Home / wallabag / wallabag
AI Slop Code RIsk Monitor

wallabag/wallabag

wallabag is a self hostable application for saving web pages: Save and classify articles. Read them later. Freely.

7.4 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for wallabag/wallabag, a PHP project with 13,006 GitHub stars. SynthScan examined 77,482 lines of code across 636 source files, recording 536 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 7.4 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

7.4
Adjusted Signal
7.4
Raw Pattern Score
100%
Time Factor
2026-10-07
Last Push
13.0K
Stars
PHP
Language
77.5K
Lines of Code
636
Files
536
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 30.4/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 526 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 10 finding(s).

Agent Over-Engineering Ratio 30.1/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 518 finding(s).

PR Review Velocity Impact 29.2/100 · MEDIUM

Which changes need focused human review? 536 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 536

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 536 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers518 hits · 554 pts
SeverityFileLineSnippetContext
LOWapp/AppKernel.php102 public function registerContainerConfiguration(LoaderInterface $loader): voidCODE
LOWapp/AppKernel.php134 private function triggerLegacyParametersDeprecationIfNeeded(): voidCODE
LOWapp/AppKernel.php143 private function loadLegacyParametersIfPresent(LoaderInterface $loader): boolCODE
LOWapp/AppKernel.php164 private function defineLegacySimpleEnvFallbacks(ContainerBuilder $container): voidCODE
LOWapp/AppKernel.php227 private function defineLegacyDatabaseUrlFallback(ContainerBuilder $container): voidCODE
LOWapp/AppKernel.php280 private function normalizeLegacyDatabaseParameters(ContainerBuilder $container): arrayCODE
LOWapp/AppKernel.php302 private function defineLegacyRedisUrlFallback(ContainerBuilder $container): voidCODE
LOWapp/AppKernel.php341 private function defineLegacyRabbitMqUrlFallback(ContainerBuilder $container): voidCODE
LOW…t/Form/DataTransformer/StringToListTransformerTest.php13 public function testTransformWithValidData($inputData, $expectedResult): voidCODE
LOW…t/Form/DataTransformer/StringToListTransformerTest.php33 public function testReverseTransformWithValidData($inputData, $expectedResult): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php16 public function testLoginIfRequiredNotRequired(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php41 public function testLoginIfRequiredWithNotLoggedInUser(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php73 public function testLoginIfRequiredLogsInWithResolvedSiteConfig(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php106 public function testLoginIfRequestedNotRequired(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php140 public function testLoginIfRequestedNotRequested(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php185 public function testLoginIfRequestedRequested(): voidCODE
LOWtests/unit/HttpClient/AuthenticatorTest.php233 public function testLoginIfRequestedRedirect(): voidCODE
LOWtests/unit/Tools/UtilsTest.php14 public function testCorrectWordsCountForDifferentLanguages($filename, $text, $expectedCount): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php28 public function testVoteReturnsAbstainForInvalidSubject(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php33 public function testVoteReturnsAbstainForInvalidAttribute(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php38 public function testVoteReturnsDeniedForUnauthenticatedView(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php45 public function testVoteReturnsGrantedForUnauthorizedUserView(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php54 public function testVoteReturnsGrantedForAuthorizedUserView(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php63 public function testVoteReturnsDeniedForUnauthenticatedEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php70 public function testVoteReturnsGrantedForUnauthorizedUserEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php79 public function testVoteReturnsGrantedForAuthorizedUserEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php88 public function testVoteReturnsDeniedForUnauthenticatedDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php95 public function testVoteReturnsGrantedForUnauthorizedUserDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/TagVoterTest.php104 public function testVoteReturnsGrantedForAuthorizedUserDelete(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php29 public function testVoteReturnsAbstainForInvalidSubject(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php34 public function testVoteReturnsAbstainForInvalidAttribute(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php39 public function testVoteReturnsDeniedForNonSuperAdminEdit(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php46 public function testVoteReturnsGrantedForSuperAdminEdit(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php53 public function testVoteReturnsDeniedForNonSuperAdminDelete(): voidCODE
LOW⚡…t/Security/Voter/IgnoreOriginInstanceRuleVoterTest.php60 public function testVoteReturnsGrantedForSuperAdminDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php28 public function testVoteReturnsAbstainForInvalidSubject(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php33 public function testVoteReturnsAbstainForInvalidAttribute(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php38 public function testVoteReturnsDeniedForNonSuperAdminEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php45 public function testVoteReturnsGrantedForSuperAdminEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php52 public function testVoteReturnsDeniedForSelfDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php60 public function testVoteReturnsDeniedForNonSuperAdminDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/UserVoterTest.php67 public function testVoteReturnsGrantedForSuperAdminDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/TaggingRuleVoterTest.php25 public function testVoteReturnsAbstainForInvalidSubject(): voidCODE
LOW⚡tests/unit/Security/Voter/TaggingRuleVoterTest.php30 public function testVoteReturnsAbstainForInvalidAttribute(): voidCODE
LOW⚡tests/unit/Security/Voter/TaggingRuleVoterTest.php35 public function testVoteReturnsDeniedForUnauthenticatedEdit(): voidCODE
LOW⚡tests/unit/Security/Voter/TaggingRuleVoterTest.php42 public function testVoteReturnsDeniedForOtherUserEdit(): voidCODE
LOWtests/unit/Security/Voter/TaggingRuleVoterTest.php55 public function testVoteReturnsGrantedForTaggingRuleUserEdit(): voidCODE
LOWtests/unit/Security/Voter/TaggingRuleVoterTest.php67 public function testVoteReturnsDeniedForUnauthenticatedDelete(): voidCODE
LOWtests/unit/Security/Voter/TaggingRuleVoterTest.php74 public function testVoteReturnsDeniedForOtherUserDelete(): voidCODE
LOWtests/unit/Security/Voter/TaggingRuleVoterTest.php87 public function testVoteReturnsGrantedForTaggingRuleUserDelete(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php28 public function testVoteReturnsAbstainForInvalidAttribute(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php33 public function testVoteReturnsAbstainForInvalidSubject(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php38 public function testVoteReturnsDeniedForInvalidUser(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php45 public function testVoteReturnsDeniedForNonUserListEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php52 public function testVoteReturnsGrantedForUserListEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php59 public function testVoteReturnsDeniedForNonUserCreateEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php66 public function testVoteReturnsGrantedForUserCreateEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php73 public function testVoteReturnsDeniedForNonUserEditEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php80 public function testVoteReturnsGrantedForUserEditEntries(): voidCODE
LOW⚡tests/unit/Security/Voter/MainVoterTest.php87 public function testVoteReturnsDeniedForNonUserExportEntries(): voidCODE
458 more matches not shown…
Fake / Example Data10 hits · 12 pts
SeverityFileLineSnippetContext
LOWtests/Tools/samples/latin.txt2Lorem ipsum dolor sit amet, pro vivendo oporteat pertinacia ei. Vim fabellas molestiae cu, vel nibh legimus ea, in qui aCODE
LOWtests/Tools/samples/latin.txt2Lorem ipsum dolor sit amet, pro vivendo oporteat pertinacia ei. Vim fabellas molestiae cu, vel nibh legimus ea, in qui aCODE
LOW⚡doc/content/user/errors_during_fetching.md139 <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut laboCODE
LOW⚡doc/content/user/errors_during_fetching.md139 <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut laboCODE
LOW⚡doc/content/user/errors_during_fetching.md146 <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut laboCODE
LOW⚡doc/content/user/errors_during_fetching.md146 <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut laboCODE
LOWsrc/Form/Type/EntryFilterType.php81 'placeholder' => 'yyyy-mm-dd',CODE
LOWsrc/Form/Type/EntryFilterType.php88 'placeholder' => 'yyyy-mm-dd',CODE
LOWsrc/Form/Type/RenameTagType.php19 'placeholder' => 'tag.rename.placeholder',CODE
LOWsrc/Form/Type/NewTagType.php23 'placeholder' => 'tag.new.placeholder',CODE
Over-Commented Block8 hits · 8 pts
SeverityFileLineSnippetContext
LOWcompose.yaml21 # https://github.com/moby/moby/issues/40881COMMENT
LOWcompose.yaml41 ports:COMMENT
LOWcompose.yaml61 # image: mariadb:10COMMENT
LOWapp/config/config_dev.yml61#doctrine:COMMENT
LOWtests/unit/Helper/ContentProxyTest.php941 * Starting with PHP 8.1 this test fails because the string with invalid character is detected as WINDOWS-1252 aCOMMENT
LOWtests/unit/Helper/ContentProxyTest.php961 // ->onlyMethods(['fetchContent'])COMMENT
LOWdoc/content/admin/installation/virtualhosts.md141 fastcgi_pass unix:/run/php/php7.0-fpm.sock;COMMENT
LOWsrc/Entity/Entry.php21 *COMMENT