2.6

Adjusted Signal

2.6

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

38.4K

Stars

Language

698.4K

Lines of Code

2.9K

Files

1.7K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1670 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 42 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 9 finding(s).

PR Review Velocity Impact 12.5/100 · LOW

Which changes need focused human review? 1720 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 10HIGH 2MEDIUM 24LOW 1684

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1720 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1622 hits · 1560 pts

Severity	File	Line	Snippet	Context
LOW	.policy.yml	1	# Approval policy for this repository, enforced by policy-bot	COMMENT
LOW	build_docker.sh	1	#!/usr/bin/env sh	COMMENT
LOW	header.txt	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	misc/bumpdeps/bumpdeps.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	misc/bumpdeps/bumpdeps.go	21	// - "wireguard-go" and "gvisor" are aliases for the modules of the same	COMMENT
LOW	misc/bumpdeps/bumpdeps.go	41	// rollback commit, not an unattended bump.	COMMENT
LOW	misc/bumpdeps/bumpdeps.go	61	// release declares a different module path (renamed projects).	COMMENT
LOW	misc/git_hook/git-hook.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	misc/git_hook/githook/launcher.sh	1	#!/usr/bin/env bash	COMMENT
LOW	misc/git_hook/githook/largefiles.go	21		COMMENT
LOW	misc/git_hook/githook/pre-push.go	21	WatchedRemotes []string	COMMENT
LOW	prober/dns.go	21	// Networks is the list of networks to resolve; if non-empty, it should	COMMENT
LOW	prober/prober_test.go	341	# TYPE probe_interval_secs gauge	COMMENT
LOW	prober/http.go	21	const maxHTTPBody = 4 << 20 // MiB	COMMENT
LOW	prober/derp.go	881	return runDerpProbeNodePair(ctx, from, to, fromc, toc, size)	COMMENT
LOW	cmd/cloner/cloner.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/natc/natc.go	261		COMMENT
LOW	cmd/mkversion/mkversion.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/vet/subtestnames/analyzer.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/vet/jsontags/analyzer.go	41	var seenName bool	COMMENT
LOW	cmd/vet/jsontags/analyzer.go	81	// other than when the map or slice are empty.	COMMENT
LOW	cmd/vet/jsontags/analyzer.go	101	// This operates the same under both v1 and v2 so long as	COMMENT
LOW	cmd/vet/jsontags/report.go	41	}	COMMENT
LOW	cmd/gitops-pusher/cache.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/k8s-nameserver/main.go	41	defaultDNSConfigDir = "/config"	COMMENT
LOW	cmd/k8s-nameserver/main.go	361	if err != nil {	COMMENT
LOW	cmd/derper/ace.go	41	// to the bidirectional ts2021 Noise protocol.	COMMENT
LOW	cmd/derper/ipcert.go	41	// TLS certificates for the server's IP addresses on demand, using the	COMMENT
LOW	cmd/sync-containers/main.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/containerboot/test_tailscale.sh	1	#!/usr/bin/env bash	COMMENT
LOW	cmd/containerboot/main.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/containerboot/main.go	21	// Must be used together with TS_CLIENT_ID. If the value begins with "file:", it is	COMMENT
LOW	cmd/containerboot/main.go	41	// destination defined by an IP.	COMMENT
LOW	cmd/containerboot/main.go	61	// logged in. If false (the default, for backwards	COMMENT
LOW	cmd/containerboot/main.go	81	// - TS_EXPERIMENTAL_VERSIONED_CONFIG_DIR: if specified, a path to a	COMMENT
LOW	cmd/containerboot/main.go	101	// cluster using the same hostname (in this case, the MagicDNS name of the ingress proxy)	COMMENT
LOW	cmd/containerboot/main.go	961	// the first time they become available).	COMMENT
LOW	cmd/containerboot/main_test.go	1421	if strings.HasSuffix(line, " "+want) {	COMMENT
LOW	cmd/jsonimports/format.go	21	// mustFormatFile formats a Go source file and adjust "json" imports.	COMMENT
LOW	cmd/jsonimports/jsonimports.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/jsonimports/jsonimports.go	21	// and "encoding/json/jsontext" into the standard library	COMMENT
LOW	cmd/tsnet-proxy/tsnet-proxy.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/fbstatus/fbstatus.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/tl-longchain/tl-longchain.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/proxy-to-grafana/proxy-to-grafana.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/proxy-to-grafana/proxy-to-grafana.go	21	// whitelist = 127.0.0.1	COMMENT
LOW	cmd/tsconnect/wasmbuild/wasmbuild.go	21		COMMENT
LOW	cmd/tsconnect/wasmbuild/wasmbuild.go	41	// - "drive", "taildrop", "peerapi*": no local filesystem.	COMMENT
LOW	cmd/tsconnect/wasmbuild/wasmbuild.go	101	// ts_omit_<feature> for every entry in [featuretags.Features] that is	COMMENT
LOW	cmd/tta/wgserver_linux.go	41	// - addr: CIDR for the WG interface (e.g. "10.64.0.1/24")	COMMENT
LOW	cmd/tta/tta.go	641	var addFirewall func() error // set by fw_linux.go	COMMENT
LOW	cmd/tailscale/generate.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/tailscale/tsroutecheckjsonv0/tsroutecheck.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
LOW	cmd/tailscale/cli/up.go	261	var upArgsGlobal upArgsT	COMMENT
LOW	cmd/tailscale/cli/up.go	721	go func() {	COMMENT
LOW	cmd/tailscale/cli/serve_legacy.go	221		COMMENT
LOW	cmd/tailscale/cli/serve_legacy.go	781	// flow to enable a feature, such as Funnel, on their tailnet.	COMMENT
LOW	cmd/tailscale/cli/file.go	321		COMMENT
LOW	cmd/tailscale/cli/exitnode.go	221	// filterFormatAndSortExitNodes filters and sorts exit nodes into	COMMENT
LOW	cmd/tailscale/jsonoutput/jsonoutput.go	1	// Copyright (c) Tailscale Inc & contributors	COMMENT
1562 more matches not shown…

Hallucination Indicators10 hits · 100 pts

Severity	File	Line	Snippet	Context
CRITICAL	cmd/k8s-operator/sts_test.go	189	wantSS.Spec.Template.Labels = proxyClassAllOpts.Spec.StatefulSet.Pod.Labels.Parse()	CODE
CRITICAL	cmd/k8s-operator/sts_test.go	223	wantSS.Spec.Template.Labels = proxyClassJustLabels.Spec.StatefulSet.Pod.Labels.Parse()	CODE
CRITICAL	cmd/k8s-operator/sts_test.go	235	wantSS.Spec.Template.Labels = proxyClassAllOpts.Spec.StatefulSet.Pod.Labels.Parse()	CODE
CRITICAL	cmd/k8s-operator/sts_test.go	262	wantSS.Spec.Template.Labels = proxyClassJustLabels.Spec.StatefulSet.Pod.Labels.Parse()	CODE
CRITICAL	ipn/ipnlocal/peerapi.go	484	if hasCGNATInterface, err := h.ps.b.sys.NetMon.Get().HasCGNATInterface(); hasCGNATInterface {	CODE
CRITICAL	ipn/ipnlocal/peerapi_drive.go	56	fs, ok := h.ps.b.sys.DriveForRemote.GetOK()	CODE
CRITICAL	wgengine/magicsock/relaymanager.go	111	if !r.wlb.ep.c.debugLogging.Load() {	CODE
CRITICAL	wgengine/magicsock/relaymanager.go	351	if !r.wlb.ep.c.debugLogging.Load() {	CODE
CRITICAL	wgengine/magicsock/relaymanager.go	415	sharedKey: work.wlb.ep.c.discoAtomic.Private().Shared(work.se.ServerDisco),	CODE
CRITICAL	k8s-operator/reconciler/proxyclass/proxyclass.go	250	if errs := metavalidation.ValidateLabels(pc.Spec.Metrics.ServiceMonitor.Labels.Parse(), field.NewPath(".spec.metrics.s	CODE

AI Slop Vocabulary11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	tailcfg/tailcfg.go	177	// - 126: 2025-09-17: Client uses seamless key renewal unless disabled by control (tailscale/corp#31479)	COMMENT
MEDIUM	util/eventbus/debug.go	33	// deliberately withheld from bus clients to encourage more robust and	COMMENT
MEDIUM	util/winutil/restartmgr_windows.go	149	// processes that utilize the binaries previously specified by calls to	COMMENT
MEDIUM	util/winutil/authenticode/authenticode_windows.go	403	// 1. Subsequent API calls directly utilize the file's Win32 HANDLE;	COMMENT
MEDIUM	tstest/largetailnet/delta_test.go	111	// are robust against interleaving (assuming no other test runs in	COMMENT
MEDIUM	wgengine/wgcfg/mem_notios.go	24	// when head I/O ops utilize segmentation offloading, where a single head I/O	COMMENT
MEDIUM	wgengine/magicsock/magicsock.go	1267	// should provide a mechanism for seamless rotation by supporting short term use	COMMENT
MEDIUM	wgengine/magicsock/endpoint.go	2128	// Prefer IPv6 for being a bit more robust, as long as	COMMENT
MEDIUM	…ature/buildfeatures/feature_listenrawdisco_disabled.go	10	// HasListenRawDisco is whether the binary was built with support for modular feature "Use raw sockets for more robust d	COMMENT
MEDIUM	feature/buildfeatures/feature_listenrawdisco_enabled.go	10	// HasListenRawDisco is whether the binary was built with support for modular feature "Use raw sockets for more robust d	COMMENT
MEDIUM	control/tsp/map_test.go	91	// the test robust if a server-side keepalive arrives mid-test.	COMMENT

Fake / Example Data32 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	cmd/tsconnect/build.go	30	if err := cleanDir(*distDir, "placeholder"); err != nil {	CODE
LOW	cmd/tailscale/cli/netcheck_test.go	82	cliAddress: "lorem ipsum",	CODE
LOW	cmd/tailscale/cli/netcheck_test.go	84	wantError: `invalid bind address: "lorem ipsum"`,	CODE
LOW	cmd/hello/helloserver/helloserver.go	87	LoginName string // "foo@bar.com"	CODE
LOW	cmd/k8s-operator/ingress-for-pg_test.go	1012	corev1.TLSPrivateKeyKey: []byte("fake-key"),	CODE
LOW	cmd/k8s-operator/egress-eps_test.go	40	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/egress-eps_test.go	256	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/egress-services_test.go	83	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/egress-services_test.go	374	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/egress-services_test.go	510	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/e2e/egress_test.go	210	ExternalName: "placeholder",	CODE
LOW	cmd/k8s-operator/e2e/proxygrouppolicy_test.go	60	ExternalName: "placeholder",	CODE
LOW	ipn/ipnlocal/diskcache_test.go	30	LoginName: "user@example.com",	CODE
LOW	ipn/ipnlocal/profiles_test.go	1208	LoginName: "user@example.com",	CODE
LOW	ipn/store/kubestore/store_kube_test.go	287	testKey = "fake-key"	CODE
LOW	ipn/store/kubestore/store_kube_test.go	465	testKey = "fake-key"	CODE
LOW	ipn/store/kubestore/store_kube_test.go	642	testKey = "fake-key"	CODE
LOW	util/deephash/tailscale_types_test.go	163	{ID: 1, LoginName: "foo@bar.com"},	CODE
LOW	util/dnsname/dnsname_test.go	188	{"email", "admin@example.com", "admin-example-com"},	CODE
LOW	tempfork/acme/rfc8555_test.go	363	const email = "mailto:user@example.org"	CODE
LOW	tempfork/acme/rfc8555_test.go	441	const email = "mailto:user@example.org"	CODE
LOW	tempfork/acme/rfc8555_test.go	589	const email = "mailto:user@example.org"	CODE
LOW	tempfork/acme/rfc8555_test.go	723	const email = "mailto:user@example.org"	CODE
LOW	ssh/tailssh/tailssh_test.go	203	Principals: []*tailcfg.SSHPrincipal{{UserLogin: "foo@bar.com"}},	CODE
LOW	ssh/tailssh/tailssh_test.go	206	ci: &sshConnInfo{uprof: tailcfg.UserProfile{LoginName: "foo@bar.com"}},	CODE
LOW	ssh/tailssh/auditd_linux_test.go	47	message: `op=login hostname="test-host" exe="/usr/bin/tailscaled" ts_user="user@example.com" ts_node="node.tail-scal	CODE
LOW	k8s-operator/api-proxy/proxy_events_test.go	74	LoginName: "user@example.com",	CODE
LOW	k8s-operator/api-proxy/proxy_events_test.go	87	NodeUser: "user@example.com",	CODE
LOW	client/systray/systray_linux_test.go	148	Name: "user@example.com",	CODE
LOW	client/web/web_test.go	557	user := &tailcfg.UserProfile{LoginName: "user@example.com", ID: tailcfg.UserID(1)}	CODE
LOW	client/web/web_test.go	878	user := &tailcfg.UserProfile{LoginName: "user@example.com", ID: tailcfg.UserID(1)}	CODE
LOW	control/controlclient/map_test.go	1003	{ID: 100, LoginName: "user@example.com"},	CODE

Structural Annotation Overuse12 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/containerboot/settings.go	425	// Step 1: run 'tailscaled'	COMMENT
LOW⚡	cmd/containerboot/settings.go	435	// Step 1: run 'tailscaled'	COMMENT
LOW	util/hashx/block512.go	94	// NOTE: This method is carefully written to be inlineable.	COMMENT
LOW	util/hashx/block512.go	108	// NOTE: This method is carefully written to be inlineable.	COMMENT
LOW	util/hashx/block512.go	122	// NOTE: This method is carefully written to be inlineable.	COMMENT
LOW	util/hashx/block512.go	136	// NOTE: This method is carefully written to be inlineable.	COMMENT
LOW	tstest/integration/netmapdelta_test.go	125	// Step 1: a full netmap in which the address belongs to oldOwner. Setting	COMMENT
LOW	tstest/integration/netmapdelta_test.go	167	// Step 2: one MapResponse that hands the address to n2 and removes	COMMENT
LOW	scripts/installer.sh	23	# Step 1: detect the current linux distro, version, and packaging system.	COMMENT
LOW	scripts/installer.sh	422	# Step 2: having detected an OS we support, is it one of the	COMMENT
LOW	scripts/installer.sh	510	# Step 3: work out if we can run privileged commands, and if so,	COMMENT
LOW	scripts/installer.sh	532	# Step 4: run the installation.	COMMENT

Decorative Section Separators6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	.policy-tests.yml	22	# ------------------------------------------------------------------	COMMENT
MEDIUM	.policy-tests.yml	25	# ------------------------------------------------------------------	COMMENT
MEDIUM	.policy-tests.yml	88	# ------------------------------------------------------------------	COMMENT
MEDIUM	.policy-tests.yml	92	# ------------------------------------------------------------------	COMMENT
MEDIUM	.policy-tests.yml	146	# ------------------------------------------------------------------	COMMENT
MEDIUM	.policy-tests.yml	148	# ------------------------------------------------------------------	COMMENT

Verbosity Indicators9 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/containerboot/settings.go	425	// Step 1: run 'tailscaled'	COMMENT
LOW⚡	cmd/containerboot/settings.go	435	// Step 1: run 'tailscaled'	COMMENT
LOW	ipn/ipnlocal/peerapi.go	818	// we need to check if they're allowed access to the internet.	COMMENT
LOW	tstest/integration/netmapdelta_test.go	125	// Step 1: a full netmap in which the address belongs to oldOwner. Setting	COMMENT
LOW	tstest/integration/netmapdelta_test.go	167	// Step 2: one MapResponse that hands the address to n2 and removes	COMMENT
LOW	scripts/installer.sh	23	# Step 1: detect the current linux distro, version, and packaging system.	COMMENT
LOW	scripts/installer.sh	422	# Step 2: having detected an OS we support, is it one of the	COMMENT
LOW	scripts/installer.sh	510	# Step 3: work out if we can run privileged commands, and if so,	COMMENT
LOW	scripts/installer.sh	532	# Step 4: run the installation.	COMMENT

Synthetic Comment Markers2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	util/winutil/winutil.go	106	// the calling executable as requested via opts. This should be called by any	COMMENT
HIGH	feature/conn25/conn25.go	680	// OK indicates that the mapping was created as requested.	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/tailscale/jsonoutput/jsonoutput.go	64	// # Defining a stable, versioned JSON format	COMMENT
MEDIUM	cmd/k8s-operator/deploy/manifests/proxy.yaml	1	# This file is not a complete manifest, it's a skeleton that the operator embeds	COMMENT
MEDIUM	cmd/k8s-operator/deploy/manifests/userspace-proxy.yaml	1	# This file is not a complete manifest, it's a skeleton that the operator embeds	COMMENT
MEDIUM	tstest/integration/vms/nixos_test.go	65	# Define the package (derivation) for Tailscale based on the binaries we	COMMENT

Example Usage Blocks7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	cmd/netlogfmt/main.go	9	// Example usage:	COMMENT
LOW	safeweb/http.go	47	// # Example usage	COMMENT
LOW	util/bufpool/pool.go	18	// Example usage:	COMMENT
LOW	util/must/must.go	6	// Example usage:	COMMENT
LOW	util/ctxkey/key.go	6	// Example usage:	COMMENT
LOW	util/ctxkey/key.go	33	// Example usage:	COMMENT
LOW	util/ctxkey/key.go	53	// Example usage:	COMMENT

Excessive Try-Catch Wrapping2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	tstest/tailmac/Swift/Common/TailMacConfigHelper.swift	117	print("Error binding virtual network client socket - \(String(cString: strerror(errno)))")	CODE
MEDIUM	tstest/tailmac/Swift/Common/TailMacConfigHelper.swift	134	print("Error connecting to server socket \(serverSocket) - \(String(cString: strerror(errno)))")	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	build_docker.sh	10	# If you want to build local images for testing, you can use make, which provides few convenience wrappers around this s	COMMENT

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	cmd/tailscale/cli/dns.go	31	// TODO: implement `tailscale log` here	COMMENT

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	client/web/src/components/update-available.tsx	10	export function UpdateAvailableNotification({	CODE

tailscale/tailscale

Open-Source Code Quality, Security and Technical Debt Review