Home / uber / NullAway
AI Slop Code RIsk Monitor

uber/NullAway

A tool to help eliminate NullPointerExceptions (NPEs) in your Java code with low build-time overhead

4.5 Low pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for uber/NullAway, a Java project with 4,119 GitHub stars. SynthScan examined 96,616 lines of code across 361 source files, recording 187 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 4.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

4.5
Adjusted Signal
4.5
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
4.1K
Stars
Java
Language
96.6K
Lines of Code
361
Files
187
Pattern Hits
2026-10-12
Scan Date
0.06
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 8.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 146 finding(s).

Hallucinated Dependency & Supply Chain Risk 8.6/100 · LOW

Are imports declared and package/API names verified? 18 finding(s).

Agent Over-Engineering Ratio 10.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 129 finding(s).

PR Review Velocity Impact 18.6/100 · LOW

Which changes need focused human review? 187 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 16HIGH 5MEDIUM 21LOW 145

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 187 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators16 hits · 172 pts
SeverityFileLineSnippetContext
CRITICAL⚡…om/uber/nullaway/jarinfer/DefinitelyDerefedParams.java71 "com.google.common.base.Preconditions.checkNotNull(Ljava/lang/Object;)Ljava/lang/Object;",CODE
CRITICAL⚡…om/uber/nullaway/jarinfer/DefinitelyDerefedParams.java76 .put("org.junit.jupiter.api.Assertions.assertNotNull(Ljava/lang/Object;)V", 0)CODE
CRITICAL⚡…om/uber/nullaway/jarinfer/DefinitelyDerefedParams.java78 "org.junit.jupiter.api.Assertions.assertNotNull(Ljava/lang/Object;Ljava/lang/String;)V",CODE
CRITICAL⚡…om/uber/nullaway/jarinfer/DefinitelyDerefedParams.java81 "org.junit.jupiter.api.Assertions.assertNotNull(Ljava/lang/Object;Ljava/util/function/Supplier<String>;)V"CODE
CRITICAL⚡…ay/src/test/java/com/uber/nullaway/FrameworkTests.java287 org.junit.jupiter.api.Assertions.assertNotNull(o3);STRING
CRITICAL⚡…ay/src/test/java/com/uber/nullaway/FrameworkTests.java289 org.junit.jupiter.api.Assertions.assertNotNull(o4, "Null!");STRING
CRITICAL⚡…ay/src/test/java/com/uber/nullaway/FrameworkTests.java291 org.junit.jupiter.api.Assertions.assertNotNull(o5, () -> "Null!");STRING
CRITICAL…ay/src/test/java/com/uber/nullaway/FrameworkTests.java396 if (!org.apache.commons.lang.StringUtils.isEmpty(s)) {STRING
CRITICAL…ay/src/test/java/com/uber/nullaway/FrameworkTests.java401 if (!org.apache.commons.lang3.StringUtils.isEmpty(t)) {STRING
CRITICAL…/src/test/java/com/uber/nullaway/SuppressionTests.java251 f.next.next.next.next.hashCode();STRING
CRITICAL…va/com/uber/nullaway/generics/TypeMetadataBuilder.java290 com.sun.tools.javac.util.List.from(typeArgs),CODE
CRITICAL…va/com/uber/nullaway/generics/TypeMetadataBuilder.java372 enclosingType, com.sun.tools.javac.util.List.from(typeArgs), baseType.tsym, metadata);CODE
CRITICAL…in/java/com/uber/nullaway/generics/GenericsChecks.java3112 return com.sun.tools.javac.util.List.from(types);CODE
CRITICAL⚡…/nullaway/generics/PreservedAnnotationTreeVisitor.java125 ? com.sun.tools.javac.util.List.from(CODE
CRITICAL⚡…/nullaway/generics/PreservedAnnotationTreeVisitor.java128 nullableType, com.sun.tools.javac.util.List.nil(), null)))CODE
CRITICAL⚡…/nullaway/generics/PreservedAnnotationTreeVisitor.java129 : com.sun.tools.javac.util.List.nil();CODE
Hyper-Verbose Identifiers106 hits · 128 pts
SeverityFileLineSnippetContext
LOW⚡…ay-suppression-remover/tests/test_file_modification.py41 def test_sole_checker_deletes_line(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py49 def test_multiple_checkers_keeps_others(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py58 def test_multiple_checkers_preserves_indentation(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py65 def test_multiple_checkers_preserves_exact_leading_and_trailing_whitespace(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py75 def test_three_checkers_keeps_two(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py84 def test_alt_suppression_removed(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py94 def test_multiline_annotation_deleted(self):CODE
LOW…ay-suppression-remover/tests/test_file_modification.py107 def test_multiline_annotation_preserves_layout_when_partial(self):CODE
LOW…ay-suppression-remover/tests/test_file_modification.py127 def test_multiline_annotation_preserves_layout_when_removing_last(self):CODE
LOW…ay-suppression-remover/tests/test_file_modification.py147 def test_multiline_annotation_preserves_layout_for_inline_values(self):CODE
LOW…ay-suppression-remover/tests/test_file_modification.py171 def test_multiline_annotation_preserves_newline_after_removed_value(self):CODE
LOW…ay-suppression-remover/tests/test_file_modification.py195 def test_multiline_annotation_does_not_introduce_trailing_whitespace(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py214 def test_no_annotations_to_remove(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py221 def test_removes_only_target_checker_from_pair(self):CODE
LOW⚡…ay-suppression-remover/tests/test_file_modification.py229 def test_line_numbers_outside_annotation_untouched(self):CODE
LOW…ay-suppression-remover/tests/test_project_and_build.py41 def test_settings_gradle_kts_in_cwd(self):CODE
LOW…ay-suppression-remover/tests/test_project_and_build.py51 def test_build_gradle_two_levels_up(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py73 def test_no_project_root_raises(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py82 def test_explicit_start_directory(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py92 def test_finds_java_files_under_src(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py101 def test_no_src_directory_returns_empty(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py107 def test_ignores_non_java_files(self):CODE
LOW…ay-suppression-remover/tests/test_project_and_build.py119 def test_finds_java_files_across_nested_modules(self):CODE
LOW…ay-suppression-remover/tests/test_project_and_build.py146 def test_module_scope_does_not_include_nested_modules(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py157 def test_discovers_main_and_test(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py166 def test_discovers_custom_source_sets(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py176 def test_skips_dirs_without_java_files(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py185 def test_no_src_dir_defaults_to_main(self):CODE
LOW⚡…ay-suppression-remover/tests/test_project_and_build.py192 def test_default_gradle_cmd_compiles_all_source_sets(self):CODE
LOW…-suppression-remover/tests/test_build_error_parsing.py51 def test_path_containing_spaces(self):CODE
LOW…-suppression-remover/tests/test_build_error_parsing.py79 def test_different_checker_not_matched(self):CODE
LOW…-suppression-remover/tests/test_build_error_parsing.py91 def test_checker_with_special_regex_chars(self):CODE
LOW…-suppression-remover/tests/test_build_error_parsing.py98 def test_does_not_match_partial_checker_name(self):CODE
LOW…ullaway-suppression-remover/tests/test_line_mapping.py56 def test_delete_multiple_lines(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py73 def test_annotation_immediately_above(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py79 def test_closest_preceding_wins(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py85 def test_following_annotation_within_lookahead(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py91 def test_following_annotation_outside_lookahead_ignored(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py97 def test_preceding_beats_equidistant_following(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py103 def test_out_of_range_line_returns_none(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py109 def test_empty_annotations_returns_none(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py113 def test_accounts_for_deleted_lines(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py119 def test_annotation_on_same_line_as_error(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py138 def test_no_outer_returns_none(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py143 def test_equal_start_line_not_counted_as_outer(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py153 def test_marks_all_unneeded_annotations(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py159 def test_already_needed_not_recounted(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py166 def test_all_already_needed_returns_zero(self):CODE
LOW⚡…ullaway-suppression-remover/tests/test_line_mapping.py173 def test_empty_list_returns_zero(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py57 def test_no_annotations_does_not_call_build(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py69 def test_annotation_removed_when_build_passes(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py88 def test_project_wide_run_processes_multiple_modules(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py119 def test_all_needed_restores_and_exits(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py145 def test_legacy_encoding_control_character_and_cr_line_endings(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py172 def test_legacy_encoding_preserves_bytes_through_restore_and_rewrite(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py199 def test_needed_kept_unnecessary_removed(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py237 def test_final_confirmation_succeeds_after_restoring_file(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py262 def test_final_confirmation_still_fails_restores_originals_and_exits(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py290 def test_unmapped_errors_do_not_crash(self):CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py314 def test_out_of_range_line_restores_all_suppressions_in_file(self):CODE
46 more matches not shown…
Decorative Section Separators18 hits · 63 pts
SeverityFileLineSnippetContext
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py377# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py379# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py542# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py544# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py551# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡…ay-suppression-remover/src/suppression_remover/core.py553# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py74# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py76# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py101# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py103# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py133# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py135# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py455# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py457# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py610# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py612# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py638# ---------------------------------------------------------------------------COMMENT
MEDIUM…ay-suppression-remover/src/suppression_remover/core.py640# ---------------------------------------------------------------------------COMMENT
Cross-File Repetition5 hits · 25 pts
SeverityFileLineSnippetContext
HIGH…st/java/com/uber/nullaway/TypeUseAnnotationsTests.java0package com.uber; import java.lang.annotation.elementtype; import java.lang.annotation.target; @target({elementtype.methSTRING
HIGH…away/src/test/java/com/uber/nullaway/VarargsTests.java0package com.uber; import java.lang.annotation.elementtype; import java.lang.annotation.target; @target({elementtype.methSTRING
HIGH…llaway/src/test/java/com/uber/nullaway/ArrayTests.java0package com.uber; import java.lang.annotation.elementtype; import java.lang.annotation.target; @target({elementtype.methSTRING
HIGH…ava/com/uber/nullaway/jspecify/JSpecifyArrayTests.java0package com.uber; import java.lang.annotation.elementtype; import java.lang.annotation.target; @target({elementtype.methSTRING
HIGH…a/com/uber/nullaway/jspecify/JSpecifyVarargsTests.java0package com.uber; import java.lang.annotation.elementtype; import java.lang.annotation.target; @target({elementtype.methSTRING
Over-Commented Block18 hits · 18 pts
SeverityFileLineSnippetContext
LOW…ay-suppression-remover/tests/test_file_modification.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOWscripts/nullaway-suppression-remover/tests/__init__.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…ay-suppression-remover/tests/test_project_and_build.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…-suppression-remover/tests/test_build_error_parsing.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…ullaway-suppression-remover/tests/test_line_mapping.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…llaway-suppression-remover/tests/test_orchestration.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOWscripts/nullaway-suppression-remover/tests/test_cli.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…y-suppression-remover/tests/test_annotation_parsing.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…laway-suppression-remover/tests/test_apply_removals.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…uppression-remover/src/suppression_remover/__init__.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…ay-suppression-remover/src/suppression_remover/core.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW…way-suppression-remover/src/suppression_remover/cli.py1# Copyright (c) 2026 Uber Technologies, Inc.COMMENT
LOW.github/workflows/renovate-config-lint.yml101 # global config and accepts options a repository config may not carry, such as onboarding.COMMENT
LOW…ava/com/uber/nullaway/jspecify/JSpecifyArrayTests.java541 @Nullable Integer[][] nullableElems2D,COMMENT
LOW…away/jspecify/GenericInferenceErrorReportingTests.java41 import org.jspecify.annotations.Nullable;COMMENT
LOW…away/jspecify/GenericInferenceErrorReportingTests.java81 // padding so that a misattributed diagnostic lands on an existing line (4)COMMENT
LOWnullaway/src/main/java/com/uber/nullaway/NullAway.java1941 handler.onMatchCompilationUnit(this, tree, stateForNewCompilationUnit);COMMENT
LOW…m/uber/nullaway/handlers/contract/ContractHandler.java361 // '@Contract("null -> true") boolean func(@Nullable Object v)'COMMENT
Verbosity Indicators6 hits · 8 pts
SeverityFileLineSnippetContext
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py717 # Step 1: Discover source files.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py724 # Step 2: Locate all @SuppressWarnings(checker) annotations.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py759 # Step 4: Build with all suppressions gone.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py766 # Step 5: Map each error back to the responsible annotation.COMMENT
LOW…ay-suppression-remover/src/suppression_remover/core.py742 # Step 3: Save originals; strip checker from ALL annotations (pass 1).COMMENT
LOWnullaway/src/main/java/com/uber/nullaway/NullAway.java907 // For a varargs position, we need to check if the array itself is @NullableCOMMENT
Deep Nesting8 hits · 6 pts
SeverityFileLineSnippetContext
LOWscripts/convert_line_helper_textblocks.py22CODE
LOWscripts/convert_line_helper_textblocks.py71CODE
LOWscripts/convert_line_helper_textblocks.py143CODE
LOW…llaway-suppression-remover/tests/test_orchestration.py402CODE
LOWscripts/nullaway-suppression-remover/tests/test_cli.py116CODE
LOW…ay-suppression-remover/src/suppression_remover/core.py217CODE
LOW…ay-suppression-remover/src/suppression_remover/core.py382CODE
LOW…ay-suppression-remover/src/suppression_remover/core.py645CODE
Structural Annotation Overuse5 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py717 # Step 1: Discover source files.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py724 # Step 2: Locate all @SuppressWarnings(checker) annotations.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py759 # Step 4: Build with all suppressions gone.COMMENT
LOW⚡…ay-suppression-remover/src/suppression_remover/core.py766 # Step 5: Map each error back to the responsible annotation.COMMENT
LOW…ay-suppression-remover/src/suppression_remover/core.py742 # Step 3: Save originals; strip checker from ALL annotations (pass 1).COMMENT
Self-Referential Comments2 hits · 5 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/jmh-benchmark.yml57 - name: Formatting Benchmark # Create a text file containing the benchmark resultsCODE
MEDIUM.github/workflows/gcloud_ssh.sh7# Define the variables for Google Cloud project, zone, username, and instanceCOMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM…java/com/uber/nullaway/jarinfer/BytecodeAnnotator.java251 // was SHA-256. Eventually we may need a more robust solution for other digest algorithms.COMMENT
Unused Imports2 hits · 2 pts
SeverityFileLineSnippetContext
LOWscripts/convert_line_helper_textblocks.py13CODE
LOW…y-suppression-remover/tests/test_annotation_parsing.py25CODE