Repository Analysis

supertokens/supertokens-core

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

3.9 Likely human-written View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of supertokens/supertokens-core, a Java project with 15,288 GitHub stars. SynthScan v2.0 examined 250,326 lines of code across 914 source files, recording 328 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 3.9 places this repository in the Likely human-written band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

3.9
Adjusted Score
3.9
Raw Score
100%
Time Factor
2026-08-28
Last Push
15.3K
Stars
Java
Language
250.3K
Lines of Code
914
Files
328
Pattern Hits
2026-08-29
Scan Date
0.06
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 54HIGH 1MEDIUM 66LOW 207

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 328 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hallucination Indicators54 hits · 540 pts
SeverityFileLineSnippetContext
CRITICALsrc/test/java/io/supertokens/test/AuthRecipeTest.java738 List<JsonObject> webauthnUsers = io.supertokens.test.webauthn.Utils.registerUsers(main, 1);CODE
CRITICAL…kens/test/accountlinking/GetUserByAccountInfoTest.java106 JsonObject responseUser = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, email).getAsJsonOCODE
CRITICAL…kens/test/webauthn/WebauthNAccountLinkingFlowTest.java217 JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)CODE
CRITICAL…kens/test/webauthn/WebauthNAccountLinkingFlowTest.java338 JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)CODE
CRITICAL…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java72 List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers);CODE
CRITICAL…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java92 JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0)CODE
CRITICAL…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java125 List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers);CODE
CRITICAL…ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java146 JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(),CODE
CRITICAL…kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java156 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java158 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java239 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java241 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…kens/test/webauthn/api/TestListCredentialsAPI_5_3.java193 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…kens/test/webauthn/api/TestListCredentialsAPI_5_3.java195 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…est/webauthn/api/TestSignInOptionsConsumption_5_5.java79 JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,CODE
CRITICAL…est/webauthn/api/TestSignInOptionsConsumption_5_5.java114 JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,CODE
CRITICAL…est/webauthn/api/TestSignInOptionsConsumption_5_5.java146 JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main,CODE
CRITICAL…est/webauthn/api/TestSignInOptionsConsumption_5_5.java184 JsonObject signInOptionsResponse = io.supertokens.test.webauthn.Utils.signInOptions(main);CODE
CRITICAL…est/webauthn/api/TestSignInOptionsConsumption_5_5.java186 io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(signInOptionsResponse, clientPlatform,CODE
CRITICAL…tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java232 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java234 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java307 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java309 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java331 Map<String, PublicKeyCredential<AuthenticatorAssertionResponse, AuthenticationExtensionClientOutput>> options = CODE
CRITICAL…ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java237 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java239 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICAL…/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java323 Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCreaCODE
CRITICAL…/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java325 PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.supertoCODE
CRITICALsrc/test/java/io/supertokens/test/saml/MockSAML.java240 org.opensaml.core.xml.schema.impl.XSStringBuilder sb = new org.opensaml.core.xml.schema.impl.XSStrinCODE
CRITICAL…va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java406 String urlDecoded = java.net.URLDecoder.decode(encoded, java.nio.charset.StandardCharsets.UTF_8.name());CODE
CRITICAL…va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java418 return baos.toString(java.nio.charset.StandardCharsets.UTF_8.name());CODE
CRITICALsrc/main/java/io/supertokens/bulkimport/BulkImport.java504 new io.supertokens.pluginInterface.authRecipe.LoginMethod.ThirdParty(lM.thirdPartyId, lM.thiCODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java1371 throw new io.supertokens.pluginInterface.thirdparty.exception.DuplicateUserIdException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java2868 throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java2927 throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateUserIdException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java2931 throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java3792 throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateCredentialException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java3918 throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java3967 throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java4190 String table = io.supertokens.inmemorydb.config.Config.getConfig(this).getSAMLClientsTable();CODE
CRITICALsrc/main/java/io/supertokens/inmemorydb/Start.java4192 throw new io.supertokens.pluginInterface.saml.exception.DuplicateEntityIdException();CODE
CRITICALsrc/main/java/io/supertokens/webserver/Webserver.java316 addAPI(new RecipeRouter(main, new UserAPI(main), new io.supertokens.webserver.api.thirdparty.UserAPI(main),CODE
CRITICALsrc/main/java/io/supertokens/webserver/Webserver.java317 new io.supertokens.webserver.api.passwordless.UserAPI(main)));CODE
CRITICALsrc/main/java/io/supertokens/webserver/Webserver.java453 addAPI(new io.supertokens.webserver.api.webauthn.SignInAPI(main));CODE
CRITICAL…supertokens/webserver/api/emailpassword/SignInAPI.java79 io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,CODE
CRITICAL…r/api/emailpassword/ImportUserWithPasswordHashAPI.java101 io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,CODE
CRITICAL…r/api/emailpassword/GeneratePasswordResetTokenAPI.java71 io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,CODE
CRITICAL…supertokens/webserver/api/emailpassword/SignUpAPI.java82 io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main,CODE
CRITICAL…/supertokens/webserver/api/thirdparty/SignInUpAPI.java144 io.supertokens.webserver.api.thirdparty.Utils.assertIfThirdPartyIsEnabledForTenant(main,CODE
CRITICAL…pertokens/webserver/api/passwordless/CheckCodeAPI.java82 io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main,CODE
CRITICAL…rtokens/webserver/api/passwordless/ConsumeCodeAPI.java87 io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main,CODE
CRITICAL…ertokens/webserver/api/passwordless/CreateCodeAPI.java83 io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main,CODE
CRITICALsrc/main/java/io/supertokens/saml/SAML.java311 org.opensaml.xmlsec.signature.X509Certificate x509CertElement = new org.opensaml.xmlsec.signature.impl.X509CCODE
CRITICALsrc/main/java/io/supertokens/saml/SAML.java721 String validUntil = java.time.format.DateTimeFormatter.ISO_INSTANT.format(cert.getNotAfter().toInstant());CODE
Decorative Section Separators65 hits · 195 pts
SeverityFileLineSnippetContext
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts45// ── Full blue-green migration lifecycle ─────────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts50 // ─── Phase 1: LEGACY ───────────────────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts67 // ─── Phase 2: DUAL_WRITE_READ_OLD ─────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts106 // ─── Phase 3: DUAL_WRITE_READ_NEW ─────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts131 // ─── Phase 4: MIGRATED ────────────────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts164// ── Concurrent operations during mode switch ────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts197// ── Rollback scenario: forward then back ────────────────────────────────────COMMENT
MEDIUM…ress-tests/src/migrationBehavior/testModeTransition.ts238// ── Email conflict detection across modes ───────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testConcurrency.ts32// ── Concurrent link + email update ──────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testConcurrency.ts79// ── Concurrent link + unlink ────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testConcurrency.ts129// ── Concurrent deleteUser + linkAccounts ────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testConcurrency.ts171// ── Bulk concurrent user creation + linking ─────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testConcurrency.ts211// ── Mixed recipe concurrent operations ──────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testMultitenancy.ts26// ── Helper: create a tenant ─────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testMultitenancy.ts38// ── Tenant association tests ────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testMultitenancy.ts94// ── Linking + tenant interaction ────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts16// ── Config ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts23// ── Types ───────────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts42// ── SDK Init ────────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts88// ── Test Runner ─────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts135// ── Assertions ──────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts161// ── User Helpers ────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts235// ── Core API Helpers (direct HTTP) ──────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts262// ── App-scoped helpers (direct HTTP for blue-green tests) ───────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/setup.ts479// ── Reporting ───────────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testEmailUpdates.ts26// ── EmailPassword email updates ─────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testEmailUpdates.ts109// ── ThirdParty email updates (via signInUp) ─────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testEmailUpdates.ts153// ── Password updates ────────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts31// ── Test: createPrimaryUser ─────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts80// ── Test: linkAccounts ──────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts166// ── Test: unlinkAccounts ────────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts209// ── Test: canLinkAccounts ───────────────────────────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts244// ── Test: deleteUser interaction with linking ───────────────────────────────COMMENT
MEDIUMstress-tests/src/migrationBehavior/testLinkAccounts.ts278// ── Test: multiple links ────────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/batch-generate-jars.yml22 # ── Parse the free-text version list into a JSON matrix ──────────────COMMENT
MEDIUM.github/workflows/batch-generate-jars.yml38 # ── Fan out: one generate-jars run per version ────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml59 # ── Validate inputs ───────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml73 # ── Resolve branches for the given versions ───────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml91 # ── Update dependency manifests if needed ─────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml192 # ── Register new versions with the SuperTokens API ────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml249 # ── Run unit tests (sqlite + postgresql) ──────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml412 # ── Mark test results on the SuperTokens API ──────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml461 # ── Build and publish the dev Docker image ────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml547 # ── Stress tests ──────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml556 # ── Tag and publish the release Docker image ──────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml571 # ── Tag all repos with release versions ───────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml687 # ── Build and commit the release JARs ─────────────────────────────COMMENT
MEDIUM.github/workflows/do-release-java15.yml700 # ── Notify Slack about the successful release ─────────────────────COMMENT
MEDIUM.github/workflows/generate-jars.yml119 # ── plugin-interface ────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/generate-jars.yml185 # ── postgresql-plugin ───────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/generate-jars.yml251 # ── core ────────────────────────────────────────────────────────────COMMENT
MEDIUM.github/workflows/release-tests.yml29 # ── Update dependency manifests if needed ────────────────────────COMMENT
MEDIUM.github/workflows/release-tests.yml120 # ── Unit tests (sqlite + postgresql) ──────────────────────────────COMMENT
MEDIUM.github/workflows/release-tests.yml247 # ── Wait for the dev Docker image to be published ─────────────────COMMENT
MEDIUM.github/workflows/release-tests.yml280 # ── Stress tests (uses the published Docker image) ────────────────COMMENT
MEDIUM…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java76 // ── shared constants ──────────────────────────────────────────────────────COMMENT
MEDIUM…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java83 // ── test helpers ─────────────────────────────────────────────────────────COMMENT
MEDIUM…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java140 // ── Bug 1: XSString attribute extraction ─────────────────────────────────COMMENT
MEDIUM…rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java217 // ── Bug 2: email attribute fallback chain ─────────────────────────────────COMMENT
MEDIUM…/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java395 // ── 1. SELECT … FOR UPDATE ─────────────────────────────────────COMMENT
5 more matches not shown…
Fake / Example Data131 hits · 147 pts
SeverityFileLineSnippetContext
LOW…java/io/supertokens/test/ApproximateUserCountTest.java153 EmailPassword.signUp(process.getProcess(), "user@example.com", "password");CODE
LOW…java/io/supertokens/test/ApproximateUserCountTest.java179 EmailPassword.signUp(process.getProcess(), "user@example.com", "password");CODE
LOWsrc/test/java/io/supertokens/test/FeatureFlagTest.java510 tenantIdentifier, storage, process.getProcess(), "user@example.com",CODE
LOWsrc/test/java/io/supertokens/test/FeatureFlagTest.java632 tenantIdentifier, storage, process.getProcess(), "user@example.com",CODE
LOWsrc/test/java/io/supertokens/test/FeatureFlagTest.java764 tenantIdentifier, storage, process.getProcess(), "user@example.com",CODE
LOW…/java/io/supertokens/test/multitenant/TestAppData.java186 "user@example.com", "password");CODE
LOW…/java/io/supertokens/test/multitenant/TestAppData.java188 "user@example.com", "password");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java232 JsonObject user1 = epSignUp(t1, "user@example.com", "password1");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java233 JsonObject user2 = epSignUp(t2, "user@example.com", "password2");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java234 JsonObject user3 = epSignUp(t3, "user@example.com", "password3");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java241 JsonObject nuser1 = epSignIn(t1, "user@example.com", "password1");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java242 JsonObject nuser2 = epSignIn(t2, "user@example.com", "password2");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java243 JsonObject nuser3 = epSignIn(t3, "user@example.com", "password3");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java261 JsonObject nuser1 = epGetUserUsingEmail(t1, "user@example.com");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java262 JsonObject nuser2 = epGetUserUsingEmail(t2, "user@example.com");CODE
LOW…ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java263 JsonObject nuser3 = epGetUserUsingEmail(t3, "user@example.com");CODE
LOW…rtokens/test/multitenant/api/TestLicenseBehaviour.java104 "user@example.com", "password", process.getProcess());CODE
LOW…rtokens/test/multitenant/api/TestLicenseBehaviour.java293 "user@example.com", "password", process.getProcess());CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java141 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java163 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java243 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java269 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java293 process.getProcess(), "user@example.com", "password");CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java325 process.getProcess(), "user@example.com", null, null, null);CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java403 "googleid", "user@example.com");CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java434 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java451 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java471 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java497 JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java536 "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java540 TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t2"), "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java556 "google-user", "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java561 "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java577 "user@example.com",CODE
LOW…ns/test/multitenant/api/TestTenantUserAssociation.java581 TestMultitenancyAPIHelper.plSignInUpEmail(new TenantIdentifier(null, "a1", "t2"), "user@example.com",CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java276 JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java277 JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java278 JsonObject user3 = emailPasswordSignUp(t3, "user@example.com", "password3");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java401 JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java402 JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java443 JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java444 JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2");CODE
LOW…rtokens/test/userIdMapping/api/MultitenantAPITest.java487 JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1");CODE
LOW…io/supertokens/test/authRecipe/MultitenantAPITest.java202 "user@example.com",CODE
LOW…io/supertokens/test/authRecipe/MultitenantAPITest.java231 "user@example.com",CODE
LOW…io/supertokens/test/authRecipe/MultitenantAPITest.java302 process.getProcess(), "google", "googleid1", "user@example.com");CODE
LOW…io/supertokens/test/authRecipe/MultitenantAPITest.java314 process.getProcess(), "facebook", "facebookid1", "user@example.com");CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java215 EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com", "password1");CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java216 EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com", "password2");CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java217 EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com", "password3");CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java220 AuthRecipeUserInfo userInfo = EmailPassword.signIn(t1, t1storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java222 assertEquals("user@example.com", userInfo.loginMethods[0].email);CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java226 AuthRecipeUserInfo userInfo = EmailPassword.signIn(t2, t2storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java228 assertEquals("user@example.com", userInfo.loginMethods[0].email);CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java232 AuthRecipeUserInfo userInfo = EmailPassword.signIn(t3, t3storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java234 assertEquals("user@example.com", userInfo.loginMethods[0].email);CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java337 AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java339 AuthRecipeUserInfo user2 = EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java341 AuthRecipeUserInfo user3 = EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com",CODE
LOW…s/test/emailpassword/MultitenantEmailPasswordTest.java392 AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com",CODE
71 more matches not shown…
Over-Commented Block47 hits · 47 pts
SeverityFileLineSnippetContext
LOWdevConfig.yaml1# Config for SuperTokens service. Here you will set the config params forCOMMENT
LOWdevConfig.yaml21# access_token_validity:COMMENT
LOWdevConfig.yaml41COMMENT
LOWdevConfig.yaml61COMMENT
LOWdevConfig.yaml81# (DIFFERENT_ACROSS_TENANTS | OPTIONAL | Default: 5) integer value. The maximum number of invalid TOTP attempts thatCOMMENT
LOWdevConfig.yaml101# (OPTIONAL | Default: 10) integer value. Sets the max thread pool size for incoming http server requests.COMMENT
LOWdevConfig.yaml121# password_hashing_alg:COMMENT
LOWdevConfig.yaml141COMMENT
LOWdevConfig.yaml161COMMENT
LOWdevConfig.yaml181# service.COMMENT
LOWdevConfig.yaml201# bulk_migration_batch_size:COMMENT
LOWdevConfig.yaml221# (OPTIONAL | Default: https://saml.supertokens.com) string value. Service provider's entity ID.COMMENT
LOWconfig.yaml1# Config for SuperTokens service. Here you will set the config params forCOMMENT
LOWconfig.yaml21# access_token_validity:COMMENT
LOWconfig.yaml41# (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: 144000) double value. Time in mins for how long a refresh token is validCOMMENT
LOWconfig.yaml61COMMENT
LOWconfig.yaml81# will trigger rate limiting.COMMENT
LOWconfig.yaml101# max_server_pool_size:COMMENT
LOWconfig.yaml121COMMENT
LOWconfig.yaml141# (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). The signer key used for firebase scrypt password hashingCOMMENT
LOWconfig.yaml161# (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). This is used when the core needs to assume a specific CDI versionCOMMENT
LOWconfig.yaml181# (OPTIONAL | Default: null) string value. If specified, the core uses this URL to connect to the OAuth provider adminCOMMENT
LOWconfig.yaml201# specified number of users for migrating in one single batch.COMMENT
LOWconfig.yaml221COMMENT
LOWstress-tests/src/common/utils.ts381// apart from pathological scaling. The read-path steps are therefore measuredCOMMENT
LOWstress-tests/src/common/migrationMode.ts1// ---------------------------------------------------------------------------COMMENT
LOWstress-tests/src/oneMillionUsers/pgStatStatements.ts1import { Client } from 'pg';COMMENT
LOWstress-tests/src/oneMillionUsers/index.ts241COMMENT
LOWstress-tests/src/oneMillionUsers/oauthPaths.ts21// the OAuth-dependent paths, so they land in the same summary table / ratio /COMMENT
LOWtest-data/playground/src/setupTests.js1// jest-dom adds custom jest matchers for asserting on DOM nodes.COMMENT
LOWee/src/main/java/io/supertokens/ee/EEFeatureFlag.java201COMMENT
LOWee/src/main/java/io/supertokens/ee/EEFeatureFlag.java321 // if (!usesAccountLinking) {COMMENT
LOW.github/workflows/backport.yml1# Backports one or more commits onto older release branches by cherry-pick andCOMMENT
LOWsrc/test/java/io/supertokens/test/PluginTest.java201// String installDir = "../";COMMENT
LOWsrc/test/java/io/supertokens/test/PluginTest.java221// process.kill();COMMENT
LOW…est/java/io/supertokens/test/multitenant/LoadTest.java101 }COMMENT
LOW…est/java/io/supertokens/test/multitenant/LoadTest.java121// assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED));COMMENT
LOW…est/java/io/supertokens/test/multitenant/LoadTest.java141// for (ResourceDistributor.SingletonResource resource : map.values()) {COMMENT
LOW…n/java/io/supertokens/useridmapping/UserIdMapping.java281 storageClasses.get(0).equals(EmailVerificationStorage.class.getName())) {COMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java121 + Config.getConfig(start).getRecipeUserAccountInfosTable() + "(app_id, recipe_user_id);";COMMENT
LOWsrc/main/java/io/supertokens/authRecipe/AuthRecipe.java641 String userIdToDeleteForAuthRecipe;COMMENT
LOW…ens/webserver/api/multitenancy/BaseCreateOrUpdate.java321// tenantConfig.coreConfigCOMMENT
LOW…/main/java/io/supertokens/signingkeys/SigningKeys.java221 // This function is synchronized because we only want a single function to clear (and refresh) the key cache.COMMENT
LOWsrc/main/java/io/supertokens/totp/Totp.java181 private static void checkAndStoreCode(TenantIdentifier tenantIdentifier, Storage storage, Main main,COMMENT
LOWsrc/main/java/io/supertokens/totp/Totp.java201 // 15 minutes, and totp_invalid_code_expiry is 5 minutes.COMMENT
LOWsrc/main/java/io/supertokens/emailpassword/User.java1///*COMMENT
LOWsrc/main/java/io/supertokens/emailpassword/User.java21//COMMENT
Structural Annotation Overuse15 hits · 22 pts
SeverityFileLineSnippetContext
LOWdocs/CUTOVER-PROCEDURE.md21## Step 1: Deploy with `DUAL_WRITE_READ_OLD`COMMENT
LOWdocs/CUTOVER-PROCEDURE.md52## Step 2: Run BackfillCOMMENT
LOWdocs/CUTOVER-PROCEDURE.md81## Step 3: Validate Data ConsistencyCOMMENT
LOWdocs/CUTOVER-PROCEDURE.md116## Step 4: Switch to `DUAL_WRITE_READ_NEW`COMMENT
LOWdocs/CUTOVER-PROCEDURE.md138## Step 5: Monitor in ProductionCOMMENT
LOWdocs/CUTOVER-PROCEDURE.md148## Step 6: Switch to `MIGRATED`COMMENT
LOWdocs/CUTOVER-PROCEDURE.md165## Step 7: Drop Deprecated Tables (Future Release)COMMENT
LOWsrc/test/java/io/supertokens/test/saml/MockSAML.java90// NOTE: This class provides helpers to mimic a minimal SAML IdP for tests.COMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java831 // Step 1: Get all tenant/account combinations to insertCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java922 // Step 1: Get all account info records to be insertedCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java945 // Step 2: Check for conflictsCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java992 // Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly addedCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1055 // Step 1: Get ALL account info records for the entire primary user group.COMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1078 // Step 2: Check for conflictsCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1122 // Step 3: Insert new rows using INSERT OR IGNORECOMMENT
Verbosity Indicators10 hits · 15 pts
SeverityFileLineSnippetContext
LOW…n/java/io/supertokens/useridmapping/UserIdMapping.java523 // we need to check if db is in A3 or A4.COMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java572 // now we need to check if the user can become primary by checking if there are conflicting account infoCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java831 // Step 1: Get all tenant/account combinations to insertCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java922 // Step 1: Get all account info records to be insertedCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java945 // Step 2: Check for conflictsCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java992 // Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly addedCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1055 // Step 1: Get ALL account info records for the entire primary user group.COMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1078 // Step 2: Check for conflictsCOMMENT
LOW…supertokens/inmemorydb/queries/AccountInfoQueries.java1122 // Step 3: Insert new rows using INSERT OR IGNORECOMMENT
LOW…c/main/java/io/supertokens/webserver/RequestStats.java101 // appIdentifier parameter is coming from the API request and hence we need to check if the app existsCOMMENT
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGH…supertokens/inmemorydb/queries/UserLockingQueries.java153 // Build result list in the same order as requested, verifying all users were foundCOMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMstress-tests/src/oneMillionUsers/pagination.ts149 // and that comparison is robust to account-linking math.COMMENT
Hyper-Verbose Identifiers3 hits · 3 pts
SeverityFileLineSnippetContext
LOWstress-tests/src/oneMillionUsers/generateUsers.ts51function createThirdPartyLoginMethod(email: string, tenantIds: string[]): LoginMethod {CODE
LOWstress-tests/src/oneMillionUsers/generateUsers.ts66function createPasswordlessLoginMethod(CODE
LOWstress-tests/src/oneMillionUsers/generateUsers.ts106function generateRandomPhoneNumber(): string {CODE
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOW…test/java/io/supertokens/test/totp/TOTPRecipeTest.java60// TODO: Add test for UsedCodeAlreadyExistsException once we implement time mockingCOMMENT