEN",	CODE
LOW	crates/cli/lib/commands/self_cmd/tests.rs	753	"env_var":"TOKEN", "value":"synthetic", "placeholder":"$TOKEN",	CODE
LOW	crates/db/lib/compat/config.rs	146	"env_var":"TOKEN", "value":"synthetic", "placeholder":"$TOKEN",	CODE
LOW	crates/db/lib/compat/config.rs	221	"env_var":"TOKEN", "value":"synthetic", "placeholder":"$TOKEN",	CODE
LOW	docs/api-reference/openapi.personal.json	5706	"placeholder"	CODE
LOW	docs/api-reference/openapi.personal.json	5735	"placeholder": {	CODE
LOW	docs/api-reference/openapi.personal.json	8627	"placeholder",	CODE
LOW	docs/api-reference/openapi.personal.json	8647	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	5821	"placeholder"	CODE
LOW	docs/api-reference/openapi.json	5850	"placeholder": {	CODE
LOW	docs/api-reference/openapi.json	8412	"placeholder",	CODE
LOW	docs/api-reference/openapi.json	8432	"placeholder": {	CODE
LOW	sdk/go/modify_test.go	138	if apiKey["placeholder"] != "$API_KEY" {	CODE
LOW	sdk/go/modify_test.go	139	t.Fatalf("placeholder = %v", apiKey["placeholder"])	CODE
LOW	sdk/go/native/src/lib.rs	8486	{"name":"API_KEY","source":{"kind":"env","var":"HOST_API_KEY"},"placeholder":"$API_KEY","allowed_hosts":	CODE
LOW⚡	sdk/python/tests/test_modify_stub.py	57	"env", "value", "store", "placeholder", "allowed_hosts",	CODE
LOW	sdk/python/microsandbox/types.py	1220	d["placeholder"] = self.placeholder	CODE
LOW	sdk/python/src/helpers.rs	2024	let placeholder: Option<String> = extract_opt(secret, "placeholder")?;	CODE
LOW	sdk/python/src/sandbox.rs	1592	"placeholder" => placeholder = Some(extract_secret_str(&name, "placeholder", obj)?),	CODE
LOW	sdk/python/src/sandbox.rs	2840	assert_eq!(secrets[0]["placeholder"], "$API_KEY");	CODE
LOW	sdk/rust/lib/runtime/launch_contract.rs	2265	"placeholder": "$KEY",	CODE
LOW	sdk/rust/lib/runtime/launch_contract.rs	2784	"env_var":"KEY", "placeholder":"$KEY", "value":"private-marker",	CODE
LOW	sdk/rust/lib/sandbox/modify/local.rs	5536	.is_some_and(\|reason\| reason.contains("placeholder"))	CODE
LOW	sdk/rust/lib/sandbox/modify/builder.rs	485	.secret(\|secret\| secret.env("API_KEY").value("dummy-value"))	CODE
LOW	sdk/node-ts/tests/unit/modify.test.ts	97	'"store", "placeholder", "allowedHosts", "substitution", "violationAction", ' +	CODE
LOW	sdk/node-ts/src/modify.ts	142	"placeholder",	CODE
LOW	…/control-client/typescript/tests/compatibility.test.ts	153	const raw = '{"ok":false,"error":"dummy-value: arbitrary future diagnostic","extension":18446744073709551616}\n';	CODE
LOW	…/control-client/typescript/tests/compatibility.test.ts	161	expect(inspect(error)).not.toContain("dummy-value");	CODE
LOW	packages/microsandbox-types/rust/tests/config_patch.rs	220	"placeholder": placeholder	CODE
LOW	packages/microsandbox-types/rust/lib/domain.rs	2789	.field("placeholder", &self.placeholder)	CODE
LOW	packages/microsandbox-types/rust/lib/modify.rs	467	.field("placeholder", &self.placeholder)	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	439	let mut entry = json!({"env_var":"KEY", "placeholder":"$KEY", "source":null});	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	464	r#"{"secrets":[{"env_var":"KEY","placeholder":"$KEY","injection":{"body":true,"body":false}}]}"#,	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	465	r#"{"secrets":[{"env_var":"KEY","placeholder":"$KEY","injection":{},"substitution":{}}]}"#,	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	486	"secrets": [{"env_var":"TOKEN", "value":"synthetic", "placeholder":"$KEY",	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	523	"env_var":"TOKEN", "value":"synthetic", "placeholder":"$KEY",	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	533	"env_var":"TOKEN", "placeholder":"$KEY",	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	562	"env_var":"KEY", "placeholder":"$KEY",	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	586	"env_var":"KEY", "placeholder":"$KEY",	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	601	json!({"secrets":[{"env_var":"KEY","placeholder":"$KEY","injection":{},"substitution":{}}]}),	CODE
LOW	…osandbox-types/rust/lib/compat/v0_5_0/local/secrets.rs	608	let mut value = json!({"secrets":[{"env_var":"KEY","placeholder":"$KEY",	CODE
LOW	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	291	value: Zeroizing::new("dummy-value".into()),	CODE
LOW	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	382	assert!(!format!("{settings:?}").contains("dummy-value"));	CODE
LOW	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	409	for value in ["dummy-value", ""] {	CODE
LOW⚡	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	434	assert!(!expected.contains("dummy-value"));	CODE
LOW⚡	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	443	("dummy-value", None, DesiredMaterial::Value),	CODE
LOW⚡	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	450	"dummy-value",	CODE
LOW	…kages/microsandbox-types/rust/lib/secret_plan/input.rs	465	assert!(!format!("{desired:?}").contains("dummy-value"));	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	854	"env_var":"KEY","value":"synthetic","placeholder":"$KEY",	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	886	"entries":[{"env_var":"KEY","placeholder":"$KEY", "allowed_hosts":[{"type":"any"}],	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	902	serde_json::json!({"entries":[{"env_var":"KEY","placeholder":"$KEY", "injection":{},"substitution":{}}]}),	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	921	"env_var":"KEY", "placeholder":"$KEY", "violation_action":action	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	961	let mut value = serde_json::json!({"env_var":"KEY", "placeholder":"$KEY"});	CODE
LOW	packages/microsandbox-types/rust/lib/cloud/tests.rs	988	serde_json::json!({"env_var":"KEY","placeholder":"$KEY","value":"private-token"});	CODE
10 more matches not shown…

Excessive Try-Catch Wrapping51 hits · 56 pts

Severity	File	Line	Snippet	Context
LOW	sdk/python/integration/conftest.py	55	except Exception:	CODE
LOW	sdk/python/tests/test_cow_lifecycle.py	112	except Exception:	CODE
LOW	sdk/python/tests/test_outbound_proxy.py	99	except Exception as exc:	CODE
LOW	sdk/python/microsandbox/_cli.py	16	except Exception as error:	CODE
LOW	examples/python/lifecycle-convergence/main.py	209	except Exception:	CODE
LOW	examples/python/net-ports/main.py	34	except Exception as e:	CODE
LOW	scripts/smoke/cli/checkpoint-shared-resources.py	237	except Exception as error:	CODE
LOW	scripts/smoke/cli/dirty-memory-checkpoint.py	111	except Exception:	STRING
LOW	scripts/smoke/cli/dirty-memory-checkpoint.py	176	except Exception as error:	STRING
LOW⚡	scripts/smoke/cli/snapshot-branch.py	295	except Exception as error:	CODE
LOW⚡	scripts/smoke/cli/snapshot-branch.py	302	except Exception as forced:	CODE
LOW⚡	scripts/smoke/cli/snapshot-branch.py	311	except Exception as error:	CODE
LOW	scripts/smoke/cli/snapshot-branch.py	323	except Exception as error:	CODE
LOW	scripts/smoke/cli/snapshot-branch.py	356	except Exception:	CODE
LOW	scripts/smoke/cli/snapshot-load-batch.py	248	except Exception as error:	CODE
LOW	scripts/smoke/cli/branch-timer-progress.py	73	except Exception as error:	CODE
LOW	scripts/smoke/cli/storage_lifecycle_live.py	113	except Exception as error: # noqa: BLE001 - clean every home, then report all failures.	CODE
LOW	scripts/smoke/cli/checkpoint-managed-volumes.py	126	except Exception as error:	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	376	except Exception as error:	STRING
LOW	scripts/smoke/cli/transport-checkpoint.py	433	except Exception as error:	STRING
LOW	scripts/smoke/cli/transport-checkpoint.py	532	except Exception as error:	STRING
LOW⚡	scripts/smoke/cli/transport-checkpoint.py	964	except Exception as error:	STRING
LOW⚡	scripts/smoke/cli/transport-checkpoint.py	969	except Exception as error:	STRING
LOW⚡	scripts/smoke/cli/transport-checkpoint.py	974	except Exception as error:	STRING
MEDIUM	scripts/smoke/cli/transport-checkpoint.py	394	def write():	CODE
MEDIUM	scripts/smoke/cli/transport-checkpoint.py	508	def work(self):	CODE
LOW	scripts/smoke/cli/checkpoint-integration.py	98	except Exception as error:	CODE
LOW	scripts/smoke/cli/checkpoint-memory-growth.py	62	except Exception as error:	CODE
LOW	scripts/smoke/cli/transport_tcp.py	176	except Exception as error:	CODE
LOW	scripts/smoke/cli/transport_tcp.py	191	except Exception as error:	CODE
MEDIUM	scripts/smoke/cli/transport_tcp.py	184	def write():	CODE
LOW⚡	scripts/smoke/cli/catalog-history.py	61	except Exception as error:	CODE
LOW⚡	scripts/smoke/cli/catalog-history.py	69	except Exception as recovery_error:	CODE
LOW⚡	scripts/smoke/cli/catalog-history.py	77	except Exception as historical_error:	CODE
LOW	scripts/smoke/cli/catalog-history.py	157	except Exception:	CODE
LOW	scripts/smoke/cli/catalog-history.py	160	except Exception as error:	CODE
LOW	scripts/smoke/cli/hpack-secret-guard.py	124	except Exception as error:	CODE
LOW	scripts/smoke/cli/hpack-secret-guard.py	262	except Exception:	STRING
LOW	scripts/smoke/cli/checkpoint-cpu-state.py	53	except Exception as error:	CODE
LOW	scripts/smoke/cli/checkpoint-clock.py	70	except Exception as error:	CODE
LOW	scripts/smoke/cli/cow-memory-lifecycle.py	160	except Exception as error:	CODE
LOW	scripts/smoke/cli/restore-resources.py	60	except Exception:	CODE
LOW⚡	scripts/smoke/cli/restore-resources.py	194	except Exception:	CODE
LOW⚡	scripts/smoke/cli/restore-resources.py	200	except Exception as error:	CODE
LOW⚡	scripts/smoke/cli/restore-resources.py	205	except Exception as error:	CODE
LOW	scripts/smoke/cli/root-disk-large-growth.py	203	except Exception as error:	CODE
LOW	scripts/smoke/cli/guest-flush.py	401	except Exception as error:	CODE
LOW	scripts/smoke/cli/guest-flush.py	407	except Exception:	CODE
LOW	scripts/smoke/cli/live-disk-snapshot.py	172	except Exception as error:	CODE
LOW	scripts/smoke/sdk/legacy-secrets.py	51	except Exception as error:	CODE
MEDIUM	scripts/smoke/sdk/legacy-secrets.py	36	def respond(reader, writer):	CODE

Empty Error Handlers11 hits · 55 pts

Severity	File	Line	Snippet	Context
HIGH	sdk/python/tests/test_cow_lifecycle.py	84	except SandboxNotFoundError:	CODE
HIGH	examples/python/lifecycle-convergence/main.py	27	except SandboxNotFoundError:	CODE
HIGH	scripts/smoke/managed-job-terminal.py	97	except BlockingIOError:	CODE
HIGH	scripts/smoke/managed-job-terminal.py	110	except BlockingIOError:	CODE
HIGH	scripts/smoke/cli/snapshot-branch.py	356	except Exception:	CODE
HIGH	scripts/smoke/cli/published-port-ranges.py	55	except OSError:	CODE
HIGH	scripts/smoke/cli/hpack-secret-guard.py	78	except OSError:	CODE
HIGH	scripts/smoke/cli/hpack-secret-guard.py	130	except OSError:	CODE
HIGH	scripts/smoke/cli/hpack-secret-guard.py	262	except Exception:	CODE
HIGH	scripts/smoke/sdk/disk-compaction-export.py	25	except MicrosandboxError:	CODE
HIGH	scripts/smoke/sdk/disk-compaction-cancel.py	29	except asyncio.CancelledError:	CODE

Deep Nesting50 hits · 48 pts

Severity	File	Line	Context
LOW	sdk/python/tests/test_cow_lifecycle.py	70	CODE
LOW	sdk/python/tests/test_modify_stub.py	33	CODE
LOW	sdk/python/microsandbox/types.py	703	CODE
LOW	sdk/python/microsandbox/types.py	1038	CODE
LOW	sdk/python/microsandbox/types.py	1883	CODE
LOW	scripts/sync-docs-openapi.py	217	CODE
LOW	scripts/sync-docs-openapi.py	372	CODE
LOW	scripts/sync-docs-openapi.py	487	CODE
LOW	scripts/smoke/managed-job-terminal.py	46	CODE
LOW	scripts/smoke/managed-job-terminal.py	157	CODE
LOW	scripts/smoke/cli/runtime-discovery.py	22	CODE
LOW	scripts/smoke/cli/runtime-discovery.py	59	CODE
LOW	scripts/smoke/cli/dirty-memory-checkpoint.py	61	CODE
LOW	scripts/smoke/cli/snapshot-branch.py	327	CODE
LOW	scripts/smoke/cli/snapshot-load-batch.py	19	CODE
LOW	scripts/smoke/cli/storage_lifecycle_live.py	14	CODE
LOW	scripts/smoke/cli/managed-job-integration.py	68	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	326	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	387	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	743	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	917	CODE
LOW	scripts/smoke/cli/transport-checkpoint.py	394	CODE
LOW	scripts/smoke/cli/test_transport_tcp.py	41	CODE
LOW	scripts/smoke/cli/test_transport_tcp.py	54	CODE
LOW	scripts/smoke/cli/checkpoint-integration.py	54	CODE
LOW	scripts/smoke/cli/published-port-ranges.py	43	CODE
LOW	scripts/smoke/cli/published-port-ranges.py	63	CODE
LOW	scripts/smoke/cli/branch-batch.py	266	CODE
LOW	scripts/smoke/cli/transport_tcp.py	155	CODE
LOW	scripts/smoke/cli/catalog-history.py	119	CODE
LOW	scripts/smoke/cli/test_snapshot_branch.py	290	CODE
LOW	scripts/smoke/cli/branch-preparation.py	160	CODE
LOW	scripts/smoke/cli/branch-preparation.py	324	CODE
LOW	scripts/smoke/cli/nested-snapshot.py	59	CODE
LOW	scripts/smoke/cli/nested-snapshot.py	90	CODE
LOW	scripts/smoke/cli/test_transport_checkpoint.py	301	CODE
LOW	scripts/smoke/cli/test_previous_release_upgrade.py	26	CODE
LOW	scripts/smoke/cli/storage_lifecycle.py	28	CODE
LOW	scripts/smoke/cli/guest-flush.py	17	CODE
LOW	scripts/smoke/cli/live-disk-snapshot.py	40	CODE
LOW	scripts/smoke/sdk/legacy-secrets.py	88	CODE
LOW	scripts/ci/publish-crates.py	60	CODE
LOW	scripts/ci/publish-crates.py	169	CODE
LOW	scripts/ci/publish-crates.py	218	CODE
LOW	scripts/ci/publish-crates.py	254	CODE
LOW	scripts/ci/test_runner_storage.py	59	CODE
LOW	scripts/ci/test_install.py	19	CODE
LOW	scripts/ci/validate_linux_glibc.py	117	CODE
LOW	scripts/ci/validate_linux_glibc.py	153	CODE
LOW	scripts/ci/test_publish_crates.py	25	CODE

AI Slop Vocabulary7 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	sdk/rust/Cargo.toml	21	# Exposes the archive walker to the fuzz harness (sdk/rust/fuzz). Never enabled in shipping builds.	COMMENT
MEDIUM	scripts/smoke/managed-job-terminal.py	158	# A file avoids a harness thread blocked in a pipe write. Its shared offset shows when	COMMENT
MEDIUM	scripts/smoke/cli/snapshot-load-batch.py	234	# Delete only this harness's exports, never the retained source fixtures. Loaded	COMMENT
MEDIUM	scripts/smoke/cli/managed-job-integration.py	138	# managed-jobs.py invokes the real-terminal harness as well as CLI lifecycle	COMMENT
MEDIUM⚡	scripts/smoke/cli/transport-checkpoint.py	639	# Read only this harness's catalog. Missing/unsupported CPU observations are explicitly	STRING
MEDIUM⚡	scripts/smoke/cli/transport-checkpoint.py	640	# null, never zero. No catalog PID is signalled by the harness.	STRING
MEDIUM	scripts/smoke/cli/test_restore_resource_intent.py	27	# The harness hashes this fixture before and after the restore matrix.	COMMENT

Verbosity Indicators4 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	crates/image/lib/registry/client.rs	551	// Step 1: Early cache check using persisted image metadata.	COMMENT
LOW	crates/image/lib/registry/client.rs	592	// Step 2: Resolve manifest.	COMMENT
LOW⚡	crates/image/lib/registry/client.rs	611	// Step 3: Parse config.	COMMENT
LOW⚡	crates/image/lib/registry/client.rs	614	// Step 4: Get layer descriptors.	COMMENT

Structural Annotation Overuse4 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	crates/image/lib/registry/client.rs	551	// Step 1: Early cache check using persisted image metadata.	COMMENT
LOW	crates/image/lib/registry/client.rs	592	// Step 2: Resolve manifest.	COMMENT
LOW⚡	crates/image/lib/registry/client.rs	611	// Step 3: Parse config.	COMMENT
LOW⚡	crates/image/lib/registry/client.rs	614	// Step 4: Get layer descriptors.	COMMENT

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/python/volume-named/main.py	9	# Create a named volume.	COMMENT
MEDIUM	examples/python/fs-read-stream/main.py	21	# Create a 10 MiB file with random data inside the sandbox.	COMMENT

Modern AI Meta-Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	README.md	408	> • <img height="14" src="https://octicons-col.vercel.app/organization/A770EF"> **[Agentic Coding Quickstart](https://gi	CODE
MEDIUM	README.md	409	> • <img height="14" src="https://octicons-col.vercel.app/package/A770EF"> **[Condukt](https://github.com/tuist/condukt)	CODE

Modern Structural Boilerplate2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	sdk/python/microsandbox/events.py	6	__all__ = ["ExecEvent", "ExecEventType", "PullEvent", "PullEventType"]	CODE
LOW	sdk/python/microsandbox/__init__.py	223	__all__ = [	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/bump-version.sh	5	# Usage:	COMMENT

superradcompany/microsandbox

Open-Source Code Quality, Security and Technical Debt Review