4.3

Adjusted Signal

4.3

Raw Pattern Score

100%

Time Factor

2026-10-28

Last Push

15.3K

Stars

Java

Language

276.1K

Lines of Code

988

Files

375

Pattern Hits

2026-10-31

Scan Date

0.07

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 99 finding(s).

Hallucinated Dependency & Supply Chain Risk 14.5/100 · LOW

Are imports declared and package/API names verified? 208 finding(s).

Agent Over-Engineering Ratio 3.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 71 finding(s).

PR Review Velocity Impact 18.4/100 · LOW

Which changes need focused human review? 375 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 67HIGH 2MEDIUM 69LOW 237

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 375 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators67 hits · 705 pts

Severity	File	Line	Snippet	Context
CRITICAL	…/io/supertokens/test/TransactionCountBaselineTest.java	192	prepareWebAuthnSignIn(process, io.supertokens.test.webauthn.Utils.registerUserWithCredentials(	CODE
CRITICAL	…/io/supertokens/test/TransactionCountBaselineTest.java	195	JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(process.getProcess(),	CODE
CRITICAL⚡	…/io/supertokens/test/TransactionCountBaselineTest.java	392	JsonObject options = io.supertokens.test.webauthn.Utils.signInOptions(process.getProcess());	CODE
CRITICAL⚡	…/io/supertokens/test/TransactionCountBaselineTest.java	394	credentials = io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(options,	CODE
CRITICAL⚡	…/io/supertokens/test/TransactionCountBaselineTest.java	400	JsonObject response = io.supertokens.test.webauthn.Utils.signIn(process.getProcess(),	CODE
CRITICAL	src/test/java/io/supertokens/test/AuthRecipeTest.java	738	List<JsonObject> webauthnUsers = io.supertokens.test.webauthn.Utils.registerUsers(main, 1);	CODE
CRITICAL	…ountlinking/ListPrimaryUsersTransactionParityTest.java	143	String webauthnUserId = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, sharedEmail)	CODE
CRITICAL	…kens/test/accountlinking/GetUserByAccountInfoTest.java	106	JsonObject responseUser = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, email).getAsJsonO	CODE
CRITICAL	…ns/test/accountlinking/LifecycleMutationEventTest.java	548	JsonObject signUpResponse = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(	CODE
CRITICAL	…kens/test/webauthn/WebauthNAccountLinkingFlowTest.java	217	JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)	CODE
CRITICAL	…kens/test/webauthn/WebauthNAccountLinkingFlowTest.java	338	JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)	CODE
CRITICAL	…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java	72	List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers);	CODE
CRITICAL	…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java	92	JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)	CODE
CRITICAL	…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java	125	List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers);	CODE
CRITICAL	…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java	146	JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(),	CODE
CRITICAL	…kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java	156	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java	158	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java	239	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java	241	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…kens/test/webauthn/api/TestListCredentialsAPI_5_3.java	193	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…kens/test/webauthn/api/TestListCredentialsAPI_5_3.java	195	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…est/webauthn/api/TestSignInOptionsConsumption_5_5.java	79	JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,	CODE
CRITICAL	…est/webauthn/api/TestSignInOptionsConsumption_5_5.java	114	JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,	CODE
CRITICAL	…est/webauthn/api/TestSignInOptionsConsumption_5_5.java	146	JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,	CODE
CRITICAL	…est/webauthn/api/TestSignInOptionsConsumption_5_5.java	184	JsonObject signInOptionsResponse = io.supertokens.test.webauthn.Utils.signInOptions(main);	CODE
CRITICAL	…est/webauthn/api/TestSignInOptionsConsumption_5_5.java	186	io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(signInOptionsResponse, clientPlatform,	CODE
CRITICAL	…tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java	232	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java	234	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java	307	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java	309	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java	331	Map<String, PublicKeyCredential<AuthenticatorAssertionResponse, AuthenticationExtensionClientOutput>> options =	CODE
CRITICAL	…ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java	237	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java	239	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL	…/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java	323	Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea	CODE
CRITICAL	…/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java	325	PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto	CODE
CRITICAL⚡	…st/webauthn/api/TestWebAuthNCrossTenantSignIn_5_3.java	113	io.supertokens.test.webauthn.Utils.createPublicKeyCreationOptions(registerOptions);	CODE
CRITICAL⚡	…st/webauthn/api/TestWebAuthNCrossTenantSignIn_5_3.java	116	io.supertokens.test.webauthn.Utils.createPasskey(authenticator, creationOptions.values().iterator().next	CODE
CRITICAL⚡	…st/webauthn/api/TestWebAuthNCrossTenantSignIn_5_3.java	125	io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(t2SignInOptions, authenticator, credent	CODE
CRITICAL⚡	…st/webauthn/api/TestWebAuthNCrossTenantSignIn_5_3.java	134	io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(t1SignInOptions, authenticator, credent	CODE
CRITICAL	src/test/java/io/supertokens/test/saml/MockSAML.java	240	org.opensaml.core.xml.schema.impl.XSStringBuilder sb = new org.opensaml.core.xml.schema.impl.XSStrin	CODE
CRITICAL	…va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java	409	String urlDecoded = java.net.URLDecoder.decode(encoded, java.nio.charset.StandardCharsets.UTF_8.name());	CODE
CRITICAL	…va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java	421	return baos.toString(java.nio.charset.StandardCharsets.UTF_8.name());	CODE
CRITICAL	src/main/java/io/supertokens/bulkimport/BulkImport.java	574	new io.supertokens.pluginInterface.authRecipe.LoginMethod.ThirdParty(lM.thirdPartyId, lM.thi	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	1453	throw new io.supertokens.pluginInterface.thirdparty.exception.DuplicateUserIdException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	1504	throw new io.supertokens.pluginInterface.thirdparty.exception.DuplicateUserIdException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	3135	throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	3194	throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateUserIdException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	3198	throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	4115	throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateCredentialException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	4241	throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	4290	throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	4514	String table = io.supertokens.inmemorydb.config.Config.getConfig(this).getSAMLClientsTable();	CODE
CRITICAL	src/main/java/io/supertokens/inmemorydb/Start.java	4516	throw new io.supertokens.pluginInterface.saml.exception.DuplicateEntityIdException();	CODE
CRITICAL	src/main/java/io/supertokens/webserver/Webserver.java	344	addAPI(new RecipeRouter(main, new UserAPI(main), new io.supertokens.webserver.api.thirdparty.UserAPI(main),	CODE
CRITICAL	src/main/java/io/supertokens/webserver/Webserver.java	345	new io.supertokens.webserver.api.passwordless.UserAPI(main)));	CODE
CRITICAL	src/main/java/io/supertokens/webserver/Webserver.java	482	addAPI(new io.supertokens.webserver.api.webauthn.SignInAPI(main));	CODE
CRITICAL	…supertokens/webserver/api/emailpassword/SignInAPI.java	80	io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,	CODE
CRITICAL	…r/api/emailpassword/ImportUserWithPasswordHashAPI.java	101	io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,	CODE
CRITICAL	…r/api/emailpassword/GeneratePasswordResetTokenAPI.java	71	io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,	CODE
CRITICAL	…supertokens/webserver/api/emailpassword/SignUpAPI.java	82	io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,	CODE
7 more matches not shown…

Decorative Section Separators68 hits · 204 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	45	// ── Full blue-green migration lifecycle ─────────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	50	// ─── Phase 1: LEGACY ───────────────────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	67	// ─── Phase 2: DUAL_WRITE_READ_OLD ─────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	106	// ─── Phase 3: DUAL_WRITE_READ_NEW ─────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	131	// ─── Phase 4: MIGRATED ────────────────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	164	// ── Concurrent operations during mode switch ────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	197	// ── Rollback scenario: forward then back ────────────────────────────────────	COMMENT
MEDIUM	…ress-tests/src/migrationBehavior/testModeTransition.ts	238	// ── Email conflict detection across modes ───────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testConcurrency.ts	32	// ── Concurrent link + email update ──────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testConcurrency.ts	79	// ── Concurrent link + unlink ────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testConcurrency.ts	129	// ── Concurrent deleteUser + linkAccounts ────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testConcurrency.ts	171	// ── Bulk concurrent user creation + linking ─────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testConcurrency.ts	211	// ── Mixed recipe concurrent operations ──────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testMultitenancy.ts	26	// ── Helper: create a tenant ─────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testMultitenancy.ts	38	// ── Tenant association tests ────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testMultitenancy.ts	94	// ── Linking + tenant interaction ────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	16	// ── Config ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	23	// ── Types ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	42	// ── SDK Init ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	88	// ── Test Runner ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	135	// ── Assertions ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	161	// ── User Helpers ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	235	// ── Core API Helpers (direct HTTP) ──────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	262	// ── App-scoped helpers (direct HTTP for blue-green tests) ───────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/setup.ts	479	// ── Reporting ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testEmailUpdates.ts	26	// ── EmailPassword email updates ─────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testEmailUpdates.ts	109	// ── ThirdParty email updates (via signInUp) ─────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testEmailUpdates.ts	153	// ── Password updates ────────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	31	// ── Test: createPrimaryUser ─────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	80	// ── Test: linkAccounts ──────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	166	// ── Test: unlinkAccounts ────────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	209	// ── Test: canLinkAccounts ───────────────────────────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	244	// ── Test: deleteUser interaction with linking ───────────────────────────────	COMMENT
MEDIUM	stress-tests/src/migrationBehavior/testLinkAccounts.ts	278	// ── Test: multiple links ────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/batch-generate-jars.yml	22	# ── Parse the free-text version list into a JSON matrix ──────────────	COMMENT
MEDIUM	.github/workflows/batch-generate-jars.yml	39	# ── Fan out: one generate-jars run per version ────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	59	# ── Validate inputs ───────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	74	# ── Resolve branches for the given versions ───────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	92	# ── Update dependency manifests if needed ─────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	193	# ── Register new versions with the SuperTokens API ────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	268	# ── Run unit tests (sqlite + postgresql) ──────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	431	# ── Mark test results on the SuperTokens API ──────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	499	# ── Stress tests ──────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	508	# ── Tag and publish the release Docker image ──────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	523	# ── Tag all repos with release versions ───────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	641	# ── Build and commit the release JARs ─────────────────────────────	COMMENT
MEDIUM	.github/workflows/do-release-java15.yml	654	# ── Notify Slack about the successful release ─────────────────────	COMMENT
MEDIUM	.github/workflows/generate-jars.yml	120	# ── plugin-interface ────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/generate-jars.yml	186	# ── postgresql-plugin ───────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/generate-jars.yml	252	# ── core ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/release-tests.yml	29	# ── Update dependency manifests if needed ────────────────────────	COMMENT
MEDIUM	.github/workflows/release-tests.yml	120	# ── Unit tests (sqlite + postgresql) ──────────────────────────────	COMMENT
MEDIUM	.github/workflows/release-tests.yml	247	# ── Wait for the dev Docker image to be published ─────────────────	COMMENT
MEDIUM	.github/workflows/release-tests.yml	280	# ── Stress tests (uses the published Docker image) ────────────────	COMMENT
MEDIUM	…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java	77	// ── shared constants ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java	84	// ── test helpers ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java	141	// ── Bug 1: XSString attribute extraction ─────────────────────────────────	COMMENT
MEDIUM	…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java	218	// ── Bug 2: email attribute fallback chain ─────────────────────────────────	COMMENT
MEDIUM	src/main/java/io/supertokens/oauth/OAuth.java	64	// ── Test-only OAuth-provider stub hook (PLAN-017 / CORE-2) ───────────────────────────────────────	COMMENT
MEDIUM	…ain/java/io/supertokens/inmemorydb/ConnectionPool.java	37	// ── Test-only connection-borrow instrumentation (PLAN-017 / CORE-2) ──────────────────────────────	COMMENT
8 more matches not shown…

Fake / Example Data141 hits · 158 pts

Severity	File	Line	Snippet	Context
LOW	…java/io/supertokens/test/ApproximateUserCountTest.java	291	EmailPassword.signUp(process.getProcess(), "user@example.com", "password");	CODE
LOW	src/test/java/io/supertokens/test/FeatureFlagTest.java	528	tenantIdentifier, storage, process.getProcess(), "user@example.com",	CODE
LOW	src/test/java/io/supertokens/test/FeatureFlagTest.java	702	tenantIdentifier, storage, process.getProcess(), "user@example.com",	CODE
LOW	src/test/java/io/supertokens/test/FeatureFlagTest.java	834	tenantIdentifier, storage, process.getProcess(), "user@example.com",	CODE
LOW	…/java/io/supertokens/test/multitenant/TestAppData.java	193	"user@example.com", "password");	CODE
LOW	…/java/io/supertokens/test/multitenant/TestAppData.java	195	"user@example.com", "password");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	232	JsonObject user1 = epSignUp(t1, "user@example.com", "password1");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	233	JsonObject user2 = epSignUp(t2, "user@example.com", "password2");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	234	JsonObject user3 = epSignUp(t3, "user@example.com", "password3");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	241	JsonObject nuser1 = epSignIn(t1, "user@example.com", "password1");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	242	JsonObject nuser2 = epSignIn(t2, "user@example.com", "password2");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	243	JsonObject nuser3 = epSignIn(t3, "user@example.com", "password3");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	261	JsonObject nuser1 = epGetUserUsingEmail(t1, "user@example.com");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	262	JsonObject nuser2 = epGetUserUsingEmail(t2, "user@example.com");	CODE
LOW⚡	…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java	263	JsonObject nuser3 = epGetUserUsingEmail(t3, "user@example.com");	CODE
LOW	…rtokens/test/multitenant/api/TestLicenseBehaviour.java	104	"user@example.com", "password", process.getProcess());	CODE
LOW	…rtokens/test/multitenant/api/TestLicenseBehaviour.java	293	"user@example.com", "password", process.getProcess());	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	141	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	163	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	243	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	269	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	293	process.getProcess(), "user@example.com", "password");	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	325	process.getProcess(), "user@example.com", null, null, null);	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	403	"googleid", "user@example.com");	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	434	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	451	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	471	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	497	JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	536	"user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	540	TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t2"), "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	556	"google-user", "user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	561	"user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	577	"user@example.com",	CODE
LOW	…ns/test/multitenant/api/TestTenantUserAssociation.java	581	TestMultitenancyAPIHelper.plSignInUpEmail(new TenantIdentifier(null, "a1", "t2"), "user@example.com",	CODE
LOW	…ns/test/accountlinking/LifecycleMutationEventTest.java	410	* A fake-email sign-up is pre-verified on the same audited connection as the user creation (the fake-email	COMMENT
LOW⚡	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	276	JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");	CODE
LOW⚡	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	277	JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");	CODE
LOW⚡	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	278	JsonObject user3 = emailPasswordSignUp(t3, "user@example.com", "password3");	CODE
LOW	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	401	JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");	CODE
LOW	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	402	JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");	CODE
LOW	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	443	JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");	CODE
LOW	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	444	JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");	CODE
LOW	…rtokens/test/userIdMapping/api/MultitenantAPITest.java	487	JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");	CODE
LOW	…io/supertokens/test/authRecipe/MultitenantAPITest.java	202	"user@example.com",	CODE
LOW	…io/supertokens/test/authRecipe/MultitenantAPITest.java	231	"user@example.com",	CODE
LOW	…io/supertokens/test/authRecipe/MultitenantAPITest.java	302	process.getProcess(), "google", "googleid1", "user@example.com");	CODE
LOW	…io/supertokens/test/authRecipe/MultitenantAPITest.java	314	process.getProcess(), "facebook", "facebookid1", "user@example.com");	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	215	EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com", "password1");	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	216	EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com", "password2");	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	217	EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com", "password3");	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	220	AuthRecipeUserInfo userInfo = EmailPassword.signIn(t1, t1storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	222	assertEquals("user@example.com", userInfo.loginMethods[0].email);	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	226	AuthRecipeUserInfo userInfo = EmailPassword.signIn(t2, t2storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	228	assertEquals("user@example.com", userInfo.loginMethods[0].email);	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	232	AuthRecipeUserInfo userInfo = EmailPassword.signIn(t3, t3storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	234	assertEquals("user@example.com", userInfo.loginMethods[0].email);	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	337	AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	339	AuthRecipeUserInfo user2 = EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	341	AuthRecipeUserInfo user3 = EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com",	CODE
LOW⚡	…s/test/emailpassword/MultitenantEmailPasswordTest.java	392	AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com",	CODE
81 more matches not shown…

Over-Commented Block67 hits · 67 pts

Severity	File	Line	Snippet	Context
LOW	devConfig.yaml	1	# Config for SuperTokens service. Here you will set the config params for	COMMENT
LOW	devConfig.yaml	21	# access_token_validity:	COMMENT
LOW	devConfig.yaml	41		COMMENT
LOW	devConfig.yaml	61		COMMENT
LOW	devConfig.yaml	81	# (DIFFERENT_ACROSS_TENANTS \| OPTIONAL \| Default: 3600000) long value. Time in milliseconds for how long a password	COMMENT
LOW	devConfig.yaml	101	# totp_max_attempts:	COMMENT
LOW	devConfig.yaml	121		COMMENT
LOW	devConfig.yaml	141	# again. Telemetry's user count, the license-usage stats and the unfiltered tenant count of /users/count on CDI 5.7	COMMENT
LOW	devConfig.yaml	161	# used when admin_port is set.	COMMENT
LOW	devConfig.yaml	181		COMMENT
LOW	devConfig.yaml	201	# (OPTIONAL \| Default: 87795 (85 mb)). Amount of memory in kb for argon2 password hashing	COMMENT
LOW	devConfig.yaml	221	# the value. For example, use the value of 127\.\d+\.\d+\.\d+\|::1\|0:0:0:0:0:0:0:1 to allow only localhost to query the	COMMENT
LOW	devConfig.yaml	241	# core are accepted.	COMMENT
LOW	devConfig.yaml	261	# the oauth provider when the oauth provider's internal address differs from the known public provider address.	COMMENT
LOW	devConfig.yaml	281	# activity_log_retention_days:	COMMENT
LOW	devConfig.yaml	301	# (OPTIONAL \| Default: null) string value. If specified, uses this URL as ACS URL for handling legacy SAML clients	COMMENT
LOW	config.yaml	1	# Config for SuperTokens service. Here you will set the config params for	COMMENT
LOW	config.yaml	21	# access_token_validity:	COMMENT
LOW	config.yaml	41	# (DIFFERENT_ACROSS_APPS \| OPTIONAL \| Default: 144000) double value. Time in mins for how long a refresh token is valid	COMMENT
LOW	config.yaml	61	# (OPTIONAL \| Default: true) boolean value. If true, the core refuses to start when the base database is missing	COMMENT
LOW	config.yaml	81	# reset token / link is valid for.	COMMENT
LOW	config.yaml	101		COMMENT
LOW	config.yaml	121		COMMENT
LOW	config.yaml	141	# (or 5.6 with allowApproximate) are the last full count plus the sign-ups, deletions and links logged since; the full	COMMENT
LOW	config.yaml	161	# admin_max_server_pool_size:	COMMENT
LOW	config.yaml	181		COMMENT
LOW	config.yaml	201	# argon2_memory_kb:	COMMENT
LOW	config.yaml	221	# core. Comment it out to allow requests from any IP address.	COMMENT
LOW	config.yaml	241	# core are accepted.	COMMENT
LOW	config.yaml	261	# (OPTIONAL \| Default: oauth_provider_public_service_url) If specified, the core uses this URL to parse responses from	COMMENT
LOW	config.yaml	281	# by a periodic cleanup. Must be the same for all apps/tenants under a connection URI domain.	COMMENT
LOW	config.yaml	301		COMMENT
LOW	stress-tests/src/common/utils.ts	381	// apart from pathological scaling. The read-path steps are therefore measured	COMMENT
LOW	stress-tests/src/common/migrationMode.ts	1	// ---------------------------------------------------------------------------	COMMENT
LOW	stress-tests/src/oneMillionUsers/pgStatStatements.ts	1	import { Client } from 'pg';	COMMENT
LOW	stress-tests/src/oneMillionUsers/index.ts	241		COMMENT
LOW	stress-tests/src/oneMillionUsers/oauthPaths.ts	21	// the OAuth-dependent paths, so they land in the same summary table / ratio /	COMMENT
LOW	test-data/playground/src/setupTests.js	1	// jest-dom adds custom jest matchers for asserting on DOM nodes.	COMMENT
LOW	ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java	221	// for (Storage storage : storages) {	COMMENT
LOW	ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java	321	if (((AuthRecipeStorage) storage).checkIfUsesAccountLinking(this.appIdentifier)) {	COMMENT
LOW	ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java	341	// }	COMMENT
LOW	.github/workflows/_release-derive-db-migration.yml	1	name: Release – Derive has-db-migration	COMMENT
LOW	.github/workflows/backport.yml	1	# Backports one or more commits onto older release branches by cherry-pick and	COMMENT
LOW	.github/workflows/do-release.yml	261	# code-generated from the plugin's canonical script	COMMENT
LOW	.github/workflows/do-release.yml	281	# the migration PR simply lands earlier (at canary time) rather than being	COMMENT
LOW	.github/workflows/embargo-build.yml	1	name: Embargo build	COMMENT
LOW	.github/helpers/verify-prebuilt-image.sh	1	#!/usr/bin/env bash	COMMENT
LOW	src/test/java/io/supertokens/test/PluginTest.java	201	// String installDir = "../";	COMMENT
LOW	src/test/java/io/supertokens/test/PluginTest.java	221	// process.kill();	COMMENT
LOW	src/test/java/io/supertokens/test/FeatureFlagTest.java	321	// the direct write left user2's row in place (this internal linkAccounts path never deleted it),	COMMENT
LOW	…est/java/io/supertokens/test/multitenant/LoadTest.java	101	}	COMMENT
LOW	…est/java/io/supertokens/test/multitenant/LoadTest.java	121	// assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED));	COMMENT
LOW	…est/java/io/supertokens/test/multitenant/LoadTest.java	141	// for (ResourceDistributor.SingletonResource resource : map.values()) {	COMMENT
LOW	…n/java/io/supertokens/useridmapping/UserIdMapping.java	161	// if the userId is used in email verification, then we do an exception and update the	COMMENT
LOW	…n/java/io/supertokens/useridmapping/UserIdMapping.java	281	if (storageClasses.size() == 1 &&	COMMENT
LOW	…ava/io/supertokens/inmemorydb/TransactionCounters.java	21	import java.sql.Connection;	COMMENT
LOW	…/io/supertokens/inmemorydb/queries/GeneralQueries.java	1341		COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	121	+ Config.getConfig(start).getRecipeUserAccountInfosTable() + "(app_id, recipe_user_id);";	COMMENT
LOW	…va/io/supertokens/authRecipe/ApproximateUserCount.java	101	// anchors instead of being re-read by every call. Matches the shadow audit's burst cap.	COMMENT
LOW	src/main/java/io/supertokens/authRecipe/AuthRecipe.java	181	primaryUser.getSupertokensUserId(), recipeUserId);	COMMENT
7 more matches not shown…

Structural Annotation Overuse15 hits · 22 pts

Severity	File	Line	Snippet	Context
LOW	docs/CUTOVER-PROCEDURE.md	21	## Step 1: Deploy with `DUAL_WRITE_READ_OLD`	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	52	## Step 2: Run Backfill	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	81	## Step 3: Validate Data Consistency	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	116	## Step 4: Switch to `DUAL_WRITE_READ_NEW`	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	138	## Step 5: Monitor in Production	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	148	## Step 6: Switch to `MIGRATED`	COMMENT
LOW	docs/CUTOVER-PROCEDURE.md	165	## Step 7: Drop Deprecated Tables (Future Release)	COMMENT
LOW	src/test/java/io/supertokens/test/saml/MockSAML.java	90	// NOTE: This class provides helpers to mimic a minimal SAML IdP for tests.	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	831	// Step 1: Get all tenant/account combinations to insert	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	922	// Step 1: Get all account info records to be inserted	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	945	// Step 2: Check for conflicts	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	992	// Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly added	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1055	// Step 1: Get ALL account info records for the entire primary user group.	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1078	// Step 2: Check for conflicts	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1122	// Step 3: Insert new rows using INSERT OR IGNORE	COMMENT

Synthetic Comment Markers2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	.github/workflows/_image-promote.yml	6	# (<version> or <version>-canary; plus <major>.<minor>, <major>, latest as requested).	COMMENT
HIGH	…supertokens/inmemorydb/queries/UserLockingQueries.java	153	// Build result list in the same order as requested, verifying all users were found	COMMENT

Verbosity Indicators10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	…n/java/io/supertokens/useridmapping/UserIdMapping.java	527	// we need to check if db is in A3 or A4.	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	572	// now we need to check if the user can become primary by checking if there are conflicting account info	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	831	// Step 1: Get all tenant/account combinations to insert	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	922	// Step 1: Get all account info records to be inserted	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	945	// Step 2: Check for conflicts	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	992	// Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly added	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1055	// Step 1: Get ALL account info records for the entire primary user group.	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1078	// Step 2: Check for conflicts	COMMENT
LOW	…supertokens/inmemorydb/queries/AccountInfoQueries.java	1122	// Step 3: Insert new rows using INSERT OR IGNORE	COMMENT
LOW	…c/main/java/io/supertokens/webserver/RequestStats.java	106	// appIdentifier parameter is coming from the API request and hence we need to check if the app exists	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	stress-tests/src/oneMillionUsers/pagination.ts	149	// and that comparison is robust to account-linking math.	COMMENT

Hyper-Verbose Identifiers3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	stress-tests/src/oneMillionUsers/generateUsers.ts	51	function createThirdPartyLoginMethod(email: string, tenantIds: string[]): LoginMethod {	CODE
LOW	stress-tests/src/oneMillionUsers/generateUsers.ts	66	function createPasswordlessLoginMethod(	CODE
LOW	stress-tests/src/oneMillionUsers/generateUsers.ts	106	function generateRandomPhoneNumber(): string {	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…test/java/io/supertokens/test/totp/TOTPRecipeTest.java	60	// TODO: Add test for UsedCodeAlreadyExistsException once we implement time mocking	COMMENT

supertokens/supertokens-core

Open-Source Code Quality, Security and Technical Debt Review