🚀 A fast WebAssembly interpreter and the most universal WASM runtime
This report summarizes scanner evidence for wasm3/wasm3, a C project with 8,046 GitHub stars. SynthScan examined 77,918 lines of code across 224 source files, recording 318 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 4.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 294 finding(s).
Are imports declared and package/API names verified? 7 finding(s).
Are wrappers, guards, and repeated structures necessary? 41 finding(s).
Which changes need focused human review? 318 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 318 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | platforms/app_fuzz/fuzzer.c | 1 | // | COMMENT |
| LOW | platforms/app/spectest.wasm.h | 1 | // | COMMENT |
| LOW | platforms/app/main.c | 1 | // | COMMENT |
| LOW | platforms/app/main.c | 21 | # include "m3_api_wasi.h" | COMMENT |
| LOW | platforms/ios/wasm3/main.c | 1 | // | COMMENT |
| LOW | platforms/emscripten/main.c | 1 | // | COMMENT |
| LOW | platforms/cpp/wasm3_cpp/include/wasm3_cpp.h | 1 | #pragma once | COMMENT |
| LOW | platforms/android/app/src/main/cpp/jni.c | 1 | // | COMMENT |
| LOW | platforms/android/app/src/main/cpp/main.c | 1 | // | COMMENT |
| LOW | platforms/embedded/hifive1/src/main.c | 1 | // | COMMENT |
| LOW | platforms/embedded/bluepill/src/main.cpp | 1 | // | COMMENT |
| LOW | platforms/embedded/esp32-idf/main/main.cpp | 1 | // | COMMENT |
| LOW | …atforms/embedded/esp32-idf-wasi/main/m3_api_esp_wasi.c | 1 | // | COMMENT |
| LOW | …atforms/embedded/esp32-idf-wasi/main/m3_api_esp_wasi.c | 581 | //_ (SuppressLookupFailure(m3_LinkRawFunction(module, wasi, "fd_filestat_get", "i(i*)", ))); | COMMENT |
| LOW | platforms/embedded/esp32-idf-wasi/main/main.cpp | 1 | // | COMMENT |
| LOW | platforms/embedded/fomu/include/usbstd.h | 61 | } __attribute__((packed)); | COMMENT |
| LOW | platforms/embedded/fomu/include/usbstd.h | 81 | COMMENT | |
| LOW | platforms/embedded/fomu/include/usbstd.h | 101 | #define USB_DT_INTERFACE 4 | COMMENT |
| LOW | platforms/embedded/fomu/include/usbstd.h | 221 | int extralen; | COMMENT |
| LOW | platforms/embedded/fomu/include/xxhash.h | 121 | regular symbol name will be automatically translated by this header. | COMMENT |
| LOW | platforms/embedded/fomu/include/xxhash.h | 281 | #endif | COMMENT |
| LOW | platforms/embedded/fomu/include/csr-defs.h | 1 | #ifndef CSR_DEFS__H | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-internal.h | 21 | }; | COMMENT |
| LOW | platforms/embedded/fomu/include/xxhash.c | 121 | #ifdef _MSC_VER /* Visual Studio */ | COMMENT |
| LOW | platforms/embedded/fomu/include/xxhash.c | 181 | COMMENT | |
| LOW | platforms/embedded/fomu/include/irq.h | 1 | #ifndef __IRQ_H | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 1 | #ifndef TOBOOT_API_H_ | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 21 | /// Toboot itself sets this to 0. If this is nonzero, then it | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 41 | /// blocks 32-63. | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 61 | /// program. Set this flag to enter your program whenever the | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 81 | /// This value is used to prevent manual entry into Toboot. | COMMENT |
| LOW | platforms/embedded/fomu/include/toboot-api.h | 101 | /// Unused. | COMMENT |
| LOW | platforms/embedded/fomu/include/hw/flags.h | 1 | #ifndef __HW_FLAGS_H | COMMENT |
| LOW | platforms/embedded/fomu/include/hw/flags.h | 21 | COMMENT | |
| LOW | platforms/embedded/fomu/src/usb-desc.c | 41 | // than constant binary data that tells the USB host what the | COMMENT |
| LOW | platforms/embedded/fomu/src/usb-dev.c | 61 | COMMENT | |
| LOW | platforms/embedded/fomu/src/rgb.c | 1 | #include <stdint.h> | COMMENT |
| LOW | platforms/embedded/fomu/src/main.c | 1 | // | COMMENT |
| LOW | platforms/emscripten_lib/main.c | 1 | // | COMMENT |
| LOW | test/run-strace-test.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/run-spec-test.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/run-spec-test.py | 421 | return normalizeResults(values, expected) | COMMENT |
| LOW | test/run-spec-test.py | 561 | [ | COMMENT |
| LOW | test/run-spec-test.py | 581 | # one test that does this is left out instead. | COMMENT |
| LOW | test/run-regression-test.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/run-regression-test.py | 61 | ).stdout.decode("utf-8", errors="replace") | COMMENT |
| LOW | test/run-regression-test.py | 81 | # "expect_pattern" is the fallback for what cannot be pinned down: fnmatch | COMMENT |
| LOW | test/run-snapshot-test.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/run-bench.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | test/run-bench.py | 41 | from testutils import ansi | COMMENT |
| LOW | test/internal/m3_test_reftypes.c | 1 | // | COMMENT |
| LOW | test/internal/m3_test.c | 1 | // | COMMENT |
| LOW | test/internal/m3_test.c | 21 | // Whether this build can run a case on a thread of its own, which the native stack | COMMENT |
| LOW | test/internal/m3_test.c | 41 | #define DisabledTest(NAME) printf ("\ndisabled: %s\n", #NAME); if (false) | COMMENT |
| LOW | test/internal/m3_test.c | 661 | } | COMMENT |
| LOW | test/internal/m3_test.c | 821 | // (block $h (type $pay) | COMMENT |
| LOW | test/internal/m3_test.c | 1621 | } | COMMENT |
| LOW | test/internal/tailcall/ops.c | 61 | OP((RES), (* stack), ((TYPE) REG), ##__VA_ARGS__); \ | COMMENT |
| LOW | test/wasi/simple/wasm_api.h | 1 | #ifndef wasm_api_h | COMMENT |
| LOW | test/wasi/c-ray/c-ray-f.c | 21 | * --------------------------------------------------------------------- | COMMENT |
| 181 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/run-spec-test.py | 382 | except Empty: | CODE |
| HIGH | test/run-spec-test.py | 1227 | except Exception as e: | CODE |
| HIGH | test/run-spec-test.py | 317 | except Exception as e: | CODE |
| HIGH | test/run-spec-test.py | 1248 | except Exception: | CODE |
| HIGH | extra/snapshot-tool.py | 1403 | except (FormatError, IndexError): | CODE |
| HIGH | extra/format.py | 121 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/run-snapshot-format-test.py | 236 | def test_resource_cli_arguments(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 263 | def test_embedded_resume_skips_start(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 281 | def test_engine_embeds_a_section_stream(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 295 | def test_custom_metadata_does_not_change_identity(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 310 | def test_duplicate_checkpoints(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 340 | def test_selecting_an_embedded_snapshot(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 353 | def test_embedded_snapshot_belongs_to_its_module(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 366 | def test_postmortem_is_not_embedded(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 395 | def test_host_state_is_the_whole_section(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 406 | def test_page_size_is_in_the_file(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 433 | def test_byte_pages_round_trip(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 457 | def test_shared_memory_and_table_are_stored_once(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 497 | def test_info_summarizes_every_store_section(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 515 | def test_store_records_are_in_index_order(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 527 | def test_empty_sections_are_left_out(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 545 | def test_store_sections_are_required(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 554 | def test_vector_locals_travel_whole(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 573 | def test_memory_and_table_bounds(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 617 | def test_exception_tag_is_only_in_meta(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 841 | def test_mismatched_resource_totals(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 1054 | def test_frame_function_returns_what_is_expected(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 1065 | def test_back_edge_names_its_loop(self): | CODE |
| LOW | test/run-snapshot-format-test.py | 1106 | def test_pause_points_follow_the_module(self): | CODE |
| LOW | extra/snapshot-tool.py | 761 | def extract_snapshots_from_wasm(data): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | build-cross.py | 100 | CODE | |
| LOW | test/run-spec-test.py | 472 | CODE | |
| LOW | test/run-spec-test.py | 309 | CODE | |
| LOW | test/run-snapshot-test.py | 279 | CODE | |
| LOW | test/run-snapshot-format-test.py | 1011 | CODE | |
| LOW | test/run-bench.py | 297 | CODE | |
| LOW | extra/snapshot-tool.py | 596 | CODE | |
| LOW | extra/snapshot-tool.py | 826 | CODE | |
| LOW | extra/snapshot-tool.py | 1156 | CODE | |
| LOW | extra/snapshot-tool.py | 1187 | CODE | |
| LOW | extra/snapshot-tool.py | 1573 | CODE | |
| LOW | extra/snapshot-tool.py | 171 | CODE | |
| LOW | extra/snapshot-tool.py | 541 | CODE | |
| LOW | extra/snapshot-tool.py | 1110 | CODE | |
| LOW | extra/snapshot-tool.py | 1407 | CODE | |
| LOW | extra/pause-points.py | 39 | CODE | |
| LOW | extra/pause-points.py | 89 | CODE | |
| LOW | extra/format.py | 624 | CODE | |
| LOW | extra/format.py | 108 | CODE | |
| LOW | extra/format.py | 419 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/run-spec-test.py | 1346 | print("Error: No tests run") | CODE |
| LOW | test/run-spec-test.py | 306 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 317 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 320 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 940 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 1071 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 1227 | except Exception as e: | CODE |
| LOW | test/run-spec-test.py | 1248 | except Exception: | CODE |
| LOW | test/run-spec-test.py | 1316 | except Exception as e: | CODE |
| LOW | extra/snapshot-tool.py | 2083 | except Exception as e: # noqa: BLE001 - any failure is a complaint | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/run-strace-test.py | 4 | # Usage: | COMMENT |
| LOW | test/run-spec-test.py | 4 | # Usage: | COMMENT |
| LOW | test/run-regression-test.py | 4 | # Usage: | COMMENT |
| LOW | test/run-snapshot-test.py | 20 | # Usage: | COMMENT |
| LOW | test/run-wasi-test.py | 4 | # Usage: | COMMENT |
| LOW | test/run-bench.py | 7 | # Usage: | COMMENT |
| LOW | extra/disasm-func.sh | 3 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/run-spec-test.py | 639 | # on the null-ness of a reference and pass it on non-null, which needs the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/run-spec-test.py | 56 | # wg-3.0 and wg-2.0 are the revisions this harness accommodates. Anything older | COMMENT |
| MEDIUM | test/run-bench.py | 5 | # Benchmark harness: compares command lines on the WASI workloads. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/run-strace-test.py | 34 | CODE | |
| LOW | test/run-spec-test.py | 44 | CODE | |
| LOW | test/run-regression-test.py | 32 | CODE | |
| LOW | test/run-snapshot-test.py | 42 | CODE | |
| LOW | test/run-wasi-test.py | 20 | CODE | |
| LOW | extra/testutils.py | 15 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/internal/tailcall/build.sh | 81 | # ---------------------- | COMMENT |