0.7

Adjusted Signal

0.7

Raw Pattern Score

100%

Time Factor

—

Last Push

—

Stars

—

Language

209.8K

Lines of Code

2.2K

Files

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 73 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.7/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 3 finding(s).

PR Review Velocity Impact 3.6/100 · LOW

Which changes need focused human review? 84 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 7HIGH 0MEDIUM 3LOW 74

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 84 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block71 hits · 71 pts

Severity	File	Line	Snippet	Context
LOW	afrog.go	201	Silent bool	COMMENT
LOW	cmd/regex/main.go	61	func main2() {	COMMENT
LOW	cmd/regex/main.go	81	// Content-Type: text/plain	COMMENT
LOW	cmd/regex/main.go	101		COMMENT
LOW	cmd/regex/main.go	141	} else {	COMMENT
LOW	examples/sdk_portscan/main.go	1	// SDK Port Pre-Scan Example / SDK 端口预扫描示例	COMMENT
LOW	examples/vuln_scan/main.go	1	// Vulnerability Scan Example / 漏洞扫描示例	COMMENT
LOW	examples/port_scan/main.go	1	// Port Scan Example / 端口扫描示例	COMMENT
LOW	examples/basic_scan/main.go	1	// Basic Scan Example / 基础扫描示例	COMMENT
LOW	examples/async_scan/main.go	1	// Async Scan Example / 异步扫描示例	COMMENT
LOW	examples/oob_scan/main.go	1	// OOB (Out-of-Band) Scan Example / OOB（带外）扫描示例	COMMENT
LOW	examples/full_output/main.go	1	// Full Output Example / 完整数据输出示例	COMMENT
LOW	.github/workflows/release.yml	221	# "fmt"	COMMENT
LOW	.github/workflows/release.yml	241	# hasEntryJS = true	COMMENT
LOW	pkg/poc/migrate_extractor.go	1	package poc	COMMENT
LOW	pkg/poc/migrate_extractor.go	21	// group: v	COMMENT
LOW	pkg/portscan/scan.go	961	}	COMMENT
LOW	pkg/portscan/fingerprints/ports.yaml	1	# afrog 端口先验（port prior）。	COMMENT
LOW	pkg/portscan/fingerprints/services.yaml	1	# afrog 端口指纹规则。	COMMENT
LOW	pkg/portscan/fingerprints/services.yaml	21	# match 规则列表，按顺序取第一个命中的	COMMENT
LOW	pkg/portscan/fingerprints/probes.yaml	1	# afrog 端口指纹探针定义。	COMMENT
LOW	pkg/progress/progress.go	121	progressBar.WriteString(strings.Repeat(emptyChar, remaining))	COMMENT
LOW	pkg/pocsign/pocsign.go	1	// Package pocsign 实现 PoC 模板的 ed25519 签名与验签。	COMMENT
LOW	pkg/config/targetset.go	1	package config	COMMENT
LOW	pkg/config/banner.go	21	// - 正式发布：GoReleaser 通过 -ldflags "-X .../pkg/config.Version={{ .Version }}"	COMMENT
LOW	pkg/web/cluster_remote.go	21	"github.com/zan8in/gologger"	COMMENT
LOW	pkg/runner/celprogram.go	901	if next <= startAt {	COMMENT
LOW	pkg/runner/celprogram.go	921	// }	COMMENT
LOW	pkg/runner/celprogram.go	1381	}	COMMENT
LOW	pkg/runner/celprogram.go	1421	v1, ok := lhs.(types.String)	COMMENT
LOW	pkg/runner/celprogram.go	1481	// // @edit 2021.11.29 21:50	COMMENT
LOW	pkg/runner/celprogram.go	1501	// // }	COMMENT
LOW	pkg/runner/celprogram.go	1521		COMMENT
LOW	pkg/runner/celprogram.go	1541	// if err != nil {	COMMENT
LOW	pkg/runner/celprogram.go	1561		COMMENT
LOW	pkg/runner/resume.go	301	}	COMMENT
LOW	pkg/runner/runner.go	521		COMMENT
LOW	pkg/runner/runner.go	541	// if len(config.ReverseCeyeDomain) > 0 && len(config.ReverseCeyeApiKey) > 0 {	COMMENT
LOW	pkg/runner/runner.go	561	// go func() {	COMMENT
LOW	pkg/runner/engine.go	541		COMMENT
LOW	pkg/runner/engine.go	3101	// if err != nil {	COMMENT
LOW	pkg/runner/engine.go	3121	// if strings.Contains(string(resp), "no") \|\| strings.Contains(string(resp), "yes") {	COMMENT
LOW	pkg/runner/engine.go	3141	// domain := config.ReverseEyeDomain	COMMENT
LOW	pkg/runner/checker.go	1041		COMMENT
LOW	pkg/runner/checker.go	1061	// Ip: u.Host,	COMMENT
LOW	pkg/utils/tips.go	1	package utils	COMMENT
LOW	pkg/nuclei2afrog/translate.go	21	// 语义依据（均以 nuclei 源码为准）：	COMMENT
LOW	pkg/webscan/fingerprints/rules.yaml	1	# afrog Web 指纹规则。	COMMENT
LOW	pkg/webscan/fingerprints/rules.yaml	21	# version 版本模板，支持 $1..$9 与 ${name}	COMMENT
LOW	pkg/sdk/scanner.go	801	// ------------------------------------------------------------------ streams	COMMENT
LOW	pkg/sdk/scanner.go	961	}	COMMENT
LOW	pkg/sdk/options.go	121	DefaultAccept bool	COMMENT
LOW	pkg/sdk/options.go	201		COMMENT
LOW	pkg/sdk/options.go	221	// detect a saturated local link and ease the connection rate off. It is on	COMMENT
LOW	pkg/sdk/options.go	261		COMMENT
LOW	pkg/sdk/options.go	281	// This is separate from the per-request Timeout: a PoC with many rules can	COMMENT
LOW	pkg/sdk/options.go	301	//	COMMENT
LOW	pkg/sdk/options.go	1101		COMMENT
LOW	pkg/sdk/stream.go	1	package sdk	COMMENT
LOW	pkg/log/ui.go	21	//	COMMENT
11 more matches not shown…

Hallucination Indicators7 hits · 70 pts

Severity	File	Line	Snippet	Context
CRITICAL	pkg/web/template/List.html	267	}, Zb.prototype.init.prototype = Zb.prototype, Zb.propHooks = { _default: { get: function (a) { var b; retur	CODE
CRITICAL	pkg/report/default.go	360	},cur:function(){var a=Zb.propHooks[this.prop];return a&&a.get?a.get(this):Zb.propHooks._default.get(this)},run:functi	CODE
CRITICAL	pocs/afrog-pocs/CVE/2020/CVE-2020-14883.yaml	34	test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.	CODE
CRITICAL	…s/vulnerability/qiyuesuo-template-param-edits-rce.yaml	26	{"id":"2","params":[{"expression":"var a=new org.springframework.expression.spel.standard.SpelExpressionParser()	CODE
CRITICAL	…cs/vulnerability/yonyou-cloud-jsinvoke-uploadfile.yaml	42	path: /{{r1}}.jsp?error=bsh.Interpreter&cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec(%22wh	CODE
CRITICAL	…pocs/vulnerability/qiyuesuo-template-html-add-rce.yaml	26	{"file":"1","title":"2","params":[{"extensionParam":"{\"expression\":\"var a=new org.springframework.expression.	CODE
CRITICAL	…ocs/vulnerability/yonyou-nccloud-uapjs-upload-rce.yaml	32	cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ipconfig").getInputStream())	CODE

Decorative Section Separators3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	pkg/progress/progress.go	18	// Unicode终端：GetProgressBar(30, 20) → "━━━━━━╺─────────────"	COMMENT
MEDIUM	pkg/progress/progress.go	130	// port-scan [━━━━╺─────] 12% 400/3200 1m30s 210/s	COMMENT
MEDIUM	pkg/progress/progress.go	131	// vuln-scan [━━╺───────] 9% 1543/16220 3m20s 15/s found=2	COMMENT

Structural Annotation Overuse2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	docs/en/curated/02-usage.md	13	## Step 1: get a license	COMMENT
LOW	docs/en/curated/02-usage.md	18	## Step 2: edit the configuration file	COMMENT

Fake / Example Data1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	pocs/afrog-pocs/CVE/2020/CVE-2020-10204.yaml	26	{"action":"coreui_User","method":"update","data":[{"userId":"anonymous","version":"1","firstName":"Anonymous","l	CODE

zan8in/afrog

Open-Source Code Quality, Security and Technical Debt Review