3.8

Adjusted Signal

3.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

8.2K

Stars

Rust

Language

164.5K

Lines of Code

855

Files

452

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 373 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 23 finding(s).

Agent Over-Engineering Ratio 13.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 323 finding(s).

PR Review Velocity Impact 16.8/100 · LOW

Which changes need focused human review? 452 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 13MEDIUM 44LOW 395

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 452 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers265 hits · 258 pts

Severity	File	Line	Snippet	Context
LOW	tests/test_role_access_ends_sessions.py	54	def test_revoking_the_role_ends_the_session(	CODE
LOW	tests/test_role_access_ends_sessions.py	73	def test_an_expiring_role_ends_the_session(	CODE
LOW	tests/test_rdp_user_auth_otp.py	90	def test_otp_required_not_authorized_without_second_factor(	CODE
LOW	tests/test_ssh_approval_close.py	17	def test_client_disconnect_clears_the_pending_approval(	CODE
LOW	tests/test_ssh_approval_close.py	37	def test_target_is_not_reached_before_approval(	CODE
LOW	tests/test_ssh_approval_close.py	67	def test_a_second_channel_shares_the_approved_connection(	CODE
LOW	tests/test_ssh_approval_close.py	140	def test_an_exec_through_the_gate_is_recorded(	CODE
LOW	tests/test_ssh_approval_close.py	181	def test_many_channels_on_a_held_connection(	CODE
LOW	tests/test_ssh_approval_close.py	241	def test_a_held_session_outlives_the_inactivity_timeout(	CODE
LOW	tests/test_ssh_approval_close.py	277	def test_admin_can_close_a_session_waiting_for_approval(	CODE
LOW	tests/test_ssh_approval_close.py	361	def _assert_request_disappears(url, user, target):	CODE
LOW	tests/test_ssh_target_handshake_timeout.py	34	def test_silent_target_fails_instead_of_hanging(	CODE
LOW	tests/test_ssh_target_handshake_timeout.py	91	def test_host_key_prompt_is_not_interrupted(	CODE
LOW	tests/test_cluster_otp_login.py	14	def test_cross_node_otp_login(	CODE
LOW	tests/test_role_expiry.py	102	def test_grant_role_with_future_expiry_allows_access(	CODE
LOW	tests/test_role_expiry.py	130	def test_expired_role_denies_access(	CODE
LOW	tests/test_role_expiry.py	163	def test_reenable_expired_role_restores_access(	CODE
LOW	tests/test_role_expiry.py	213	def test_remove_expiry_makes_permanent(	CODE
LOW	tests/test_role_expiry.py	254	def test_revoked_role_denies_access(	CODE
LOW	tests/test_role_expiry.py	280	def test_reactivate_revoked_role_via_update_expiry(	CODE
LOW	tests/test_role_expiry.py	315	def test_reactivate_revoked_role_via_remove_expiry(	CODE
LOW	tests/test_role_expiry.py	346	def test_get_user_roles_returns_all_states(	CODE
LOW	tests/test_ip_restrictions.py	53	def test_login_honours_forwarded_client_ip(ip_restricted_user):	CODE
LOW	tests/test_ip_restrictions.py	65	def test_api_token_is_bound_to_the_users_allowed_ranges(ip_restricted_user):	CODE
LOW	tests/conftest.py	1346	def wait_rdp_session_authorized(api, username, timeout):	CODE
LOW	tests/test_secret_backend_vault.py	528	# def test_mysql_target_password_from_vault(self, processes: ProcessManager, timeout):	COMMENT
LOW	tests/test_secret_backend_vault.py	126	def test_resolve_via_admin_api(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	155	def test_backend_health_and_listing(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	179	def test_multiple_backends_resolve_independently(self, processes: ProcessManager, backend_engine, timeout, stop_at_e	CODE
LOW	tests/test_secret_backend_vault.py	212	def test_multiple_backends_independent_health(self, processes: ProcessManager, backend_engine, timeout, stop_at_end)	CODE
LOW	tests/test_secret_backend_vault.py	245	def test_duplicate_or_invalid_backend_name_is_rejected(self, processes: ProcessManager, shared_wg, timeout):	CODE
LOW	tests/test_secret_backend_vault.py	261	def test_update_keeps_secret_when_omitted(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	329	def test_secret_reference_usage_reports_target(self, processes: ProcessManager, shared_wg, timeout):	CODE
LOW	tests/test_secret_backend_vault.py	370	def test_secret_reference_usage_multiple_targets_share_secret(	CODE
LOW	tests/test_secret_backend_vault.py	452	def test_postgres_target_password_from_vault(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	588	def test_ssh_target_password_from_vault(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	650	def test_vnc_target_password_from_vault(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	719	def test_rdp_target_password_from_vault(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	853	def test_unreachable_backend_is_isolated(self, processes: ProcessManager, timeout, stop_at_end):	CODE
LOW	tests/test_secret_backend_vault.py	930	def test_ssh_client_key_from_vault(self, processes: ProcessManager, backend_engine, timeout, stop_at_end):	CODE
LOW	tests/test_admin_approval_permissions.py	34	def test_session_permissions_alone_grant_no_access(	CODE
LOW	tests/test_admin_approval_permissions.py	76	def test_approve_sessions_permission_allows_approval(	CODE
LOW	tests/test_admin_approval_permissions.py	102	def test_cannot_approve_own_session(	CODE
LOW	tests/test_admin_approval_permissions.py	136	def test_target_editor_may_approve_own_session(	CODE
LOW	tests/test_admin_approval_permissions.py	169	def test_audit_records_the_resolver(	CODE
LOW	tests/test_ssh_target_cert_auth.py	153	def test_connects_and_the_target_logs_the_key_id(	CODE
LOW	tests/test_ssh_target_cert_auth.py	179	def test_principal_outside_the_role_is_refused(	CODE
LOW	tests/test_ssh_target_cert_auth.py	193	def test_unknown_role_is_reported(	CODE
LOW	tests/test_ssh_target_cert_auth.py	206	def test_signing_is_gated_by_the_backends_allowed_paths(	CODE
LOW	tests/test_ssh_target_cert_auth.py	226	def test_unknown_backend_is_reported(	CODE
LOW	tests/test_ssh_target_cert_auth.py	239	def test_forced_command_from_the_role_is_refused(	CODE
LOW	tests/test_ssh_target_cert_auth.py	253	def test_host_key_check_issues_no_certificate(	CODE
LOW	tests/test_ssh_target_cert_auth.py	265	def test_session_through_a_jump_host(	CODE
LOW	tests/test_ssh_target_cert_auth.py	276	def test_host_key_check_through_a_jump_host_stops_at_the_target(	CODE
LOW	tests/test_ssh_target_cert_auth.py	302	def test_web_client_failure_is_logged(	CODE
LOW	tests/test_postgres_admin_approval.py	89	async def test_web_then_admin_approval(	CODE
LOW	tests/test_postgres_admin_approval.py	154	async def test_a_ticket_cannot_answer_its_users_login_approval(	CODE
LOW	tests/test_postgres_admin_approval.py	264	async def test_pending_count_readable_with_session_cookie(	CODE
LOW	tests/test_postgres_admin_approval.py	323	def test_inbox_counts_sessions_and_tickets(	CODE
LOW	tests/test_postgres_admin_approval.py	400	def test_ticket_is_held_for_approval(	CODE
205 more matches not shown…

Decorative Section Separators36 hits · 135 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	11	# ── colour helpers ────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	20	# ── helpers ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	29	# ── check if already seeded ───────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	44	# ── create role ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	49	# ── create user ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	54	# ── add password credential ───────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	58	# ── assign user to role ───────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/seed.sh	62	# ── create SSH target ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	docker/local-testing/login-protection/seed.sh	79	# ── assign target to role ─────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	17	# ── colours ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	24	# ── preflight ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	29	# ── kill any previous instance ───────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	40	# ── pull + start Docker targets ───────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	47	# ── wait for SSH target to accept connections ─────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	56	# ── prepare data directory ───────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docker/local-testing/login-protection/start.sh	64	# ── unattended-setup (only if not already initialised) ───────────────────────	COMMENT
MEDIUM	docker/local-testing/login-protection/start.sh	91	# ── start warpgate ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docker/local-testing/login-protection/start.sh	101	# ── wait for warpgate HTTP ────────────────────────────────────────────────────	COMMENT
MEDIUM	docker/local-testing/login-protection/start.sh	113	# ── seed users / targets / roles ─────────────────────────────────────────────	COMMENT
MEDIUM	docker/local-testing/login-protection/start.sh	117	# ── done ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_secret_backend_vault.py	1005	# ── AppRole auth method (not just static Token) ──────────────────────────	COMMENT
MEDIUM⚡	tests/test_login_protection.py	94	# ── test class ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_login_protection.py	100	# ── endpoint smoke tests ────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_login_protection.py	130	# ── failure recording ───────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	14	# ── shared helpers ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	166	# ── IP blocking ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	263	# ── user lockout ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	359	# ── hot-reload ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	454	# ── SSH protocol ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_login_protection.py	686	# ── admin exemption ──────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_http_user_auth_oidc.py	230	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_http_user_auth_oidc.py	232	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_http_user_auth_oidc.py	993	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_http_user_auth_oidc.py	997	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_kubernetes_integration.py	41	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_kubernetes_integration.py	43	# ---------------------------------------------------------------------------	COMMENT

Over-Commented Block70 hits · 70 pts

Severity	File	Line	Snippet	Context
LOW	deny.toml	1	# This template contains all of the possible sections and their default values	COMMENT
LOW	deny.toml	21	# `target_family = "unix"` configuration, that only having windows targets in	COMMENT
LOW	deny.toml	41	# is recommended to pass `--all-features` on the cmd line instead	COMMENT
LOW	deny.toml	81	# See Git Authentication for more information about setting up git authentication.	COMMENT
LOW	deny.toml	101	# the workspace that is being checked. This can be overridden by allowing/denying	COMMENT
LOW	deny.toml	121	# is a direct dependency of the otherwise banned crate	COMMENT
LOW	deny.toml	141	# "tokio-rustls",	COMMENT
LOW	deny.toml	161		COMMENT
LOW	warpgate-common/src/error.rs	41	ExternalHostNotWhitelisted(String, Vec<String>),	COMMENT
LOW	warpgate-common/src/config/mod.rs	281	/// The set of admin permissions a principal holds, folded from their assigned roles once so	COMMENT
LOW	warpgate-common/src/config/target.rs	301		COMMENT
LOW	warpgate-common/src/config/target.rs	321	/// Show the target's own sign-in screen instead of logging on automatically.	COMMENT
LOW	warpgate-common/src/auth/state.rs	21		COMMENT
LOW	warpgate-protocol-kubernetes/src/correlator.rs	81	/// join a session in flight wait on the mutex, so a `kubectl` command's fan-out	COMMENT
LOW	warpgate-protocol-kubernetes/src/correlator.rs	121		COMMENT
LOW	warpgate-protocol-kubernetes/src/audit.rs	1	//! Classification of Kubernetes API requests into the operations worth auditing.	COMMENT
LOW	warpgate-protocol-kubernetes/src/server/handlers.rs	61	/// mid-stream drops its TCP connection without a websocket close (how a	COMMENT
LOW	warpgate-protocol-kubernetes/src/server/auth.rs	221	}	COMMENT
LOW	warpgate-web-desktop/src/jpeg.rs	1	//! JPEG re-encoding for backends that only emit raw framebuffer tiles.	COMMENT
LOW	warpgate-db-entities/src/Parameters.rs	21	Connect,	COMMENT
LOW	warpgate-database-protocols/src/error.rs	21	#[error("unexpected null; try decoding as an `Option`")]	COMMENT
LOW	warpgate-database-protocols/src/error.rs	41	#[error("error occurred while attempting to establish a TLS connection: {0}")]	COMMENT
LOW	warpgate-database-protocols/src/error.rs	81	/// because another task encountered too many errors while trying to open a new connection.	COMMENT
LOW	warpgate-database-protocols/src/lib.rs	1	#![allow(clippy::pedantic)]	COMMENT
LOW	warpgate-protocol-vnc/src/server/rfb.rs	1	//! Low-level RFB (VNC) and VeNCrypt handshake helpers.	COMMENT
LOW	warpgate-protocol-rdp/src/server/mod.rs	1	//! Native RDP server endpoint.	COMMENT
LOW	warpgate-protocol-rdp/src/server/rdp.rs	341	width: u16::try_from(width).ok()?,	COMMENT
LOW	warpgate-protocol-rdp/src/server/rdp.rs	361	out: mpsc::UnboundedSender<Event>,	COMMENT
LOW	tests/test_secret_backend_vault.py	521	# flip the Vault-stored value; the same target must now fail, proving the password	COMMENT
LOW	tests/test_secret_backend_vault.py	541	# api.create_password_credential(user.id, sdk.NewPasswordCredential(password="123"))	COMMENT
LOW	tests/test_secret_backend_vault.py	561	# )	COMMENT
LOW	tests/test_secret_backend_vault.py	721	# rdp_client.py), so unlike the other protocols this drives a real backend connection	COMMENT
LOW	tests/test_ssh_proto.py	301	self,	COMMENT
LOW	tests/test_kubernetes_integration.py	41	# ---------------------------------------------------------------------------	COMMENT
LOW	tests/api_sdk/pyproject.toml	61		COMMENT
LOW	warpgate-sso/src/metadata.rs	21	///	COMMENT
LOW	warpgate-sso/src/metadata.rs	61	/// dereferencing or handing to a browser.	COMMENT
LOW	warpgate-sso/src/sso.rs	41	/// A group-style claim value: a single entry, or an array of entries	COMMENT
LOW	warpgate-common-http/src/cluster_tls.rs	1	//! Inbound half of cluster peer authentication.	COMMENT
LOW	warpgate-core/src/db_auth.rs	41	/// When false, a policy requiring web approval denies before the success	COMMENT
LOW	warpgate-core/src/auth_state_store.rs	261	Ok((user, policy))	COMMENT
LOW	warpgate-core/src/credential_encryption.rs	81	.await?;	COMMENT
LOW	warpgate-core/src/recordings/desktop.rs	141	}	COMMENT
LOW	warpgate-core/src/recordings/writer.rs	21	/// Capacity of both the disk-write queue and the live broadcast ring. They must	COMMENT
LOW	warpgate-core/src/rate_limiting/mod.rs	1	//! ## Hierarchy	COMMENT
LOW	warpgate-core/src/login_protection/cache.rs	21	#[derive(Clone, Debug)]	COMMENT
LOW	warpgate-core/src/approvals/mod.rs	1	//! Common mechanism for approvals:	COMMENT
LOW	warpgate-core/src/approvals/gate.rs	81	Self::Refused \| Self::Expired => Err(WarpgateError::SessionNotApproved),	COMMENT
LOW	warpgate-core/src/protocols/desktop.rs	201	/// `E0` prefix that distinguishes e.g. the nav cluster from the numeric keypad.	COMMENT
LOW	warpgate-core/src/protocols/framebuffer.rs	1	//! Server-side framebuffer reconstruction from a desktop delta stream.	COMMENT
LOW	warpgate-protocol-mysql/src/relay.rs	21	/// so the client can have negotiated capabilities the target turns out to lack	COMMENT
LOW	warpgate-protocol-ssh/src/command_detector.rs	1	//! Heuristic recovery of shell commands from an interactive PTY byte stream.	COMMENT
LOW	warpgate-protocol-ssh/src/server/session.rs	2621		COMMENT
LOW	.github/workflows/codeql.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/codeql.yml	61	# Add any setup steps before running the `github/codeql-action/init` action.	COMMENT
LOW	.github/workflows/scorecard.yml	41	- name: "Run analysis"	COMMENT
LOW	warpgate-admin/src/api/cluster_proxy.rs	1	//! Cross-node proxy for node-owned resources.	COMMENT
LOW	warpgate-admin/src/api/secret_backends.rs	181	#[oai(status = 200)]	COMMENT
LOW	warpgate-web/src/common/desktopClipboard.ts	101	(this.isMac ? e.metaKey : e.ctrlKey) &&	COMMENT
LOW	warpgate-protocol-http/src/session_storage.rs	21	use crate::common::SessionExt;	COMMENT
10 more matches not shown…

Empty Error Handlers12 hits · 60 pts

Severity	File	Line	Snippet	Context
HIGH	tests/vnc_client.py	215	except OSError:	CODE
HIGH	tests/conftest.py	301	except psutil.NoSuchProcess:	CODE
HIGH	tests/conftest.py	287	except psutil.NoSuchProcess:	CODE
HIGH	tests/conftest.py	891	except Exception:	CODE
HIGH	tests/conftest.py	956	except Exception:	CODE
HIGH	tests/conftest.py	298	except psutil.NoSuchProcess:	CODE
HIGH	tests/test_ssh_proto.py	558	except socket.timeout:	CODE
HIGH	tests/test_login_protection.py	155	except Exception:	CODE
HIGH	tests/test_kubernetes_user_auth_ticket.py	288	except (ConnectionResetError, asyncio.CancelledError):	CODE
HIGH	tests/test_cluster_failover.py	76	except psutil.TimeoutExpired:	CODE
HIGH	tests/test_cluster_failover.py	71	except psutil.NoSuchProcess:	CODE
HIGH	tests/test_json_logs.py	72	except Exception:	CODE

Unused Imports22 hits · 19 pts

Severity	File	Line	Context
LOW	tests/test_role_expiry.py	18	CODE
LOW	tests/conftest.py	30	CODE
LOW	tests/test_secret_backend_vault.py	18	CODE
LOW	tests/test_secret_backend_vault.py	18	CODE
LOW	tests/test_secret_backend_vault.py	18	CODE
LOW	tests/test_secret_backend_vault.py	18	CODE
LOW	tests/test_http_proto.py	6	CODE
LOW	tests/test_http_user_auth_otp.py	8	CODE
LOW	tests/test_http_basic.py	8	CODE
LOW	tests/test_login_protection.py	11	CODE
LOW	tests/test_http_user_auth_ticket.py	7	CODE
LOW	tests/test_http_user_auth_logout.py	6	CODE
LOW	tests/test_cluster_session_close.py	4	CODE
LOW	tests/test_http_user_auth_oidc.py	13	CODE
LOW	tests/test_ticket_requests.py	6	CODE
LOW	tests/test_http_websocket.py	14	CODE
LOW	tests/test_http_user_auth_password.py	6	CODE
LOW	tests/test_http_user_auth_oidc_backchannel.py	12	CODE
LOW	tests/test_api.py	19	CODE
LOW	tests/test_http_redirects.py	6	CODE
LOW	tests/approval_util.py	14	CODE
LOW	tests/test_http_csrf.py	12	CODE

Verbosity Indicators7 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/test_login_protection.py	383	# Step 1: 3 failures below initial threshold of 5 → no lockout	COMMENT
LOW⚡	tests/test_login_protection.py	392	# Step 2: lower threshold to 2 via admin API (no restart)	COMMENT
LOW⚡	tests/test_login_protection.py	396	# Step 3: attempt N — total=4 in window, new threshold=2.	COMMENT
LOW⚡	tests/test_login_protection.py	402	# Step 4: attempt N+1 — check_user_locked now finds the lockout.	COMMENT
LOW⚡	tests/test_login_protection.py	429	# Step 1: 2 failures	COMMENT
LOW⚡	tests/test_login_protection.py	434	# Step 2: raise threshold to 10	COMMENT
LOW⚡	tests/test_login_protection.py	438	# Step 3: 2 more failures (total 4 in window, threshold now 10) — must NOT lock	COMMENT

Structural Annotation Overuse7 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/test_login_protection.py	383	# Step 1: 3 failures below initial threshold of 5 → no lockout	COMMENT
LOW⚡	tests/test_login_protection.py	392	# Step 2: lower threshold to 2 via admin API (no restart)	COMMENT
LOW⚡	tests/test_login_protection.py	396	# Step 3: attempt N — total=4 in window, new threshold=2.	COMMENT
LOW⚡	tests/test_login_protection.py	402	# Step 4: attempt N+1 — check_user_locked now finds the lockout.	COMMENT
LOW⚡	tests/test_login_protection.py	429	# Step 1: 2 failures	COMMENT
LOW⚡	tests/test_login_protection.py	434	# Step 2: raise threshold to 10	COMMENT
LOW⚡	tests/test_login_protection.py	438	# Step 3: 2 more failures (total 4 in window, threshold now 10) — must NOT lock	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/test_role_expiry.py	356	# Create a second role	COMMENT
MEDIUM	tests/test_ticket_requests.py	440	# Create a ticket	COMMENT
MEDIUM	tests/test_json_logs.py	28	# Create a temporary file to capture log output	COMMENT
MEDIUM	tests/test_json_logs.py	120	# Create a temporary file to capture log output	COMMENT

Deep Nesting13 hits · 12 pts

Severity	File	Line	Context
LOW	tests/conftest.py	217	CODE
LOW	tests/conftest.py	222	CODE
LOW	tests/conftest.py	271	CODE
LOW	tests/test_rdp_web.py	21	CODE
LOW	tests/test_secret_backend_vault.py	719	CODE
LOW	tests/test_secret_backend_vault.py	782	CODE
LOW	tests/util.py	86	CODE
LOW	tests/util.py	92	CODE
LOW	tests/test_ssh_proto.py	300	CODE
LOW	tests/test_ssh_proto.py	380	CODE
LOW	tests/test_kubernetes_user_auth_ticket.py	399	CODE
LOW	tests/test_kubernetes_user_auth_ticket.py	528	CODE
LOW	tests/test_cluster_web_approval.py	15	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	SECURITY.md	35	* If generated by AI, include the name of the model used.	COMMENT

Excessive Try-Catch Wrapping8 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	tests/conftest.py	891	except Exception:	STRING
LOW	tests/conftest.py	956	except Exception:	CODE
LOW	tests/test_vnc_user_auth_in_browser.py	78	except Exception as error: # noqa: BLE001	CODE
LOW	tests/test_login_protection.py	155	except Exception:	CODE
LOW	tests/test_recordings_s3.py	40	except Exception:	CODE
LOW	tests/test_vnc_user_auth_otp_and_web.py	91	except Exception as error: # noqa: BLE001	CODE
LOW	tests/test_admin_approval_protocols.py	382	except Exception as error: # noqa: BLE001	CODE
LOW	tests/test_json_logs.py	72	except Exception:	CODE

Slop Phrases2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	helm/warpgate/values.yaml	103	# If you are using config_overrides, ca, ssh keyds form secrets and external databse you can use emptyDir	COMMENT
MEDIUM	helm/warpgate/values.yaml	232	# Alternatively, you can use strings, which lets you use additional templating features:	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	warpgate/src/listener_supervisor.rs	267	/// Watch the parent directories of the desired cert/key files (robust to	COMMENT
MEDIUM	warpgate/src/listener_supervisor.rs	306	/// Matched by file name to be robust across absolute/relative/symlinked paths	COMMENT

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tests/conftest.py	966		CODE
LOW	tests/test_http_user_auth_oidc.py	37		CODE

Fake / Example Data1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	warpgate-db-entities/src/Parameters.rs	433	email: "user@example.com".into(),	CODE

warp-tech/warpgate

Open-Source Code Quality, Security and Technical Debt Review