Repository Analysis

tailscale/tailscale

The easiest, most secure way to use WireGuard and 2FA.

2.5 Likely human-written View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of tailscale/tailscale, a Go project with 33,943 GitHub stars. SynthScan v2.0 examined 601,612 lines of code across 2517 source files, recording 1428 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 2.5 places this repository in the Likely human-written band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

2.5
Adjusted Score
2.5
Raw Score
100%
Time Factor
2026-07-14
Last Push
33.9K
Stars
Go
Language
601.6K
Lines of Code
2.5K
Files
1.4K
Pattern Hits
2026-07-14
Scan Date
0.00
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 10HIGH 2MEDIUM 22LOW 1394

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1428 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Over-Commented Block1343 hits · 1275 pts
SeverityFileLineSnippetContext
LOW.policy.yml1# Approval policy for this repository, enforced by policy-botCOMMENT
LOWbuild_docker.sh1#!/usr/bin/env shCOMMENT
LOWheader.txt1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWmisc/git_hook/git-hook.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWmisc/git_hook/githook/launcher.sh1#!/usr/bin/env bashCOMMENT
LOWprober/dns.go21 // Networks is the list of networks to resolve; if non-empty, it shouldCOMMENT
LOWprober/http.go21const maxHTTPBody = 4 << 20 // MiBCOMMENT
LOWprober/derp.go881COMMENT
LOWcmd/cloner/cloner.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/natc/natc.go261COMMENT
LOWcmd/vet/subtestnames/analyzer.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/vet/jsontags/analyzer.go41 var seenName, hasFormat boolCOMMENT
LOWcmd/vet/jsontags/analyzer.go81 // other than when the map or slice are empty.COMMENT
LOWcmd/vet/jsontags/report.go41 }COMMENT
LOWcmd/gitops-pusher/cache.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/k8s-nameserver/main.go41 defaultDNSConfigDir = "/config"COMMENT
LOWcmd/k8s-nameserver/main.go361 if err != nil {COMMENT
LOWcmd/derper/ace.go41 // to the bidirectional ts2021 Noise protocol.COMMENT
LOWcmd/sync-containers/main.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/containerboot/test_tailscale.sh1#!/usr/bin/env bashCOMMENT
LOWcmd/containerboot/main.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/containerboot/main.go21// Must be used together with TS_CLIENT_ID. If the value begins with "file:", it isCOMMENT
LOWcmd/containerboot/main.go41// destination defined by an IP.COMMENT
LOWcmd/containerboot/main.go61// logged in. If false (the default, for backwardsCOMMENT
LOWcmd/containerboot/main.go81// - TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR: if specified, a path to aCOMMENT
LOWcmd/containerboot/main.go101// cluster using the same hostname (in this case, the MagicDNS name of the ingress proxy)COMMENT
LOWcmd/containerboot/main.go921 }COMMENT
LOWcmd/jsonimports/format.go21// mustFormatFile formats a Go source file and adjust "json" imports.COMMENT
LOWcmd/jsonimports/jsonimports.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/jsonimports/jsonimports.go21// and "encoding/json/jsontext" into the standard libraryCOMMENT
LOWcmd/tsnet-proxy/tsnet-proxy.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/fbstatus/fbstatus.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/tl-longchain/tl-longchain.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/proxy-to-grafana/proxy-to-grafana.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/proxy-to-grafana/proxy-to-grafana.go21// whitelist = 127.0.0.1COMMENT
LOWcmd/tsconnect/wasmbuild/wasmbuild.go41// excluded via its ts_omit_ build tag (computed by [Tags]).COMMENT
LOWcmd/tta/wgserver_linux.go41// - addr: CIDR for the WG interface (e.g. "10.64.0.1/24")COMMENT
LOWcmd/tailscale/generate.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/tailscale/tsroutecheckjsonv0/tsroutecheck.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/tailscale/cli/up.go261// Fields output when `tailscale up --json` is used. Two JSON blocks will be output.COMMENT
LOWcmd/tailscale/cli/up.go401 warning = "netfilter=nodivert; add iptables calls to ts-* chains manually."COMMENT
LOWcmd/tailscale/cli/up.go981 upArgs upArgsTCOMMENT
LOWcmd/tailscale/cli/serve_legacy.go221// serve config types like proxy, path, and text.COMMENT
LOWcmd/tailscale/cli/file.go321COMMENT
LOWcmd/tailscale/cli/exitnode.go221// alphabetical order, by country, city and then by priority ifCOMMENT
LOWcmd/tailscale/cli/jsonoutput/dns.go41 // --accept-dns=false.COMMENT
LOWcmd/tailscale/cli/jsonoutput/tailnet-lock-log.go181 LastAUMHash string `json:"LastAUMHash,omitzero"`COMMENT
LOWcmd/tailscale/cli/jsonoutput/jsonoutput.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/testwrapper/testwrapper.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/testwrapper/testwrapper.go41// Per-test retry policy. See package doc comment.COMMENT
LOWcmd/netlogfmt/main.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/tsshd/tsshd.go1// Copyright (c) Tailscale Inc & contributorsCOMMENT
LOWcmd/k8s-operator/proxygroup_specs.go261 //COMMENT
LOWcmd/k8s-operator/operator.go301// runReconcilers starts the controller-runtime manager and registers theCOMMENT
LOWcmd/k8s-operator/operator.go781 log *zap.SugaredLoggerCOMMENT
LOWcmd/k8s-operator/operator.go801 // TODO (irbekrm): this setting does not respect the defaultCOMMENT
LOWcmd/k8s-operator/egress-pod-readiness.go41// every Pod has been recreated and is not yet added to endpoints.COMMENT
LOWcmd/k8s-operator/egress-pod-readiness.go61// EndpointSlices(egress-eps-reconciler), so the routing is not blocked on Pod's readiness.COMMENT
LOWcmd/k8s-operator/proxygroup.go221 // Our custom logic for ensuring minimum downtime ProxyGroup update rollouts relies on the local health checkCOMMENT
LOWcmd/k8s-operator/egress-services.go81}COMMENT
1283 more matches not shown…
Hallucination Indicators10 hits · 100 pts
SeverityFileLineSnippetContext
CRITICALcmd/k8s-operator/proxyclass.go186 if errs := metavalidation.ValidateLabels(pc.Spec.Metrics.ServiceMonitor.Labels.Parse(), field.NewPath(".spec.metrics.sCODE
CRITICALcmd/k8s-operator/sts_test.go189 wantSS.Spec.Template.Labels = proxyClassAllOpts.Spec.StatefulSet.Pod.Labels.Parse()CODE
CRITICALcmd/k8s-operator/sts_test.go223 wantSS.Spec.Template.Labels = proxyClassJustLabels.Spec.StatefulSet.Pod.Labels.Parse()CODE
CRITICALcmd/k8s-operator/sts_test.go235 wantSS.Spec.Template.Labels = proxyClassAllOpts.Spec.StatefulSet.Pod.Labels.Parse()CODE
CRITICALcmd/k8s-operator/sts_test.go262 wantSS.Spec.Template.Labels = proxyClassJustLabels.Spec.StatefulSet.Pod.Labels.Parse()CODE
CRITICALipn/ipnlocal/peerapi.go445 if hasCGNATInterface, err := h.ps.b.sys.NetMon.Get().HasCGNATInterface(); hasCGNATInterface {CODE
CRITICALipn/ipnlocal/peerapi_drive.go56 fs, ok := h.ps.b.sys.DriveForRemote.GetOK()CODE
CRITICALwgengine/magicsock/relaymanager.go111 if !r.wlb.ep.c.debugLogging.Load() {CODE
CRITICALwgengine/magicsock/relaymanager.go351 if !r.wlb.ep.c.debugLogging.Load() {CODE
CRITICALwgengine/magicsock/relaymanager.go415 sharedKey: work.wlb.ep.c.discoAtomic.Private().Shared(work.se.ServerDisco),CODE
AI Slop Vocabulary10 hits · 30 pts
SeverityFileLineSnippetContext
MEDIUMtailcfg/tailcfg.go175// - 126: 2025-09-17: Client uses seamless key renewal unless disabled by control (tailscale/corp#31479)COMMENT
MEDIUMutil/eventbus/debug.go33// deliberately withheld from bus clients to encourage more robust andCOMMENT
MEDIUMutil/winutil/restartmgr_windows.go149 // processes that utilize the binaries previously specified by calls toCOMMENT
MEDIUMutil/winutil/authenticode/authenticode_windows.go403 // 1. Subsequent API calls directly utilize the file's Win32 HANDLE;COMMENT
MEDIUMtstest/largetailnet/delta_test.go106 // are robust against interleaving (assuming no other test runs inCOMMENT
MEDIUMwgengine/magicsock/magicsock.go1255// should provide a mechanism for seamless rotation by supporting short term useCOMMENT
MEDIUMwgengine/magicsock/endpoint.go1919 // Prefer IPv6 for being a bit more robust, as long asCOMMENT
MEDIUM…ature/buildfeatures/feature_listenrawdisco_disabled.go10// HasListenRawDisco is whether the binary was built with support for modular feature "Use raw sockets for more robust dCOMMENT
MEDIUMfeature/buildfeatures/feature_listenrawdisco_enabled.go10// HasListenRawDisco is whether the binary was built with support for modular feature "Use raw sockets for more robust dCOMMENT
MEDIUMcontrol/tsp/map_test.go90 // the test robust if a server-side keepalive arrives mid-test.COMMENT
Fake / Example Data26 hits · 26 pts
SeverityFileLineSnippetContext
LOWcmd/tsconnect/build.go30 if err := cleanDir(*distDir, "placeholder"); err != nil {CODE
LOWcmd/tailscale/cli/netcheck_test.go82 cliAddress: "lorem ipsum",CODE
LOWcmd/tailscale/cli/netcheck_test.go84 wantError: `invalid bind address: "lorem ipsum"`,CODE
LOWcmd/hello/helloserver/helloserver.go86 LoginName string // "foo@bar.com"CODE
LOWcmd/k8s-operator/ingress-for-pg_test.go1012 corev1.TLSPrivateKeyKey: []byte("fake-key"),CODE
LOWcmd/k8s-operator/egress-eps_test.go40 ExternalName: "placeholder",CODE
LOWcmd/k8s-operator/egress-services_test.go78 ExternalName: "placeholder",CODE
LOWcmd/k8s-operator/e2e/proxygrouppolicy_test.go51 ExternalName: "placeholder",CODE
LOWipn/ipnlocal/diskcache_test.go30 LoginName: "user@example.com",CODE
LOWipn/ipnlocal/profiles_test.go1208 LoginName: "user@example.com",CODE
LOWipn/store/kubestore/store_kube_test.go286 testKey = "fake-key"CODE
LOWipn/store/kubestore/store_kube_test.go465 testKey = "fake-key"CODE
LOWipn/store/kubestore/store_kube_test.go642 testKey = "fake-key"CODE
LOWutil/deephash/tailscale_types_test.go168 {ID: 1, LoginName: "foo@bar.com"},CODE
LOWutil/dnsname/dnsname_test.go165 {"email", "admin@example.com", "admin-example-com"},CODE
LOWtempfork/acme/rfc8555_test.go287 const email = "mailto:user@example.org"CODE
LOWtempfork/acme/rfc8555_test.go365 const email = "mailto:user@example.org"CODE
LOWtempfork/acme/rfc8555_test.go513 const email = "mailto:user@example.org"CODE
LOWtempfork/acme/rfc8555_test.go647 const email = "mailto:user@example.org"CODE
LOWssh/tailssh/tailssh_test.go207 Principals: []*tailcfg.SSHPrincipal{{UserLogin: "foo@bar.com"}},CODE
LOWssh/tailssh/tailssh_test.go210 ci: &sshConnInfo{uprof: tailcfg.UserProfile{LoginName: "foo@bar.com"}},CODE
LOWssh/tailssh/auditd_linux_test.go47 message: `op=login hostname="test-host" exe="/usr/bin/tailscaled" ts_user="user@example.com" ts_node="node.tail-scalCODE
LOWk8s-operator/api-proxy/proxy_events_test.go73 LoginName: "user@example.com",CODE
LOWk8s-operator/api-proxy/proxy_events_test.go86 NodeUser: "user@example.com",CODE
LOWclient/web/web_test.go532 user := &tailcfg.UserProfile{LoginName: "user@example.com", ID: tailcfg.UserID(1)}CODE
LOWclient/web/web_test.go853 user := &tailcfg.UserProfile{LoginName: "user@example.com", ID: tailcfg.UserID(1)}CODE
Decorative Section Separators6 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUM.policy-tests.yml22 # ------------------------------------------------------------------COMMENT
MEDIUM.policy-tests.yml25 # ------------------------------------------------------------------COMMENT
MEDIUM.policy-tests.yml88 # ------------------------------------------------------------------COMMENT
MEDIUM.policy-tests.yml92 # ------------------------------------------------------------------COMMENT
MEDIUM.policy-tests.yml146 # ------------------------------------------------------------------COMMENT
MEDIUM.policy-tests.yml148 # ------------------------------------------------------------------COMMENT
Structural Annotation Overuse10 hits · 16 pts
SeverityFileLineSnippetContext
LOWcmd/containerboot/settings.go410// Step 1: run 'tailscaled'COMMENT
LOWcmd/containerboot/settings.go420// Step 1: run 'tailscaled'COMMENT
LOWutil/hashx/block512.go94 // NOTE: This method is carefully written to be inlineable.COMMENT
LOWutil/hashx/block512.go108 // NOTE: This method is carefully written to be inlineable.COMMENT
LOWutil/hashx/block512.go122 // NOTE: This method is carefully written to be inlineable.COMMENT
LOWutil/hashx/block512.go136 // NOTE: This method is carefully written to be inlineable.COMMENT
LOWscripts/installer.sh23 # Step 1: detect the current linux distro, version, and packaging system.COMMENT
LOWscripts/installer.sh422 # Step 2: having detected an OS we support, is it one of theCOMMENT
LOWscripts/installer.sh510 # Step 3: work out if we can run privileged commands, and if so,COMMENT
LOWscripts/installer.sh532 # Step 4: run the installation.COMMENT
Synthetic Comment Markers2 hits · 15 pts
SeverityFileLineSnippetContext
HIGHutil/winutil/winutil.go106// the calling executable as requested via opts. This should be called by anyCOMMENT
HIGHfeature/conn25/conn25.go585 // OK indicates that the mapping was created as requested.COMMENT
Verbosity Indicators7 hits · 12 pts
SeverityFileLineSnippetContext
LOWcmd/containerboot/settings.go410// Step 1: run 'tailscaled'COMMENT
LOWcmd/containerboot/settings.go420// Step 1: run 'tailscaled'COMMENT
LOWipn/ipnlocal/peerapi.go723 // we need to check if they're allowed access to the internet.COMMENT
LOWscripts/installer.sh23 # Step 1: detect the current linux distro, version, and packaging system.COMMENT
LOWscripts/installer.sh422 # Step 2: having detected an OS we support, is it one of theCOMMENT
LOWscripts/installer.sh510 # Step 3: work out if we can run privileged commands, and if so,COMMENT
LOWscripts/installer.sh532 # Step 4: run the installation.COMMENT
Example Usage Blocks6 hits · 9 pts
SeverityFileLineSnippetContext
LOWcmd/netlogfmt/main.go9// Example usage:COMMENT
LOWsafeweb/http.go47// # Example usageCOMMENT
LOWutil/must/must.go6// Example usage:COMMENT
LOWutil/ctxkey/key.go6// Example usage:COMMENT
LOWutil/ctxkey/key.go33// Example usage:COMMENT
LOWutil/ctxkey/key.go53// Example usage:COMMENT
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMcmd/k8s-operator/deploy/manifests/proxy.yaml1# This file is not a complete manifest, it's a skeleton that the operator embedsCOMMENT
MEDIUMcmd/k8s-operator/deploy/manifests/userspace-proxy.yaml1# This file is not a complete manifest, it's a skeleton that the operator embedsCOMMENT
MEDIUMtstest/integration/vms/nixos_test.go65 # Define the package (derivation) for Tailscale based on the binaries weCOMMENT
Excessive Try-Catch Wrapping2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMtstest/tailmac/Swift/Common/TailMacConfigHelper.swift117 print("Error binding virtual network client socket - \(String(cString: strerror(errno)))")CODE
MEDIUMtstest/tailmac/Swift/Common/TailMacConfigHelper.swift134 print("Error connecting to server socket \(serverSocket) - \(String(cString: strerror(errno)))")CODE
Slop Phrases1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMbuild_docker.sh10# If you want to build local images for testing, you can use make, which provides few convenience wrappers around this sCOMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWcmd/tailscale/cli/dns.go31 // TODO: implement `tailscale log` hereCOMMENT
Hyper-Verbose Identifiers1 hit · 1 pts
SeverityFileLineSnippetContext
LOWclient/web/src/components/update-available.tsx10export function UpdateAvailableNotification({CODE