3.6

Adjusted Signal

3.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

16.1K

Stars

Java

Language

372.2K

Lines of Code

1.5K

Files

371

Pattern Hits

2026-10-31

Scan Date

0.06

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 241 finding(s).

Hallucinated Dependency & Supply Chain Risk 13.3/100 · LOW

Are imports declared and package/API names verified? 126 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 52 finding(s).

PR Review Velocity Impact 14.7/100 · LOW

Which changes need focused human review? 371 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 82HIGH 11MEDIUM 9LOW 269

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 371 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators82 hits · 952 pts

Severity	File	Line	Snippet	Context
CRITICAL	…st/java/org/zaproxy/zap/extension/api/APIUnitTest.java	786	new org.parosproxy.paros.core.proxy.ProxyParam();	CODE
CRITICAL	…aproxy/zap/extension/log4j/ExtensionLog4jUnitTest.java	57	new org.zaproxy.zap.extension.log4j.ExtensionLog4j.ErrorAppender(	CODE
CRITICAL	zap/src/main/java/org/zaproxy/zap/Version.java	46	impl = com.github.zafarkhaja.semver.Version.parse(version);	CODE
CRITICAL	zap/src/main/java/org/zaproxy/zap/ZapGetMethod.java	226	org.zaproxy.zap.network.ZapHttpParser.parseHeaders(	CODE
CRITICAL	…va/org/zaproxy/zap/extension/alert/AlertViewPanel.java	868	org.zaproxy.zap.model.Vulnerabilities.getAllVulnerabilities();	CODE
CRITICAL	…va/org/zaproxy/zap/extension/alert/AlertViewPanel.java	880	org.zaproxy.zap.model.Vulnerabilities.getAllVulnerabilities();	CODE
CRITICAL	…/org/zaproxy/zap/extension/dynssl/ExtensionDynSSL.java	94	org.parosproxy.paros.network.SSLConnector.setSslCertificateService(	CODE
CRITICAL	…/org/zaproxy/zap/extension/dynssl/ExtensionDynSSL.java	95	org.parosproxy.paros.security.CachedSslCertifificateServiceImpl.getService());	CODE
CRITICAL	…/org/zaproxy/zap/extension/dynssl/ExtensionDynSSL.java	155	org.parosproxy.paros.security.CachedSslCertifificateServiceImpl.getService()	CODE
CRITICAL	…/org/zaproxy/zap/extension/option/SocksProxyPanel.java	73	org.parosproxy.paros.network.ConnectionParam.DEFAULT_SOCKS_PROXY.getHost());	CODE
CRITICAL	…/org/zaproxy/zap/extension/option/SocksProxyPanel.java	79	org.parosproxy.paros.network.ConnectionParam.DEFAULT_SOCKS_PROXY.getPort());	CODE
CRITICAL	…/org/zaproxy/zap/extension/option/SocksProxyPanel.java	128	org.parosproxy.paros.network.ConnectionParam.DEFAULT_SOCKS_PROXY.getVersion());	CODE
CRITICAL⚡	…n/java/org/zaproxy/zap/extension/search/SearchAPI.java	316	org.zaproxy.zap.utils.HarUtils.createHarEntry(	CODE
CRITICAL⚡	…n/java/org/zaproxy/zap/extension/search/SearchAPI.java	323	HarLog harLog = org.zaproxy.zap.utils.HarUtils.createZapHarLog();	CODE
CRITICAL⚡	…n/java/org/zaproxy/zap/extension/search/SearchAPI.java	326	responseBody = org.zaproxy.zap.utils.HarUtils.harLogToByteArray(harLog);	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1485	HarLog harLog = org.zaproxy.zap.utils.HarUtils.createZapHarLog();	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1488	responseBody = org.zaproxy.zap.utils.HarUtils.harLogToByteArray(harLog);	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1525	HarLog harLog = org.zaproxy.zap.utils.HarUtils.createZapHarLog();	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1528	responseBody = org.zaproxy.zap.utils.HarUtils.harLogToByteArray(harLog);	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1551	org.zaproxy.zap.utils.HarUtils.createHttpMessage(	CODE
CRITICAL⚡	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1571	org.zaproxy.zap.utils.HarUtils.createHarEntry(	CODE
CRITICAL⚡	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1577	HarLog harLog = org.zaproxy.zap.utils.HarUtils.createZapHarLog();	CODE
CRITICAL⚡	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1580	responseBody = org.zaproxy.zap.utils.HarUtils.harLogToByteArray(harLog);	CODE
CRITICAL	…c/main/java/org/zaproxy/zap/extension/api/CoreAPI.java	1705	org.zaproxy.zap.utils.HarUtils.createHarEntry(	CODE
CRITICAL	…/zaproxy/zap/extension/callback/ExtensionCallback.java	71	proxyServer = new org.parosproxy.paros.core.proxy.ProxyServer("ZAP-CallbackServer");	CODE
CRITICAL	…/zaproxy/zap/extension/callback/ExtensionCallback.java	132	callbackPanel = new org.zaproxy.zap.extension.callback.ui.CallbackPanel(this);	CODE
CRITICAL	…/zaproxy/zap/extension/callback/ExtensionCallback.java	238	org.zaproxy.zap.extension.callback.ui.CallbackRequest.create(	CODE
CRITICAL	…/zaproxy/zap/extension/callback/ExtensionCallback.java	374	org.zaproxy.zap.extension.callback.ui.CallbackRequest.create(	CODE
CRITICAL	…zaproxy/zap/extension/proxies/OptionsProxiesPanel.java	162	new org.parosproxy.paros.extension.option.SecurityProtocolsPanel();	CODE
CRITICAL	…rg/zaproxy/zap/extension/proxies/ExtensionProxies.java	167	new org.parosproxy.paros.core.proxy.ProxyServer(ZAP_PROXY_THREAD_PREFIX + key) {	CODE
CRITICAL	…proxy/zap/extension/pscan/DialogAddAutoTagScanner.java	251	new org.zaproxy.zap.extension.pscan.scanner.RegexAutoTagScanner(	CODE
CRITICAL	…/org/zaproxy/zap/extension/pscan/PassiveScanParam.java	114	new org.zaproxy.zap.extension.pscan.scanner.RegexAutoTagScanner(	CODE
CRITICAL	…/zap/extension/pscan/OptionsPassiveScanTableModel.java	58	this.defns.add(new org.zaproxy.zap.extension.pscan.scanner.RegexAutoTagScanner(def));	CODE
CRITICAL	…/main/java/org/zaproxy/zap/model/SessionStructure.java	348	new org.parosproxy.paros.core.scanner.NameValuePair(	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	78	extensions.add(new org.parosproxy.paros.extension.edit.ExtensionEdit());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	79	extensions.add(new org.parosproxy.paros.extension.history.ExtensionHistory());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	80	extensions.add(new org.parosproxy.paros.extension.option.ExtensionOption());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	81	extensions.add(new org.zaproxy.zap.extension.alert.ExtensionAlert());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	82	extensions.add(new org.zaproxy.zap.extension.anticsrf.ExtensionAntiCSRF());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	83	extensions.add(new org.zaproxy.zap.extension.api.ExtensionAPI());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	84	extensions.add(new org.zaproxy.zap.extension.ascan.ExtensionActiveScan());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	85	extensions.add(new org.zaproxy.zap.extension.authentication.ExtensionAuthentication());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	86	extensions.add(new org.zaproxy.zap.extension.authorization.ExtensionAuthorization());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	87	extensions.add(new org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	88	extensions.add(new org.zaproxy.zap.extension.brk.ExtensionBreak());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	89	extensions.add(new org.zaproxy.zap.extension.compare.ExtensionCompare());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	90	extensions.add(new org.zaproxy.zap.extension.ext.ExtensionExtension());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	91	extensions.add(new org.zaproxy.zap.extension.forceduser.ExtensionForcedUser());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	92	extensions.add(new org.zaproxy.zap.extension.help.ExtensionHelp());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	97	new org.zaproxy.zap.extension.httppanel.view.hex.ExtensionHttpPanelHexView());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	113	extensions.add(new org.zaproxy.zap.extension.httpsessions.ExtensionHttpSessions());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	114	extensions.add(new org.zaproxy.zap.extension.keyboard.ExtensionKeyboard());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	115	extensions.add(new org.zaproxy.zap.extension.pscan.ExtensionPassiveScan());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	116	extensions.add(new org.zaproxy.zap.extension.ruleconfig.ExtensionRuleConfig());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	117	extensions.add(new org.zaproxy.zap.extension.script.ExtensionScript());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	118	extensions.add(new org.zaproxy.zap.extension.search.ExtensionSearch());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	119	extensions.add(new org.zaproxy.zap.extension.sessions.ExtensionSessionManagement());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	120	extensions.add(new org.zaproxy.zap.extension.siterefresh.ExtensionSitesRefresh());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	121	extensions.add(new org.zaproxy.zap.extension.stats.ExtensionStats());	CODE
CRITICAL⚡	…in/java/org/zaproxy/zap/control/CoreFunctionality.java	122	extensions.add(new org.zaproxy.zap.extension.stdmenus.ExtensionStdMenus());	CODE
22 more matches not shown…

Over-Commented Block157 hits · 157 pts

Severity	File	Line	Snippet	Context
LOW	docker/zap-full-scan.py	1	#!/usr/bin/env python	COMMENT
LOW	docker/zap-full-scan.py	21	#	COMMENT
LOW	docker/zap_common.py	1	#!/usr/bin/env python	COMMENT
LOW	docker/zap-baseline.py	1	#!/usr/bin/env python	COMMENT
LOW	docker/zap-baseline.py	21	#	COMMENT
LOW	docker/zap-api-scan.py	1	#!/usr/bin/env python	COMMENT
LOW	docker/zap-api-scan.py	21	# or GraphQL using ZAP.	COMMENT
LOW	…on_tests/configs/plans/auth-oauth2-expires-in-gap.yaml	1	--- # KNOWN GAP, TRACKED HERE ON PURPOSE: OAuth2AuthenticationMethod (zap-extensions authhelper	COMMENT
LOW	python/scripts/watcher/watcher.py	1	# Zed Attack Proxy (ZAP) and its related class files.	COMMENT
LOW	python/scripts/watcher/watcher.py	21	#	COMMENT
LOW	python/scripts/wavsep/wavsep.py	1	# Zed Attack Proxy (ZAP) and its related class files.	COMMENT
LOW	python/scripts/wavsep/wavsep.py	21	# project not the test suite!	COMMENT
LOW	python/scripts/generic-pytest/test_zap.py	1	# Zed Attack Proxy (ZAP) and its related class files.	COMMENT
LOW	zap/src/main/main-add-ons.yml	1	# List of add-ons to include in main releases (non-SNAPSHOT),	COMMENT
LOW	…aproxy/zap/extension/ascan/PolicyAllCategoryPanel.java	21	// ZAP: 2013/03/03 Issue 546: Remove all template Javadoc comments	COMMENT
LOW	…rg/zaproxy/zap/extension/ascan/CategoryTableModel.java	21	// ZAP: 2012/03/14 Changed to use the internationalised strings.	COMMENT
LOW	…zaproxy/zap/extension/ascan/AllCategoryTableModel.java	21	// ZAP: 2012/04/25 Added type argument to generic type and changed to use the	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/CommandLine.java	21	// ZAP: 2011/04/16 Support for running ZAP as a daemon	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/CommandLine.java	41	// ZAP: 2017/08/31 Use helper method I18N.getString(String, Object...).	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/Constant.java	21	*/	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/Constant.java	41	// ZAP: 2012/11/15 Issue 416: Normalise how multiple related options are managed	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/Constant.java	61	// ZAP: 2014/01/04 Issue 1458: Change home/installation dir paths to be always absolute	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/Constant.java	81	// ZAP: 2018/01/03 No longer create filter dir and deprecate FOLDER_FILTER constant.	COMMENT
LOW	zap/src/main/java/org/parosproxy/paros/Constant.java	101	// ZAP: 2019/09/16 Deprecate ZAP_HOMEPAGE and ZAP_EXTENSIONS_PAGE.	COMMENT
LOW	…n/java/org/parosproxy/paros/core/proxy/ProxyParam.java	21	*/	COMMENT
LOW	…/java/org/parosproxy/paros/core/proxy/ProxyServer.java	21	*/	COMMENT
LOW	…/java/org/parosproxy/paros/core/proxy/ProxyThread.java	21	*/	COMMENT
LOW	…/java/org/parosproxy/paros/core/proxy/ProxyThread.java	41	// ZAP: 2013/12/13 Issue 939: ZAP should accept SSL connections on non-standard ports automatically	COMMENT
LOW	…/java/org/parosproxy/paros/core/proxy/ProxyThread.java	61	// ZAP: 2016/04/13 Notify of timeouts when reading a response	COMMENT
LOW	…/java/org/parosproxy/paros/core/proxy/ProxyThread.java	81	// ZAP: 2017/10/02 Improve error handling when checking if SSL/TLS handshake.	COMMENT
LOW	…va/org/parosproxy/paros/core/proxy/ProxyThreadSSL.java	41	//	COMMENT
LOW	…osproxy/paros/core/scanner/AbstractAppParamPlugin.java	21	// ZAP: 2012/04/25 Added @Override annotation to the appropriate method and removed unnecessary	COMMENT
LOW	…a/org/parosproxy/paros/core/scanner/PluginFactory.java	21	// ZAP: 2011/08/30 Support for scanner levels	COMMENT
LOW	…a/org/parosproxy/paros/core/scanner/PluginFactory.java	41	// ZAP: 2015/07/25 Do not log error if the duplicated scanner is (apparently) a newer/older version	COMMENT
LOW	…in/java/org/parosproxy/paros/core/scanner/Scanner.java	21	// ZAP: 2011/05/15 Support for exclusions	COMMENT
LOW	…in/java/org/parosproxy/paros/core/scanner/Scanner.java	41	// ZAP: 2016/07/12 Do not allow techSet to be null	COMMENT
LOW	…a/org/parosproxy/paros/core/scanner/NameValuePair.java	21	// ZAP: 2013/07/02 Changed API to public because future extensible Variant model	COMMENT
LOW	…arosproxy/paros/core/scanner/VariantAbstractQuery.java	21	// ZAP: 2012/03/15 Changed the methods (the private) setParameter and paramAppend to	COMMENT
LOW	…org/parosproxy/paros/core/scanner/VariantURLQuery.java	21	// ZAP: 2012/02/21 Added logging	COMMENT
LOW	…rc/main/java/org/parosproxy/paros/core/scanner/Kb.java	21	// ZAP: 2012/04/25 Added type arguments to generic types, removed variables,	COMMENT
LOW	…ain/java/org/parosproxy/paros/core/scanner/Plugin.java	21	// ZAP: 2011/08/30 Support for scanner levels	COMMENT
LOW	…main/java/org/parosproxy/paros/core/scanner/Alert.java	21	// ZAP: 2011/12/04 Support deleting alerts	COMMENT
LOW	…main/java/org/parosproxy/paros/core/scanner/Alert.java	41	// report	COMMENT
LOW	…main/java/org/parosproxy/paros/core/scanner/Alert.java	61	// ZAP: 2021/04/30 Add input vector to Alert	COMMENT
LOW	…rg/parosproxy/paros/core/scanner/VariantFormQuery.java	21	// ZAP: 2012/04/25 Added @Override annotation to all appropriate method.	COMMENT
LOW	…ava/org/parosproxy/paros/core/scanner/HostProcess.java	21	// ZAP: 2011/05/15 Support for exclusions	COMMENT
LOW	…ava/org/parosproxy/paros/core/scanner/HostProcess.java	41	// ZAP: 2014/04/01 Changed to set a name to created threads.	COMMENT
LOW	…ava/org/parosproxy/paros/core/scanner/HostProcess.java	61	// ZAP: 2016/06/29 Allow to specify and obtain the reason why a scanner was skipped	COMMENT
LOW	…ava/org/parosproxy/paros/core/scanner/HostProcess.java	81	// ZAP: 2017/07/13 Automatically skip dependent scanners (Issue 3784)	COMMENT
LOW	…va/org/parosproxy/paros/core/scanner/ScannerParam.java	21	// ZAP: 2011/08/30 Support for scanner levels	COMMENT
LOW	…va/org/parosproxy/paros/core/scanner/ScannerParam.java	41	// ZAP: 2015/03/25 Issue 1573: Add option to inject plugin ID in header for all ascan requests	COMMENT
LOW	…/org/parosproxy/paros/core/scanner/AbstractPlugin.java	21	// ZAP: 2011/08/30 Support for scanner levels	COMMENT
LOW	…/org/parosproxy/paros/core/scanner/AbstractPlugin.java	41	// ZAP: 2014/02/21 Issue 1043: Custom active scan dialog	COMMENT
LOW	…/org/parosproxy/paros/core/scanner/AbstractPlugin.java	61	// ZAP: 2018/02/02 Add helper method to check if any of several techs is in scope.	COMMENT
LOW	…n/java/org/parosproxy/paros/core/scanner/Analyser.java	21	// ZAP: 2012/03/15 Changed the method getPathRegex to use the class StringBuilder	COMMENT
LOW	…n/java/org/parosproxy/paros/core/scanner/Analyser.java	41	// ZAP: 2017/12/29 Rely on HostProcess to validate the redirections.	COMMENT
LOW	…a/org/parosproxy/paros/extension/ExtensionAdaptor.java	21	// ZAP: 2011/11/20 Support for extension factory	COMMENT
LOW	…a/org/parosproxy/paros/extension/ExtensionAdaptor.java	41	// ZAP: 2015/03/30 Issue 1582: Enablers for low memory option	COMMENT
LOW	…/org/parosproxy/paros/extension/ExtensionHookMenu.java	21	// ZAP: 2012/01/12 Reflected the rename of the class ExtensionPopupMenu to	COMMENT
LOW	…/java/org/parosproxy/paros/extension/ViewDelegate.java	21	// ZAP: 2011/08/04 Changed to support new HttpPanel interface	COMMENT
97 more matches not shown…

Cross-Language Confusion (JS/TS)11 hits · 80 pts

Severity	File	Line	Snippet	Context
HIGH	…/integration_tests/configs/scripts/af_context_tests.js	27	print("Loading: " + files[i].getAbsolutePath());	CODE
HIGH⚡	…/integration_tests/configs/scripts/af_context_tests.js	47	print(progress.getErrors());	CODE
HIGH⚡	…/integration_tests/configs/scripts/af_context_tests.js	50	print(progress.getWarnings());	CODE
HIGH⚡	…/integration_tests/configs/scripts/af_context_tests.js	56	print("Generating: " + outFile.getAbsolutePath());	CODE
HIGH⚡	…/integration_tests/configs/scripts/af_context_tests.js	63	print("FAILED processing: " + files[i].getAbsolutePath());	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	19	print('==================');	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	20	print(hr.getHttpMessage().getRequestHeader());	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	21	print(hr.getHttpMessage().getRequestBody());	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	22	print('=========');	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	23	print(hr.getHttpMessage().getResponseHeader());	CODE
HIGH⚡	…tegration_tests/configs/scripts/standalone/af-diags.js	24	print(hr.getHttpMessage().getResponseBody());	CODE

Hyper-Verbose Identifiers48 hits · 51 pts

Severity	File	Line	Snippet	Context
LOW	docker/zap_common.py	497	def zap_wait_for_passive_scan(zap, timeout_in_secs = 0):	CODE
LOW	docker/zap_common.py	544	def get_latest_zap_client_version():	CODE
LOW	…n_tests/configs/scripts/session/session-mgmt-script.js	9	function clearWebSessionIdentifiers(sessionWrapper) {	CODE
LOW	…n_tests/configs/scripts/session/session-mgmt-script.js	12	function processMessageToMatchSession(sessionWrapper) {	CODE
LOW	docker/tests/test_zap_baseline_plan.py	75	def assert_plan_matches_fixture(self, args, fixture_name, config_content=None, url_content=None):	CODE
LOW	docker/tests/test_zap_baseline_plan.py	156	def test_plan_only_unsupported_option(self):	CODE
LOW	docker/tests/test_zap_baseline_plan.py	179	def test_plan_only_requires_mounted_workdir_in_docker(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	89	def test_load_custom_hooks_from_file_not_exists(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	94	def test_load_custom_hooks_from_file_exists(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	100	def assert_custom_hooks_loaded(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	104	def test_load_custom_hooks_from_file_with_errors(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	110	def test_load_custom_hooks_from_env_var_file_not_exists(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	116	def test_load_custom_hooks_from_env_var_file_exists(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	123	def test_load_custom_hooks_from_env_var_file_with_errors(self):	CODE
LOW⚡	docker/tests/test_zap_hooks.py	130	def test_load_config_triggers_hook(self):	CODE
LOW	docker/tests/test_zap_hooks.py	23	def custom_hooks_file_malformed():	CODE
LOW	docker/tests/test_zap_hooks.py	54	def test_trigger_hook_mismatch_exception(self):	CODE
LOW	docker/tests/test_zap_hooks.py	62	def test_trigger_hook_verify_calls(self):	CODE
LOW	docker/tests/test_zap_hooks.py	74	def test_trigger_hook_maintain_signature(self):	CODE
LOW	docker/tests/test_zap_hooks.py	144	def test_print_rules_triggers_hook(self):	CODE
LOW	docker/tests/test_zap_hooks.py	168	def test_start_zap_triggers_hook(self):	CODE
LOW	docker/tests/test_zap_hooks.py	181	def test_start_docker_zap_triggers_hook(self):	CODE
LOW	docker/tests/test_zap_hooks.py	199	def test_zap_access_target_triggers_hook(self):	CODE
LOW	docker/tests/test_zap_hooks.py	211	def test_zap_spider_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_hooks.py	227	def test_zap_ajax_spider_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_hooks.py	243	def test_zap_active_scan_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_hooks.py	258	def test_zap_get_alerts_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_hooks.py	275	def test_zap_import_context_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_hooks.py	292	def test_zap_set_scan_user_triggers_hooks(self):	CODE
LOW	docker/tests/test_zap_common.py	49	def test_zap_spider_raises_exception_if_not_started(self):	CODE
LOW	docker/tests/test_zap_common.py	81	def test_zap_ajax_spider_raises_exception_if_not_started(self):	CODE
LOW	docker/tests/test_zap_common.py	96	def test_zap_ajax_spider_with_max_time(self):	CODE
LOW	docker/tests/test_zap_common.py	125	def test_zap_active_scan_raises_exception_if_not_started(self):	CODE
LOW	docker/tests/test_zap_common.py	138	def test_zap_wait_for_passive_scan(self):	CODE
LOW	docker/tests/test_zap_common.py	151	def test_zap_wait_for_passive_scan_until_timeout(self):	CODE
LOW	docker/tests/test_zap_common.py	180	def test_zap_import_context_returns_none_if_not_imported(self):	CODE
LOW	docker/tests/test_zap_common.py	194	def test_zap_import_context_sets_users(self):	CODE
LOW	docker/tests/test_zap_common.py	214	def test_zap_spider_uses_imported_context(self):	CODE
LOW	docker/tests/test_zap_common.py	230	def test_zap_spider_uses_user(self):	CODE
LOW	docker/tests/test_zap_common.py	250	def test_zap_ajax_spider_uses_imported_context(self):	CODE
LOW	docker/tests/test_zap_common.py	266	def test_zap_ajax_spider_uses_user(self):	CODE
LOW	docker/tests/test_zap_common.py	286	def test_zap_active_scan_uses_imported_context(self):	CODE
LOW	docker/tests/test_zap_common.py	303	def test_zap_active_scan_uses_user(self):	CODE
LOW	docker/tests/test_zap_common.py	335	def test_zap_set_scan_user_with_one_user(self):	CODE
LOW	docker/tests/test_zap_common.py	348	def test_zap_set_scan_user_with_multiple_users(self):	CODE
LOW	docker/tests/test_zap_common.py	361	def test_zap_set_scan_user_with_no_users(self):	CODE
LOW	docker/tests/test_zap_common.py	372	def test_zap_set_scan_user_with_bad_user(self):	CODE
LOW	python/scripts/generic-pytest/conftest.py	5	def pytest_funcarg__zapconfig(request):	CODE

Fake / Example Data25 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	…onfigs/plans/auth-oauth2-custom-token-field-names.yaml	32	username: "test@test.com"	CODE
LOW	…on_tests/configs/plans/auth-json-bearer-js-cookie.yaml	26	username: "test@test.com"	CODE
LOW	…tion_tests/configs/plans/auth-password-added-json.yaml	26	username: "test@test.com"	CODE
LOW	…lans/auth-oauth2-password-grant-wrong-credentials.yaml	28	username: "test@test.com"	CODE
LOW	…/integration_tests/configs/plans/auth-simple-json.yaml	26	username: "test@test.com"	CODE
LOW	…on_tests/configs/plans/auth-oauth2-password-grant.yaml	28	username: "test@test.com"	CODE
LOW	…/plans/auth-client-script-simple-json-blocking-ui.yaml	27	username: "test@test.com"	CODE
LOW	…ient-script-simple-json-blocking-ui-scroll-fields.yaml	27	username: "test@test.com"	CODE
LOW	…ration_tests/configs/plans/auth-password-new-json.yaml	26	username: "test@test.com"	CODE
LOW	…/integration_tests/configs/plans/auth-ajax-simple.yaml	25	username: "test@test.com"	CODE
LOW	…/integration_tests/configs/plans/auth-json-bearer.yaml	26	username: "test@test.com"	CODE
LOW	…ion_tests/configs/plans/auth-password-hidden-json.yaml	26	username: "test@test.com"	CODE
LOW	…tion_tests/configs/plans/auth-non-std-json-bearer.yaml	26	username: "test@test.com"	CODE
LOW	…ntegration_tests/configs/plans/auth-client-simple.yaml	25	username: "test@test.com"	CODE
LOW	…n_tests/configs/plans/auth-simple-json-shadow-dom.yaml	26	username: "test@test.com"	CODE
LOW	…ation_tests/configs/plans/auth-json-bearer-cookie.yaml	26	username: "test@test.com"	CODE
LOW	…ization/BasicAuthorizationDetectionMethodUnitTest.java	55	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	…ization/BasicAuthorizationDetectionMethodUnitTest.java	55	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	…sion/pscan/scanner/DefaultRegexAutoTagScannerTest.java	56	private static final String BASE_STRING = "lorem ipsum < type= href= ";	CODE
LOW	…tension/pscan/scanner/RegexAutoTagScannerUnitTest.java	90	msg.setResponseBody(BODY.replace("@@body_two@@", "Lorem ipsum dolor sit amet, foo bar"));	CODE
LOW	…tension/pscan/scanner/RegexAutoTagScannerUnitTest.java	90	msg.setResponseBody(BODY.replace("@@body_two@@", "Lorem ipsum dolor sit amet, foo bar"));	CODE
LOW	…tension/pscan/scanner/RegexAutoTagScannerUnitTest.java	107	msg.setResponseBody(BODY.replace("@@body_two@@", "Lorem ipsum dolor sit amet, foo bar"));	CODE
LOW	…tension/pscan/scanner/RegexAutoTagScannerUnitTest.java	107	msg.setResponseBody(BODY.replace("@@body_two@@", "Lorem ipsum dolor sit amet, foo bar"));	CODE
LOW	…/authentication/VerificationMethodPollUrlUnitTest.java	46	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	…/authentication/VerificationMethodPollUrlUnitTest.java	46	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE

Structural Annotation Overuse9 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	…uthentication/ScriptBasedAuthenticationMethodType.java	835	// NOTE: This method will initialize a set of Credentials without any required parameters	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	827	// Step 3: initialize all (slow)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	829	// Step 4: initialize models (quick)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	831	// Step 5: initialize xmls (quick)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	833	// Step 6: initialize viewes (slow)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	835	// Step 7: initialize hooks (slowest)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	837	// Step 8: start all extensions(quick)	COMMENT
LOW⚡	…java/org/parosproxy/paros/control/AbstractControl.java	50	// Step 1: Loading Common Extensions	COMMENT
LOW⚡	…java/org/parosproxy/paros/control/AbstractControl.java	53	// Step 2: Loading Extensions (slow)	COMMENT

Verbosity Indicators8 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	827	// Step 3: initialize all (slow)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	829	// Step 4: initialize models (quick)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	831	// Step 5: initialize xmls (quick)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	833	// Step 6: initialize viewes (slow)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	835	// Step 7: initialize hooks (slowest)	COMMENT
LOW⚡	…va/org/parosproxy/paros/extension/ExtensionLoader.java	837	// Step 8: start all extensions(quick)	COMMENT
LOW⚡	…java/org/parosproxy/paros/control/AbstractControl.java	50	// Step 1: Loading Common Extensions	COMMENT
LOW⚡	…java/org/parosproxy/paros/control/AbstractControl.java	53	// Step 2: Loading Extensions (slow)	COMMENT

Deep Nesting11 hits · 11 pts

Severity	File	Line	Context
LOW	docker/zap-full-scan.py	109	CODE
LOW	docker/zap_common.py	148	CODE
LOW	docker/zap_common.py	248	CODE
LOW	docker/zap-baseline.py	158	CODE
LOW	docker/zap-baseline.py	232	CODE
LOW	docker/zap-api-scan.py	132	CODE
LOW	docker/tests/test_zap_baseline_plan.py	37	CODE
LOW	docker/tests/test_zap_baseline_plan.py	156	CODE
LOW	docker/tests/test_zap_baseline_plan.py	179	CODE
LOW	python/scripts/wavsep/wavsep.py	43	CODE
LOW	python/scripts/generic-pytest/test_zap.py	83	CODE

Slop Phrases3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/zap-full-scan.py	27	# By default it will spider the target URL with no time limit, but you can change	COMMENT
MEDIUM	docker/zap-baseline.py	27	# By default it will spider the target URL for one minute, but you can change	COMMENT
MEDIUM	docker/zap-api-scan.py	49	# file but you can change them by supplying a configuration file with the rules	COMMENT

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/zap-full-scan.py	408	# Create the config file	COMMENT
MEDIUM	docker/zap-baseline.py	610	# Create the config file	COMMENT
MEDIUM	docker/zap-api-scan.py	536	# Create the config file	COMMENT

Unused Imports8 hits · 8 pts

Severity	File	Line	Context
LOW	docker/zap-full-scan.py	56	CODE
LOW	docker/zap-baseline.py	57	CODE
LOW	docker/zap-api-scan.py	57	CODE
LOW	docker/zap-api-scan.py	64	CODE
LOW	docker/tests/test_zap_hooks.py	5	CODE
LOW	docker/tests/suite.py	5	CODE
LOW	docker/tests/test_zap_common.py	2	CODE
LOW	docker/tests/test_zap_common.py	6	CODE

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	python/scripts/wavsep/wavsep.py	44	# -------------------------------------------------------------------------	COMMENT
MEDIUM	python/scripts/wavsep/wavsep.py	46	# -------------------------------------------------------------------------	COMMENT

Excessive Try-Catch Wrapping2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	docker/zap_common.py	549	except Exception as e:	CODE
MEDIUM	docker/zap_common.py	332	def start_docker_zap(docker_image, port, extra_zap_params, mount_dir):	CODE

AI Slop Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	docker/zap-webswing.sh	5	# Customised for ZAP running in Docker - just call with no parameters for webswing to start and leave	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	docker/integration_tests/baseline_tests.sh	44	# Output the results file as is - this can be copied into the results dir if its valid	COMMENT

zaproxy/zaproxy

Open-Source Code Quality, Security and Technical Debt Review