Home / thumbor / thumbor
AI Slop Code RIsk Monitor

thumbor/thumbor

thumbor is an open-source photo thumbnail service by globo.com

5.2 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for thumbor/thumbor, a Python project with 10,518 GitHub stars. SynthScan examined 181,473 lines of code across 361 source files, recording 829 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 5.2 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.2
Adjusted Signal
5.2
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
10.5K
Stars
Python
Language
181.5K
Lines of Code
361
Files
829
Pattern Hits
2026-10-12
Scan Date
0.01
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 21.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 797 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 11 finding(s).

Agent Over-Engineering Ratio 20.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 771 finding(s).

PR Review Velocity Impact 21.4/100 · LOW

Which changes need focused human review? 829 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 2MEDIUM 4LOW 820

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 829 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers742 hits · 813 pts
SeverityFileLineSnippetContext
LOWintegration_tests/pil_test.py28 # def test_combined_params__with_pil(self):COMMENT
LOWtests/test_point.py17 def test_default_alignment_percentages(self):CODE
LOWtests/test_point.py26 def test_new_point_default_weight(self):CODE
LOW⚡tests/test_point.py57 def test_new_point_square_point(self):CODE
LOW⚡tests/test_point.py63 def test_aligned_point_center_middle(self):CODE
LOW⚡tests/test_point.py69 def test_aligned_point_top_left(self):CODE
LOW⚡tests/test_point.py75 def test_aligned_point_bottom_right(self):CODE
LOWtests/test_utils.py33 def test_can_get_content_type():CODE
LOW⚡tests/test_utils.py94 def test_logger_should_be_instance_of_python_logger():CODE
LOW⚡tests/test_utils.py98 def test_logger_should_not_be_null():CODE
LOW⚡tests/test_utils.py102 def test_logger_should_not_be_an_error():CODE
LOW⚡tests/test_utils.py106def test_get_color_space_handles_invalid_icc():CODE
LOW⚡tests/test_utils.py114def test_get_color_space_handles_null_xcolor_space(image_cms_profile_mock):CODE
LOW⚡tests/test_utils.py122def test_get_color_space_missing_imagecms_returns_none():CODE
LOW⚡tests/test_utils.py128def test_ensure_srgb_handles_invalid_icc():CODE
LOW⚡tests/test_utils.py135def test_ensure_srgb_missing_imagecms_runtimeerror():CODE
LOW⚡tests/test_utils.py142def test_ensure_srgb_keeps_existing_srgb_profile():CODE
LOW⚡tests/test_utils.py151def test_ensure_srgb_returns_none_for_unsupported_color_space(color_space):CODE
LOW⚡tests/test_utils.py159def test_ensure_srgb_returns_none_for_animated_cmyk():CODE
LOWtests/test_console.py18 def test_can_get_default_server_parameters(self):CODE
LOWtests/test_console.py29 def test_can_get_custom_server_parameters(self):CODE
LOWtests/test_console.py51 def test_keyfile_help_describes_the_security_key_file(self):CODE
LOWtests/test_url_composer.py45 def test_fails_when_no_config_or_key(self, load_mock, mock_stdout):CODE
LOWtests/test_url_composer.py74 def test_get_thumbor_params_with_crop(self):CODE
LOWtests/test_url_composer.py94 def test_get_thumbor_params_full_adaptive_fitin_false(self):CODE
LOWtests/test_url_composer.py116 def test_get_thumbor_params_full_adaptive_fitin(self):CODE
LOWtests/test_url_composer.py135 def test_get_thumbor_params_adaptive_fitin(self):CODE
LOWtests/test_url_composer.py154 def test_get_thumbor_params_full_fitin(self):CODE
LOWtests/test_url_composer.py173 def test_get_thumbor_params_fitin(self):CODE
LOWtests/test_url_composer.py212 def test_get_options_from_sys(self):CODE
LOWtests/test_url_composer.py233 def test_get_options_fails_when_no_url(self):CODE
LOWtests/test_signal_handler.py18 def test_setup_signal_handler_sets_handler(self, signal_mock):CODE
LOWtests/test_signal_handler.py31 def test_signal_handler_calls_add_callback_from_signal(self, ioloop_mock):CODE
LOWtests/test_doctor.py20def test_reports_module_load_failure(capsys, module_name, error_type):CODE
LOWtests/test_doctor.py44def test_format_error_indents_multiline_text():CODE
LOWtests/test_doctor.py60def test_doctor_finishes_when_cairo_library_is_missing(capsys):CODE
LOWtests/test_doctor.py96def test_get_doctor_output_no_config(capsys, doctor_output_no_config):CODE
LOWtests/test_importer.py38 def test_import_item_should_be_proper_item(self):CODE
LOWtests/test_importer.py67 def test_single_item_should_equal_file_storage():CODE
LOWtests/test_importer.py77 def test_multiple_items_can_be_imported():CODE
LOWtests/test_threadpool.py21async def test_can_get_threadpool_instance():CODE
LOWtests/test_threadpool.py36async def test_can_run_task_in_foreground():CODE
LOWtests/test_threadpool.py48async def test_can_run_task_in_foreground_and_exception_happens():CODE
LOWtests/test_threadpool.py61async def test_queueing_task_when_no_pool_runs_sync():CODE
LOWtests/test_threadpool.py73async def test_queueing_task_when_no_pool_runs_sync_and_exception_happens():CODE
LOWtests/test_threadpool.py99async def test_can_run_async_with_queue():CODE
LOW⚡tests/test_server.py103 def test_can_get_value_as_integer(self):CODE
LOW⚡tests/test_server.py109 def test_can_get_config_from_path(self):CODE
LOW⚡tests/test_server.py117 def test_can_get_config_with_env_enabled(self):CODE
LOW⚡tests/test_server.py141 def test_can_configure_log_from_dict_config(self, dict_config_mock):CODE
LOW⚡tests/test_server.py151 def test_can_import_default_modules(self):CODE
LOW⚡tests/test_server.py158 def test_can_import_with_custom_error_handler_class(self):CODE
LOW⚡tests/test_server.py202 def test_validate_config_validates_allowed_sizes(self, validation_mock):CODE
LOW⚡tests/test_server.py211 def test_validate_gifsicle_path(self, which_mock):CODE
LOW⚡tests/test_server.py221 def test_validate_null_gifsicle_path(self, which_mock):CODE
LOWtests/test_server.py36def fixture_server_without_unix_sockets(monkeypatch):CODE
LOWtests/test_server.py46def test_can_start_tcp_without_unix_sockets(server_without_unix_sockets):CODE
LOWtests/test_server.py59def test_can_use_fd_without_unix_sockets(CODE
LOWtests/test_server.py82def test_rejects_unavailable_unix_socket(server_without_unix_sockets):CODE
LOWtests/test_server.py128 def test_can_configure_log_from_config(self, basic_config_mock):CODE
682 more matches not shown…
Hallucination Indicators3 hits · 30 pts
SeverityFileLineSnippetContext
CRITICALthumbor/transformer.py188 self.context.modules.importer.error_handler.handle_error(CODE
CRITICALthumbor/handlers/__init__.py856 self.context.modules.importer.error_handler.handle_error(CODE
CRITICALthumbor/handlers/__init__.py1231 self.context.modules.importer.error_handler.handle_error(CODE
Excessive Try-Catch Wrapping19 hits · 21 pts
SeverityFileLineSnippetContext
LOWintegration_tests/urls_helpers.py149 except Exception as err: # pylint: disable=broad-exceptCODE
LOWthumbor/url_composer.py232 except Exception: # pylint: disable=broad-exceptCODE
LOWthumbor/utils.py34 except Exception:CODE
MEDIUMthumbor/utils.py31def _get_flag(flags, name):CODE
LOWthumbor/transformer.py182 except Exception: # pylint: disable=broad-exceptCODE
LOWthumbor/filters/watermark.py219 except Exception as error:CODE
LOWthumbor/filters/__init__.py233 except Exception:CODE
LOWthumbor/engines/gif.py157 except Exception:CODE
LOWthumbor/engines/__init__.py208 except Exception as error: # pylint: disable=broad-exceptCODE
LOWthumbor/engines/__init__.py283 except Exception as error:CODE
LOWthumbor/engines/__init__.py340 except Exception as error:CODE
LOWthumbor/engines/pil.py228 except Exception:CODE
MEDIUMthumbor/engines/pil.py147def create_image(self, buffer):CODE
LOWthumbor/detectors/feature_detector/__init__.py33 except Exception as error:CODE
LOWthumbor/handlers/__init__.py207 except Exception as error:CODE
LOWthumbor/handlers/__init__.py314 except Exception as error:CODE
LOWthumbor/handlers/__init__.py344 except Exception as error:CODE
LOWthumbor/handlers/__init__.py851 except Exception as error: # pylint: disable=broad-exceptCODE
LOWthumbor/handlers/__init__.py1170 except Exception as error:CODE
Deep Nesting18 hits · 17 pts
SeverityFileLineSnippetContext
LOWtests/handlers/test_animated_webp.py82CODE
LOWtests/handlers/test_gif_post_transform_filters.py76CODE
LOWtests/handlers/test_gif_post_transform_filters.py104CODE
LOWtests/handlers/test_gif_post_transform_filters.py148CODE
LOWthumbor/importer.py148CODE
LOWthumbor/url_composer.py169CODE
LOWthumbor/transformer.py131CODE
LOWthumbor/filters/watermark.py59CODE
LOWthumbor/filters/redeye.py35CODE
LOWthumbor/engines/__init__.py110CODE
LOWthumbor/engines/__init__.py300CODE
LOWthumbor/engines/pil.py354CODE
LOWthumbor/loaders/http_loader.py130CODE
LOWthumbor/loaders/http_loader.py185CODE
LOWthumbor/handlers/__init__.py368CODE
LOWthumbor/handlers/__init__.py521CODE
LOWthumbor/handlers/__init__.py744CODE
LOWthumbor/handlers/__init__.py785CODE
Redundant / Tautological Comments9 hits · 16 pts
SeverityFileLineSnippetContext
LOWthumbor/handlers/image_resource.py22 # Check if image existsCOMMENT
LOW⚡thumbor/handlers/image_resource.py50 # Check if image overwriting is allowedCOMMENT
LOW⚡thumbor/handlers/image_resource.py55 # Check if the image uploaded is validCOMMENT
LOW⚡thumbor/handlers/image_resource.py62 # Check if image deleting is allowedCOMMENT
LOW⚡thumbor/handlers/image_resource.py67 # Check if image existsCOMMENT
LOWthumbor/handlers/upload.py26 # Check if the image uploaded is a multipart/form-dataCOMMENT
LOWthumbor/handlers/upload.py39 # Check if the image uploaded is validCOMMENT
LOWthumbor/handlers/__init__.py1252 # Check if image is validCOMMENT
LOWthumbor/handlers/imaging.py42 # Check if an image with an uuid exists in storageCOMMENT
Over-Commented Block13 hits · 12 pts
SeverityFileLineSnippetContext
LOWtests/loaders/test_http_loader.py241class DummyAsyncHttpClientTestCase(TestCase):COMMENT
LOWdocs/conf.py1# -*- coding: utf-8 -*-COMMENT
LOWdocs/conf.py81# language = NoneCOMMENT
LOWdocs/conf.py101# unit titles (such as .. function::).COMMENT
LOWdocs/conf.py121# a list of builtin themes.COMMENT
LOWdocs/conf.py141# The name of an image file (within the static path) to use as favicon of theCOMMENT
LOWdocs/conf.py161# typographically correct entities.COMMENT
LOWdocs/conf.py181# html_show_sourcelink = TrueCOMMENT
LOWdocs/conf.py221 "manual",COMMENT
LOWdocs/conf.py281# How to display URL addresses: 'footnote', 'no', or 'inline'.COMMENT
LOWthumbor/url.py1# -*- coding: utf-8 -*-COMMENT
LOWthumbor/lib/__init__.py1# -*- coding: utf-8 -*-COMMENT
LOW.github/workflows/codeql-analysis.yml1# For most projects, this workflow file will not need changing; you simply needCOMMENT
Empty Error Handlers2 hits · 10 pts
SeverityFileLineSnippetContext
HIGHthumbor/detectors/feature_detector/__init__.py13except ImportError:CODE
HIGHthumbor/handlers/__init__.py1203except KeyError:CODE
Unused Imports8 hits · 8 pts
SeverityFileLineSnippetContext
LOWtests/conftest.py7CODE
LOWthumbor/url.py10CODE
LOWthumbor/doctor.py184CODE
LOWthumbor/doctor.py185CODE
LOWthumbor/compatibility/__init__.py10CODE
LOWthumbor/url_signers/__init__.py14CODE
LOWthumbor/detectors/__init__.py13CODE
LOWthumbor/detectors/__init__.py14CODE
AI Structural Patterns8 hits · 8 pts
SeverityFileLineSnippetContext
LOWtests/loaders/test_file_loader_http_fallback.py33CODE
LOWtests/loaders/test_file_loader_http_fallback.py44CODE
LOWthumbor/context.py255CODE
LOWthumbor/storages/mixed_storage.py77CODE
LOWthumbor/storages/mixed_storage.py82CODE
LOWthumbor/storages/mixed_storage.py87CODE
LOWthumbor/storages/mixed_storage.py92CODE
LOWthumbor/result_storages/file_storage.py120CODE
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtests/compatibility/legacy_file_result_storage.py10# This file is copied from legacy way of using thumbor result storages,COMMENT
MEDIUMdocs/conf.py6# This file is execfile()d with the current directory set to itsCOMMENT
Slop Phrases4 hits · 4 pts
SeverityFileLineSnippetContext
LOWtests/conftest.py185Don't forget to copy this log and add it to the description.CODE
LOWthumbor/doctor.py467 print_info("Don't forget to copy this log and add it to the description.")STRING
LOW.github/ISSUE_TEMPLATE/bug_report.yml12 ⚠️ Don't forget to **replace your `SECURITY_KEY`** in the config with aCODE
LOW.github/ISSUE_TEMPLATE/bug_report.yml61 Paste your `thumbor.conf` contents here. **Make sure to replace yourCODE
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
LOWthumbor/engines/pil.py427 # Can't simply set options['progressive'] to the valueCOMMENT