Self-hosted AI gateway for multi-channel, multi-credential setups — API keys and subscription accounts, scheduling, failover, request logs and usage. 自托管 AI 网关:多渠道多凭据统一接入,含密钥与订阅账号、调度容错、日志与用量。
This report summarizes scanner evidence for tbphp/gpt-load, a Go project with 7,191 GitHub stars. SynthScan examined 511,630 lines of code across 2097 source files, recording 281 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 0.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 246 finding(s).
Are imports declared and package/API names verified? 30 finding(s).
Are wrappers, guards, and repeated structures necessary? 222 finding(s).
Which changes need focused human review? 281 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 281 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/src/frontends/classic/app/route-locations.ts | 18 | function validateSharedPageRouteNames(): void { | CODE |
| LOW | web/src/frontends/classic/app/unsaved-changes.ts | 22 | export function createUnsavedChangesController(): UnsavedChangesController { | CODE |
| LOW | web/src/frontends/classic/app/unsaved-changes.ts | 100 | export function useUnsavedChangesController(): UnsavedChangesController { | CODE |
| LOW⚡ | web/src/frontends/classic/app/route-query.ts | 9 | export function parsePositiveRouteInteger(value: LocationQuery[string]): number | undefined { | CODE |
| LOW⚡ | web/src/frontends/classic/app/route-query.ts | 16 | export function normalizeCollectionSearch(value: string | undefined): string | undefined { | CODE |
| LOW⚡ | web/src/frontends/classic/app/route-query.ts | 22 | export function constrainCollectionSearch(value: string | undefined): string | undefined { | CODE |
| LOW | web/src/frontends/classic/app/route-query.ts | 49 | export function parsePositiveRouteIntegerList(value: LocationQuery[string]): number[] { | CODE |
| LOW | web/src/frontends/classic/app/route-query.ts | 63 | export function serializePositiveRouteIntegerList(values: readonly number[]): string | undefined { | CODE |
| LOW | web/src/frontends/classic/app/query-keys.ts | 13 | export function normalizeGroupCollectionFilters( | CODE |
| LOW | web/src/frontends/classic/app/query-keys.ts | 28 | export function normalizeCredentialCollectionFilters( | CODE |
| LOW | web/src/frontends/classic/app/query-keys.ts | 41 | export function normalizeAccessKeyCollectionFilters( | CODE |
| LOW | web/src/frontends/classic/app/ephemeral-state.ts | 3 | export function registerEphemeralStateCleaner(cleaner: () => void): () => void { | CODE |
| LOW | web/src/frontends/classic/app/resources/model-prices.ts | 299 | export function projectModelPriceCollection(value: unknown): ModelPriceCollectionDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/model-prices.ts | 316 | export function normalizeModelPriceFilters(filters: ModelPriceFilters): ModelPriceFilters { | CODE |
| LOW | web/src/frontends/classic/app/resources/model-prices.ts | 353 | export function modelPriceCollectionQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/model-prices.ts | 429 | export function projectModelPriceMutationIssue( | CODE |
| LOW | web/src/frontends/classic/app/resources/request-logs.ts | 911 | export function requestLogDetailQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/usage.ts | 173 | function projectUsageDistributionAggregate(value: unknown): UsageDistributionAggregateDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/usage.ts | 347 | function projectDistributionMetricRecord( | CODE |
| LOW | …b/src/frontends/classic/app/resources/system-update.ts | 32 | function projectNonBlankTrimmedString(value: unknown): string { | CODE |
| LOW | web/src/frontends/classic/app/resources/projector.ts | 70 | export function projectNullableEpochMilliseconds(value: unknown): number | null { | CODE |
| LOW | web/src/frontends/classic/app/resources/projector.ts | 92 | export function projectNullableDecimalString(value: unknown): string | null { | CODE |
| LOW | …/src/frontends/classic/app/resources/client-catalog.ts | 89 | export function resolveDefaultReasoningLevel( | CODE |
| LOW | …c/frontends/classic/app/resources/credential-stages.ts | 168 | function projectCredentialImportBatch( | CODE |
| LOW | …c/frontends/classic/app/resources/credential-stages.ts | 240 | export async function beginCredentialAuthorization( | CODE |
| LOW | …c/frontends/classic/app/resources/credential-stages.ts | 255 | export async function completeCredentialAuthorization( | CODE |
| LOW | …c/frontends/classic/app/resources/credential-stages.ts | 271 | export async function pollCredentialDeviceAuthorization( | CODE |
| LOW | …c/frontends/classic/app/resources/credential-stages.ts | 363 | export async function inspectGroupCredentialConnection( | CODE |
| LOW | …rc/frontends/classic/app/resources/route-inspection.ts | 190 | function projectNullableNonBlankString(value: unknown): string | null { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 278 | export function readCredentialValidationData(value: unknown): CredentialValidationData | null { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 323 | function projectParameterJSONValue(value: unknown, depth = 0): ParameterJSONValue { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 341 | function projectParameterOverrideMatch(value: unknown): ParameterOverrideMatchDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 352 | function projectParameterOverrideRule(value: unknown): ParameterOverrideRuleDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 371 | function projectParameterOverrides(value: unknown): ParameterOverrideRuleDto[] { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 535 | function projectGroupCollectionSummary(value: unknown): GroupCollectionSummaryDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 550 | function projectGroupCollectionItem(value: unknown): GroupCollectionItemDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 574 | function projectGroupCollectionPagination(value: unknown): GroupCollectionPaginationDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 585 | function expectedGroupCollectionTotalPages(totalItems: number, pageSize: number): number { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 591 | function expectedGroupCollectionPageItems(pagination: GroupCollectionPaginationDto): number { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 673 | function projectCredentialImportResult(value: unknown): CredentialImportResult { | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 777 | export function groupCollectionQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 824 | export function groupSettingsQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 933 | export async function replaceGroupModelsResource( | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 958 | export async function invalidateGroupModelDependents( | CODE |
| LOW | web/src/frontends/classic/app/resources/groups.ts | 994 | export async function invalidateGroupSettingsDependents( | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 130 | function projectNonBlankTrimmedString(value: unknown): string { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 172 | export function projectAccessKeyCostLimitRule(value: unknown): AccessKeyCostLimitRuleDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 184 | export function projectAccessKeyCostLimitRuleStatus( | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 241 | export function projectAccessKeyCostLimitStatus(value: unknown): AccessKeyCostLimitStatusDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 311 | function projectAccessKeyCollectionSummary(value: unknown): AccessKeyCollectionSummaryDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 323 | function projectAccessKeyCollectionPagination(value: unknown): AccessKeyCollectionPaginationDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 334 | function expectedCollectionTotalPages(totalItems: number, pageSize: number): number { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 338 | function expectedCollectionPageItems(pagination: AccessKeyCollectionPaginationDto): number { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 355 | export function projectAccessKeyCollectionItem(value: unknown): AccessKeyCollectionItemDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 369 | export function projectAccessKeyCollection(value: unknown): AccessKeyCollectionResponseDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 437 | export function accessKeyCollectionQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/access-keys.ts | 450 | export function accessKeyOptionsQueryOptions( | CODE |
| LOW | web/src/frontends/classic/app/resources/health.ts | 263 | function projectExpiringResetCredit(value: unknown): HealthExpiringResetCreditDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/credentials.ts | 261 | function projectObservedWindowUsage(value: unknown): CredentialObservedWindowUsageDto { | CODE |
| LOW | web/src/frontends/classic/app/resources/credentials.ts | 291 | function projectCredentialJSONValue(value: unknown): unknown { | CODE |
| 157 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 76 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 76 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 250 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 250 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 424 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 424 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 591 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 591 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM | …embedded/modelcatalog/codex_client_models_0.164.0.json | 1408 | "instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ontends/classic/features/import/CredentialTextarea.vue | 145 | :placeholder="placeholder" | CODE |
| LOW | …src/frontends/classic/components/ui/AppSearchInput.vue | 65 | :placeholder="placeholder" | CODE |
| LOW | …b/src/frontends/classic/components/ui/AppTextInput.vue | 81 | :placeholder="placeholder" | CODE |
| LOW | web/src/frontends/classic/components/ui/AppCombobox.vue | 97 | :placeholder="placeholder" | CODE |
| LOW | …s/modern/features/groups/SubscriptionAuthorization.vue | 164 | :placeholder="placeholder" | CODE |
| LOW | internal/control/modern_credential_options_test.go | 103 | firstGroup, first := createHomeSubscriptionCredential(t, fixture, "legacy", "shared", "admin@example.com") | CODE |
| LOW | internal/control/modern_credential_options_test.go | 104 | secondGroup, second := createHomeSubscriptionCredential(t, fixture, "current", "shared", "admin@example.com") | CODE |
| LOW | internal/control/modern_credential_options_test.go | 154 | if option.Label != "admin@example.com" { | CODE |
| LOW | internal/control/modern_credential_options_test.go | 183 | if len(home.Items) != 4 || home.Items[0].Credential.Account.Email != "admin@example.com" || home.Items[0].GroupCount != | CODE |
| LOW | internal/control/credential_stages_test.go | 70 | "id_token":"id-secret","account_id":"account-123","email":"admin@example.com", | CODE |
| LOW | internal/control/credential_stages_test.go | 526 | AccountID: "account-123", Email: "admin@example.com", | CODE |
| LOW | internal/control/credential_stages_test.go | 584 | AccountID: "account-123", Email: "admin@example.com", | CODE |
| LOW | internal/control/credential_stages_test.go | 751 | `{"type":"codex","access_token":"access","refresh_token":"refresh","account_id":"account-123","email":"admin@example.c | CODE |
| LOW | internal/gateway/handler_test.go | 3738 | handler, manager, registry := newHandlerForTest(t, forwarder, "placeholder") | CODE |
| LOW | internal/gateway/handler_test.go | 4024 | handler, manager, registry := newHandlerForTest(t, forwarder, "placeholder") | CODE |
| LOW | internal/gateway/handler_test.go | 4109 | handler, manager, registry := newHandlerForTest(t, forwarder, "placeholder") | CODE |
| LOW | internal/gateway/handler_test.go | 4173 | handler, manager, registry := newHandlerForTest(t, forwarder, "placeholder") | CODE |
| LOW | third_party/cpaembedded/embedded/embedded_test.go | 30 | "email":"admin@example.com", | CODE |
| LOW | third_party/cpaembedded/embedded/embedded_test.go | 43 | if credential.AccountID != "account-123" || credential.Email != "admin@example.com" { | CODE |
| LOW | third_party/cpaembedded/embedded/embedded_test.go | 334 | Email: "admin@example.com", | CODE |
| LOW | third_party/cpaembedded/embedded/embedded_test.go | 345 | if credential.AccountID != "account-123" || credential.Email != "admin@example.com" { | CODE |
| LOW | third_party/cpaembedded/embedded/embedded_test.go | 872 | Email: "admin@example.com", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 76 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| LOW⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 76 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| MEDIUM⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 250 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| LOW⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 250 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| LOW⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 424 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| LOW⚡ | …embedded/modelcatalog/codex_client_models_0.164.0.json | 591 | "instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your | CODE |
| LOW | …embedded/modelcatalog/codex_client_models_0.164.0.json | 767 | "instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your | CODE |
| LOW | …embedded/modelcatalog/codex_client_models_0.164.0.json | 908 | "instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your | CODE |
| LOW | …embedded/modelcatalog/codex_client_models_0.164.0.json | 1045 | "instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your | CODE |
| LOW | …embedded/modelcatalog/codex_client_models_0.164.0.json | 1408 | "instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an | CODE |
| LOW | …embedded/modelcatalog/codex_client_models_0.164.0.json | 1533 | "instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …assic/features/settings/ExperimentalSettingsFields.vue | 75 | props.base.settings.request_audit_preset.rules.filter( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/release_runtime.py | 266 | '[{"index":0,"delta":{"content":"release-ok"},"finish_reason":null}]}\n\n' | CODE |
| HIGH | scripts/release_runtime.py | 284 | "if [ \"$length\" -gt 0 ]; then dd bs=1 count=\"$length\" of=/dev/null 2>/dev/null; fi\n" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/codexrecovery/doc.go | 1 | // Package codexrecovery implements failure-triggered OpenAI Responses | COMMENT |
| LOW | internal/codexrecovery/sanitize.go | 41 | COMMENT | |
| LOW | internal/catalog/official.go | 1 | package catalog | COMMENT |
| LOW | internal/subscription/passive_quota_flush.go | 21 | // FlushPassiveQuotaObservations persists up to one bounded batch of pending | COMMENT |
| LOW | internal/gateway/live_proxy.go | 1 | // Adapted from CLIProxyAPI v7.3.15 internal/client/codex/live/tcp_proxy.go. | COMMENT |
| LOW | .github/scripts/release-verify-assets.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/scripts/release-verify-image-revision.sh | 1 | #!/usr/bin/env bash | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …c/frontends/modern/features/home/GatewayConnection.vue | 85 | const mask = computed(() => key.value?.mask ?? 'YOUR_API_KEY') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/release_runtime.py | 128 | except Exception: | CODE |
| MEDIUM | scripts/release_runtime.py | 110 | def __enter__(self) -> "DockerDatabase": | CODE |
| LOW | scripts/release.py | 157 | except Exception as error: | CODE |
| LOW | scripts/release.py | 260 | except Exception as error: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/release_runtime.py | 77 | except (OSError, ValueError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/release_runtime.py | 3 | CODE | |
| LOW | scripts/release.py | 3 | CODE | |
| LOW | scripts/release_mini.py | 3 | CODE | |
| LOW | .github/scripts/release-compare-semver.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | internal/requestaudit/audit.go | 1 | // Package requestaudit implements experimental Jev guardrails without rewriting content. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/release-compare-semver.py | 17 | CODE |