Open source alternative to Auth0 / Firebase Auth / AWS Cognito
This report presents the forensic synthetic code analysis of supertokens/supertokens-core, a Java project with 15,288 GitHub stars. SynthScan v2.0 examined 250,326 lines of code across 914 source files, recording 328 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 3.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 328 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/test/java/io/supertokens/test/AuthRecipeTest.java | 738 | List<JsonObject> webauthnUsers = io.supertokens.test.webauthn.Utils.registerUsers(main, 1); | CODE |
| CRITICAL | …kens/test/accountlinking/GetUserByAccountInfoTest.java | 106 | JsonObject responseUser = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, email).getAsJsonO | CODE |
| CRITICAL | …kens/test/webauthn/WebauthNAccountLinkingFlowTest.java | 217 | JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0) | CODE |
| CRITICAL | …kens/test/webauthn/WebauthNAccountLinkingFlowTest.java | 338 | JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0) | CODE |
| CRITICAL | …ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java | 72 | List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers); | CODE |
| CRITICAL | …ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java | 92 | JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), users.get(0) | CODE |
| CRITICAL | …ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java | 125 | List<JsonObject> users = io.supertokens.test.webauthn.Utils.registerUsers(process.getProcess(), numberOfUsers); | CODE |
| CRITICAL | …ava/io/supertokens/test/webauthn/WebAuthNFlowTest.java | 146 | JsonObject signInResponse = io.supertokens.test.webauthn.Utils.signInWithUser(process.getProcess(), | CODE |
| CRITICAL | …kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java | 156 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …kens/test/webauthn/api/TestUpdateUserEmailAPI_5_3.java | 158 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java | 239 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …authn/api/TestSignUpWithCredentialRegisterAPI_5_3.java | 241 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …kens/test/webauthn/api/TestListCredentialsAPI_5_3.java | 193 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …kens/test/webauthn/api/TestListCredentialsAPI_5_3.java | 195 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …est/webauthn/api/TestSignInOptionsConsumption_5_5.java | 79 | JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, | CODE |
| CRITICAL | …est/webauthn/api/TestSignInOptionsConsumption_5_5.java | 114 | JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, | CODE |
| CRITICAL | …est/webauthn/api/TestSignInOptionsConsumption_5_5.java | 146 | JsonObject user = io.supertokens.test.webauthn.Utils.registerUserWithCredentials(main, | CODE |
| CRITICAL | …est/webauthn/api/TestSignInOptionsConsumption_5_5.java | 184 | JsonObject signInOptionsResponse = io.supertokens.test.webauthn.Utils.signInOptions(main); | CODE |
| CRITICAL | …est/webauthn/api/TestSignInOptionsConsumption_5_5.java | 186 | io.supertokens.test.webauthn.Utils.createPublicKeyRequestOptions(signInOptionsResponse, clientPlatform, | CODE |
| CRITICAL | …tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java | 232 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …tokens/test/webauthn/api/TestGetCredentialAPI_5_3.java | 234 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java | 307 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java | 309 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …o/supertokens/test/webauthn/api/TestSignInAPI_5_3.java | 331 | Map<String, PublicKeyCredential<AuthenticatorAssertionResponse, AuthenticationExtensionClientOutput>> options = | CODE |
| CRITICAL | …ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java | 237 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …ens/test/webauthn/api/TestRemoveCredentialAPI_5_3.java | 239 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | …/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java | 323 | Map<String, PublicKeyCredentialCreationOptions> options = io.supertokens.test.webauthn.Utils.createPublicKeyCrea | CODE |
| CRITICAL | …/test/webauthn/api/TestCredentialsRegisterAPI_5_3.java | 325 | PublicKeyCredential<AuthenticatorAttestationResponse, RegistrationExtensionClientOutput> credential = io.superto | CODE |
| CRITICAL | src/test/java/io/supertokens/test/saml/MockSAML.java | 240 | org.opensaml.core.xml.schema.impl.XSStringBuilder sb = new org.opensaml.core.xml.schema.impl.XSStrin | CODE |
| CRITICAL | …va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java | 406 | String urlDecoded = java.net.URLDecoder.decode(encoded, java.nio.charset.StandardCharsets.UTF_8.name()); | CODE |
| CRITICAL | …va/io/supertokens/test/saml/api/SAMLConfigTest5_4.java | 418 | return baos.toString(java.nio.charset.StandardCharsets.UTF_8.name()); | CODE |
| CRITICAL | src/main/java/io/supertokens/bulkimport/BulkImport.java | 504 | new io.supertokens.pluginInterface.authRecipe.LoginMethod.ThirdParty(lM.thirdPartyId, lM.thi | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 1371 | throw new io.supertokens.pluginInterface.thirdparty.exception.DuplicateUserIdException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 2868 | throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 2927 | throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateUserIdException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 2931 | throw new io.supertokens.pluginInterface.dashboard.exceptions.DuplicateEmailException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 3792 | throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateCredentialException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 3918 | throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 3967 | throw new io.supertokens.pluginInterface.webauthn.exceptions.DuplicateUserIdException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 4190 | String table = io.supertokens.inmemorydb.config.Config.getConfig(this).getSAMLClientsTable(); | CODE |
| CRITICAL | src/main/java/io/supertokens/inmemorydb/Start.java | 4192 | throw new io.supertokens.pluginInterface.saml.exception.DuplicateEntityIdException(); | CODE |
| CRITICAL | src/main/java/io/supertokens/webserver/Webserver.java | 316 | addAPI(new RecipeRouter(main, new UserAPI(main), new io.supertokens.webserver.api.thirdparty.UserAPI(main), | CODE |
| CRITICAL | src/main/java/io/supertokens/webserver/Webserver.java | 317 | new io.supertokens.webserver.api.passwordless.UserAPI(main))); | CODE |
| CRITICAL | src/main/java/io/supertokens/webserver/Webserver.java | 453 | addAPI(new io.supertokens.webserver.api.webauthn.SignInAPI(main)); | CODE |
| CRITICAL | …supertokens/webserver/api/emailpassword/SignInAPI.java | 79 | io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main, | CODE |
| CRITICAL | …r/api/emailpassword/ImportUserWithPasswordHashAPI.java | 101 | io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main, | CODE |
| CRITICAL | …r/api/emailpassword/GeneratePasswordResetTokenAPI.java | 71 | io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main, | CODE |
| CRITICAL | …supertokens/webserver/api/emailpassword/SignUpAPI.java | 82 | io.supertokens.webserver.api.emailpassword.Utils.assertIfEmailPasswordIsEnabledForTenant(main, | CODE |
| CRITICAL | …/supertokens/webserver/api/thirdparty/SignInUpAPI.java | 144 | io.supertokens.webserver.api.thirdparty.Utils.assertIfThirdPartyIsEnabledForTenant(main, | CODE |
| CRITICAL | …pertokens/webserver/api/passwordless/CheckCodeAPI.java | 82 | io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main, | CODE |
| CRITICAL | …rtokens/webserver/api/passwordless/ConsumeCodeAPI.java | 87 | io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main, | CODE |
| CRITICAL | …ertokens/webserver/api/passwordless/CreateCodeAPI.java | 83 | io.supertokens.webserver.api.passwordless.Utils.assertIfPasswordlessIsEnabledForTenant(main, | CODE |
| CRITICAL | src/main/java/io/supertokens/saml/SAML.java | 311 | org.opensaml.xmlsec.signature.X509Certificate x509CertElement = new org.opensaml.xmlsec.signature.impl.X509C | CODE |
| CRITICAL | src/main/java/io/supertokens/saml/SAML.java | 721 | String validUntil = java.time.format.DateTimeFormatter.ISO_INSTANT.format(cert.getNotAfter().toInstant()); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 45 | // ── Full blue-green migration lifecycle ───────────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 50 | // ─── Phase 1: LEGACY ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 67 | // ─── Phase 2: DUAL_WRITE_READ_OLD ───────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 106 | // ─── Phase 3: DUAL_WRITE_READ_NEW ───────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 131 | // ─── Phase 4: MIGRATED ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 164 | // ── Concurrent operations during mode switch ──────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 197 | // ── Rollback scenario: forward then back ──────────────────────────────────── | COMMENT |
| MEDIUM | …ress-tests/src/migrationBehavior/testModeTransition.ts | 238 | // ── Email conflict detection across modes ─────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testConcurrency.ts | 32 | // ── Concurrent link + email update ────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testConcurrency.ts | 79 | // ── Concurrent link + unlink ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testConcurrency.ts | 129 | // ── Concurrent deleteUser + linkAccounts ──────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testConcurrency.ts | 171 | // ── Bulk concurrent user creation + linking ───────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testConcurrency.ts | 211 | // ── Mixed recipe concurrent operations ────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testMultitenancy.ts | 26 | // ── Helper: create a tenant ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testMultitenancy.ts | 38 | // ── Tenant association tests ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testMultitenancy.ts | 94 | // ── Linking + tenant interaction ──────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 16 | // ── Config ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 23 | // ── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 42 | // ── SDK Init ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 88 | // ── Test Runner ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 135 | // ── Assertions ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 161 | // ── User Helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 235 | // ── Core API Helpers (direct HTTP) ────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 262 | // ── App-scoped helpers (direct HTTP for blue-green tests) ─────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/setup.ts | 479 | // ── Reporting ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testEmailUpdates.ts | 26 | // ── EmailPassword email updates ───────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testEmailUpdates.ts | 109 | // ── ThirdParty email updates (via signInUp) ───────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testEmailUpdates.ts | 153 | // ── Password updates ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 31 | // ── Test: createPrimaryUser ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 80 | // ── Test: linkAccounts ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 166 | // ── Test: unlinkAccounts ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 209 | // ── Test: canLinkAccounts ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 244 | // ── Test: deleteUser interaction with linking ─────────────────────────────── | COMMENT |
| MEDIUM | stress-tests/src/migrationBehavior/testLinkAccounts.ts | 278 | // ── Test: multiple links ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/batch-generate-jars.yml | 22 | # ── Parse the free-text version list into a JSON matrix ────────────── | COMMENT |
| MEDIUM | .github/workflows/batch-generate-jars.yml | 38 | # ── Fan out: one generate-jars run per version ──────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 59 | # ── Validate inputs ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 73 | # ── Resolve branches for the given versions ─────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 91 | # ── Update dependency manifests if needed ───────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 192 | # ── Register new versions with the SuperTokens API ──────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 249 | # ── Run unit tests (sqlite + postgresql) ────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 412 | # ── Mark test results on the SuperTokens API ────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 461 | # ── Build and publish the dev Docker image ──────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 547 | # ── Stress tests ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 556 | # ── Tag and publish the release Docker image ────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 571 | # ── Tag all repos with release versions ─────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 687 | # ── Build and commit the release JARs ───────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/do-release-java15.yml | 700 | # ── Notify Slack about the successful release ───────────────────── | COMMENT |
| MEDIUM | .github/workflows/generate-jars.yml | 119 | # ── plugin-interface ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/generate-jars.yml | 185 | # ── postgresql-plugin ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/generate-jars.yml | 251 | # ── core ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-tests.yml | 29 | # ── Update dependency manifests if needed ──────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-tests.yml | 120 | # ── Unit tests (sqlite + postgresql) ────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-tests.yml | 247 | # ── Wait for the dev Docker image to be published ───────────────── | COMMENT |
| MEDIUM | .github/workflows/release-tests.yml | 280 | # ── Stress tests (uses the published Docker image) ──────────────── | COMMENT |
| MEDIUM | …rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java | 76 | // ── shared constants ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java | 83 | // ── test helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java | 140 | // ── Bug 1: XSString attribute extraction ───────────────────────────────── | COMMENT |
| MEDIUM | …rtokens/test/saml/api/SAMLClaimsExtractionTest5_4.java | 217 | // ── Bug 2: email attribute fallback chain ───────────────────────────────── | COMMENT |
| MEDIUM | …/io/supertokens/webserver/api/oauth/OAuthTokenAPI.java | 395 | // ── 1. SELECT … FOR UPDATE ───────────────────────────────────── | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …java/io/supertokens/test/ApproximateUserCountTest.java | 153 | EmailPassword.signUp(process.getProcess(), "user@example.com", "password"); | CODE |
| LOW | …java/io/supertokens/test/ApproximateUserCountTest.java | 179 | EmailPassword.signUp(process.getProcess(), "user@example.com", "password"); | CODE |
| LOW | src/test/java/io/supertokens/test/FeatureFlagTest.java | 510 | tenantIdentifier, storage, process.getProcess(), "user@example.com", | CODE |
| LOW | src/test/java/io/supertokens/test/FeatureFlagTest.java | 632 | tenantIdentifier, storage, process.getProcess(), "user@example.com", | CODE |
| LOW | src/test/java/io/supertokens/test/FeatureFlagTest.java | 764 | tenantIdentifier, storage, process.getProcess(), "user@example.com", | CODE |
| LOW | …/java/io/supertokens/test/multitenant/TestAppData.java | 186 | "user@example.com", "password"); | CODE |
| LOW | …/java/io/supertokens/test/multitenant/TestAppData.java | 188 | "user@example.com", "password"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 232 | JsonObject user1 = epSignUp(t1, "user@example.com", "password1"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 233 | JsonObject user2 = epSignUp(t2, "user@example.com", "password2"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 234 | JsonObject user3 = epSignUp(t3, "user@example.com", "password3"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 241 | JsonObject nuser1 = epSignIn(t1, "user@example.com", "password1"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 242 | JsonObject nuser2 = epSignIn(t2, "user@example.com", "password2"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 243 | JsonObject nuser3 = epSignIn(t3, "user@example.com", "password3"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 261 | JsonObject nuser1 = epGetUserUsingEmail(t1, "user@example.com"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 262 | JsonObject nuser2 = epGetUserUsingEmail(t2, "user@example.com"); | CODE |
| LOW⚡ | …ltitenant/api/TestTenantIdIsNotPresentForOlderCDI.java | 263 | JsonObject nuser3 = epGetUserUsingEmail(t3, "user@example.com"); | CODE |
| LOW | …rtokens/test/multitenant/api/TestLicenseBehaviour.java | 104 | "user@example.com", "password", process.getProcess()); | CODE |
| LOW | …rtokens/test/multitenant/api/TestLicenseBehaviour.java | 293 | "user@example.com", "password", process.getProcess()); | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 141 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 163 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 243 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 269 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 293 | process.getProcess(), "user@example.com", "password"); | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 325 | process.getProcess(), "user@example.com", null, null, null); | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 403 | "googleid", "user@example.com"); | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 434 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 451 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 471 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 497 | JsonObject user = TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t1"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 536 | "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 540 | TestMultitenancyAPIHelper.epSignUp(new TenantIdentifier(null, "a1", "t2"), "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 556 | "google-user", "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 561 | "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 577 | "user@example.com", | CODE |
| LOW | …ns/test/multitenant/api/TestTenantUserAssociation.java | 581 | TestMultitenancyAPIHelper.plSignInUpEmail(new TenantIdentifier(null, "a1", "t2"), "user@example.com", | CODE |
| LOW⚡ | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 276 | JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1"); | CODE |
| LOW⚡ | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 277 | JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2"); | CODE |
| LOW⚡ | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 278 | JsonObject user3 = emailPasswordSignUp(t3, "user@example.com", "password3"); | CODE |
| LOW | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 401 | JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1"); | CODE |
| LOW | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 402 | JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2"); | CODE |
| LOW | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 443 | JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1"); | CODE |
| LOW | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 444 | JsonObject user2 = emailPasswordSignUp(t2, "user@example.com", "password2"); | CODE |
| LOW | …rtokens/test/userIdMapping/api/MultitenantAPITest.java | 487 | JsonObject user1 = emailPasswordSignUp(t1, "user@example.com", "password1"); | CODE |
| LOW | …io/supertokens/test/authRecipe/MultitenantAPITest.java | 202 | "user@example.com", | CODE |
| LOW | …io/supertokens/test/authRecipe/MultitenantAPITest.java | 231 | "user@example.com", | CODE |
| LOW | …io/supertokens/test/authRecipe/MultitenantAPITest.java | 302 | process.getProcess(), "google", "googleid1", "user@example.com"); | CODE |
| LOW | …io/supertokens/test/authRecipe/MultitenantAPITest.java | 314 | process.getProcess(), "facebook", "facebookid1", "user@example.com"); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 215 | EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com", "password1"); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 216 | EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com", "password2"); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 217 | EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com", "password3"); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 220 | AuthRecipeUserInfo userInfo = EmailPassword.signIn(t1, t1storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 222 | assertEquals("user@example.com", userInfo.loginMethods[0].email); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 226 | AuthRecipeUserInfo userInfo = EmailPassword.signIn(t2, t2storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 228 | assertEquals("user@example.com", userInfo.loginMethods[0].email); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 232 | AuthRecipeUserInfo userInfo = EmailPassword.signIn(t3, t3storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 234 | assertEquals("user@example.com", userInfo.loginMethods[0].email); | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 337 | AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 339 | AuthRecipeUserInfo user2 = EmailPassword.signUp(t2, t2storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 341 | AuthRecipeUserInfo user3 = EmailPassword.signUp(t3, t3storage, process.getProcess(), "user@example.com", | CODE |
| LOW⚡ | …s/test/emailpassword/MultitenantEmailPasswordTest.java | 392 | AuthRecipeUserInfo user1 = EmailPassword.signUp(t1, t1storage, process.getProcess(), "user@example.com", | CODE |
| 71 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | devConfig.yaml | 1 | # Config for SuperTokens service. Here you will set the config params for | COMMENT |
| LOW | devConfig.yaml | 21 | # access_token_validity: | COMMENT |
| LOW | devConfig.yaml | 41 | COMMENT | |
| LOW | devConfig.yaml | 61 | COMMENT | |
| LOW | devConfig.yaml | 81 | # (DIFFERENT_ACROSS_TENANTS | OPTIONAL | Default: 5) integer value. The maximum number of invalid TOTP attempts that | COMMENT |
| LOW | devConfig.yaml | 101 | # (OPTIONAL | Default: 10) integer value. Sets the max thread pool size for incoming http server requests. | COMMENT |
| LOW | devConfig.yaml | 121 | # password_hashing_alg: | COMMENT |
| LOW | devConfig.yaml | 141 | COMMENT | |
| LOW | devConfig.yaml | 161 | COMMENT | |
| LOW | devConfig.yaml | 181 | # service. | COMMENT |
| LOW | devConfig.yaml | 201 | # bulk_migration_batch_size: | COMMENT |
| LOW | devConfig.yaml | 221 | # (OPTIONAL | Default: https://saml.supertokens.com) string value. Service provider's entity ID. | COMMENT |
| LOW | config.yaml | 1 | # Config for SuperTokens service. Here you will set the config params for | COMMENT |
| LOW | config.yaml | 21 | # access_token_validity: | COMMENT |
| LOW | config.yaml | 41 | # (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: 144000) double value. Time in mins for how long a refresh token is valid | COMMENT |
| LOW | config.yaml | 61 | COMMENT | |
| LOW | config.yaml | 81 | # will trigger rate limiting. | COMMENT |
| LOW | config.yaml | 101 | # max_server_pool_size: | COMMENT |
| LOW | config.yaml | 121 | COMMENT | |
| LOW | config.yaml | 141 | # (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). The signer key used for firebase scrypt password hashing | COMMENT |
| LOW | config.yaml | 161 | # (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). This is used when the core needs to assume a specific CDI version | COMMENT |
| LOW | config.yaml | 181 | # (OPTIONAL | Default: null) string value. If specified, the core uses this URL to connect to the OAuth provider admin | COMMENT |
| LOW | config.yaml | 201 | # specified number of users for migrating in one single batch. | COMMENT |
| LOW | config.yaml | 221 | COMMENT | |
| LOW | stress-tests/src/common/utils.ts | 381 | // apart from pathological scaling. The read-path steps are therefore measured | COMMENT |
| LOW | stress-tests/src/common/migrationMode.ts | 1 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | stress-tests/src/oneMillionUsers/pgStatStatements.ts | 1 | import { Client } from 'pg'; | COMMENT |
| LOW | stress-tests/src/oneMillionUsers/index.ts | 241 | COMMENT | |
| LOW | stress-tests/src/oneMillionUsers/oauthPaths.ts | 21 | // the OAuth-dependent paths, so they land in the same summary table / ratio / | COMMENT |
| LOW | test-data/playground/src/setupTests.js | 1 | // jest-dom adds custom jest matchers for asserting on DOM nodes. | COMMENT |
| LOW | ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java | 201 | COMMENT | |
| LOW | ee/src/main/java/io/supertokens/ee/EEFeatureFlag.java | 321 | // if (!usesAccountLinking) { | COMMENT |
| LOW | .github/workflows/backport.yml | 1 | # Backports one or more commits onto older release branches by cherry-pick and | COMMENT |
| LOW | src/test/java/io/supertokens/test/PluginTest.java | 201 | // String installDir = "../"; | COMMENT |
| LOW | src/test/java/io/supertokens/test/PluginTest.java | 221 | // process.kill(); | COMMENT |
| LOW | …est/java/io/supertokens/test/multitenant/LoadTest.java | 101 | } | COMMENT |
| LOW | …est/java/io/supertokens/test/multitenant/LoadTest.java | 121 | // assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED)); | COMMENT |
| LOW | …est/java/io/supertokens/test/multitenant/LoadTest.java | 141 | // for (ResourceDistributor.SingletonResource resource : map.values()) { | COMMENT |
| LOW | …n/java/io/supertokens/useridmapping/UserIdMapping.java | 281 | storageClasses.get(0).equals(EmailVerificationStorage.class.getName())) { | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 121 | + Config.getConfig(start).getRecipeUserAccountInfosTable() + "(app_id, recipe_user_id);"; | COMMENT |
| LOW | src/main/java/io/supertokens/authRecipe/AuthRecipe.java | 641 | String userIdToDeleteForAuthRecipe; | COMMENT |
| LOW | …ens/webserver/api/multitenancy/BaseCreateOrUpdate.java | 321 | // tenantConfig.coreConfig | COMMENT |
| LOW | …/main/java/io/supertokens/signingkeys/SigningKeys.java | 221 | // This function is synchronized because we only want a single function to clear (and refresh) the key cache. | COMMENT |
| LOW | src/main/java/io/supertokens/totp/Totp.java | 181 | private static void checkAndStoreCode(TenantIdentifier tenantIdentifier, Storage storage, Main main, | COMMENT |
| LOW | src/main/java/io/supertokens/totp/Totp.java | 201 | // 15 minutes, and totp_invalid_code_expiry is 5 minutes. | COMMENT |
| LOW | src/main/java/io/supertokens/emailpassword/User.java | 1 | ///* | COMMENT |
| LOW | src/main/java/io/supertokens/emailpassword/User.java | 21 | // | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/CUTOVER-PROCEDURE.md | 21 | ## Step 1: Deploy with `DUAL_WRITE_READ_OLD` | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 52 | ## Step 2: Run Backfill | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 81 | ## Step 3: Validate Data Consistency | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 116 | ## Step 4: Switch to `DUAL_WRITE_READ_NEW` | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 138 | ## Step 5: Monitor in Production | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 148 | ## Step 6: Switch to `MIGRATED` | COMMENT |
| LOW | docs/CUTOVER-PROCEDURE.md | 165 | ## Step 7: Drop Deprecated Tables (Future Release) | COMMENT |
| LOW | src/test/java/io/supertokens/test/saml/MockSAML.java | 90 | // NOTE: This class provides helpers to mimic a minimal SAML IdP for tests. | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 831 | // Step 1: Get all tenant/account combinations to insert | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 922 | // Step 1: Get all account info records to be inserted | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 945 | // Step 2: Check for conflicts | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 992 | // Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly added | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1055 | // Step 1: Get ALL account info records for the entire primary user group. | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1078 | // Step 2: Check for conflicts | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1122 | // Step 3: Insert new rows using INSERT OR IGNORE | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …n/java/io/supertokens/useridmapping/UserIdMapping.java | 523 | // we need to check if db is in A3 or A4. | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 572 | // now we need to check if the user can become primary by checking if there are conflicting account info | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 831 | // Step 1: Get all tenant/account combinations to insert | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 922 | // Step 1: Get all account info records to be inserted | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 945 | // Step 2: Check for conflicts | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 992 | // Step 3: Insert new rows using INSERT OR IGNORE; track if any row was newly added | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1055 | // Step 1: Get ALL account info records for the entire primary user group. | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1078 | // Step 2: Check for conflicts | COMMENT |
| LOW | …supertokens/inmemorydb/queries/AccountInfoQueries.java | 1122 | // Step 3: Insert new rows using INSERT OR IGNORE | COMMENT |
| LOW | …c/main/java/io/supertokens/webserver/RequestStats.java | 101 | // appIdentifier parameter is coming from the API request and hence we need to check if the app exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …supertokens/inmemorydb/queries/UserLockingQueries.java | 153 | // Build result list in the same order as requested, verifying all users were found | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | stress-tests/src/oneMillionUsers/pagination.ts | 149 | // and that comparison is robust to account-linking math. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | stress-tests/src/oneMillionUsers/generateUsers.ts | 51 | function createThirdPartyLoginMethod(email: string, tenantIds: string[]): LoginMethod { | CODE |
| LOW | stress-tests/src/oneMillionUsers/generateUsers.ts | 66 | function createPasswordlessLoginMethod( | CODE |
| LOW | stress-tests/src/oneMillionUsers/generateUsers.ts | 106 | function generateRandomPhoneNumber(): string { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …test/java/io/supertokens/test/totp/TOTPRecipeTest.java | 60 | // TODO: Add test for UsedCodeAlreadyExistsException once we implement time mocking | COMMENT |