0.6

Adjusted Signal

0.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

15.5K

Stars

Language

1.3M

Lines of Code

5.4K

Files

585

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 382 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.1/100 · LOW

Are imports declared and package/API names verified? 195 finding(s).

Agent Over-Engineering Ratio 0.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 95 finding(s).

PR Review Velocity Impact 2.7/100 · LOW

Which changes need focused human review? 585 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 10HIGH 1MEDIUM 13LOW 561

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 585 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block262 hits · 256 pts

Severity	File	Line	Snippet	Context
LOW	API_DESIGN.md	601	// reset for the user. Please check the required format and supported algorithms: <Link to documentation>.	COMMENT
LOW	API_DESIGN.md	621	//	COMMENT
LOW	benchmark/src/user.ts	21	// then returns no user at all. Retry briefly rather than resolving undefined, which	COMMENT
LOW	benchmark/src/user.ts	81	//	COMMENT
LOW	cmd/defaults.yaml	1	Instrumentation:	COMMENT
LOW	cmd/defaults.yaml	21	Exporter:	COMMENT
LOW	cmd/defaults.yaml	41	# The following exporter types are supported:	COMMENT
LOW	cmd/defaults.yaml	61	Log:	COMMENT
LOW	cmd/defaults.yaml	81	# (e.g. added via slog.Any), the entire value is replaced with Value and its structure is not preserved.	COMMENT
LOW	cmd/defaults.yaml	101	Errors:	COMMENT
LOW	cmd/defaults.yaml	141		COMMENT
LOW	cmd/defaults.yaml	161	ServiceName: "ZITADEL" #ZITADEL_TRACING_SERVICENAME	COMMENT
LOW	cmd/defaults.yaml	181	# If one endpoint returns an unsuccessful response code or times out,	COMMENT
LOW	cmd/defaults.yaml	201	Port: 8080 # ZITADEL_PORT	COMMENT
LOW	cmd/defaults.yaml	221	# Private key of the TLS certificate (KeyPath has a higher priority than Key)	COMMENT
LOW	cmd/defaults.yaml	241	# Ordered header name list, which will be used as the public host	COMMENT
LOW	cmd/defaults.yaml	321	# Note: ZITADEL ignores the `/db` path when selecting Redis databases; DBs are chosen	COMMENT
LOW	cmd/defaults.yaml	341	# This option offsets the first DB so it doesn't conflict with other databases on the same server.	COMMENT
LOW	cmd/defaults.yaml	361	# - `-2` - disables SetReadDeadline calls completely.	COMMENT
LOW	cmd/defaults.yaml	381	# Default is ReadTimeout + 1 second.	COMMENT
LOW	cmd/defaults.yaml	401	# If <= 0, connections are not closed due to a connection's age.	COMMENT
LOW	cmd/defaults.yaml	481	# Use private IP to identify machines uniquely	COMMENT
LOW	cmd/defaults.yaml	501	# AWS ECS v4 Configuration: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-metadata-endpoint-v4.ht	COMMENT
LOW	cmd/defaults.yaml	521	# The Projections section defines the behavior for the scheduled and synchronous events projections.	COMMENT
LOW	cmd/defaults.yaml	601	# Automatically cancel the notification after the amount of failed attempts	COMMENT
LOW	cmd/defaults.yaml	821	EncryptionKeyID: "targetKey" # ZITADEL_ENCRYPTIONKEYS_TARGET_ENCRYPTIONKEYID	COMMENT
LOW	cmd/defaults.yaml	841	# # key or a public X.509 certificate	COMMENT
LOW	cmd/defaults.yaml	921	MaxRounds: 31 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_LIMITS_PHPASS_MAXROUNDS	COMMENT
LOW	cmd/defaults.yaml	941	# - "bcrypt"	COMMENT
LOW	cmd/defaults.yaml	1041	CertificateLifetime: 8766h # ZITADEL_SYSTEMDEFAULTS_KEYCONFIG_CERTIFICATELIFETIME	COMMENT
LOW	cmd/defaults.yaml	1101	# If enabled, the thresholds below are applied to the eventstore.events2 table	COMMENT
LOW	cmd/defaults.yaml	1501	AllowedLanguages: # ZITADEL_DEFAULTINSTANCE_RESTRICTIONS_ALLOWEDLANGUAGES	COMMENT
LOW	cmd/defaults.yaml	1521	# - Unit: "requests.all.authenticated"	COMMENT
LOW	cmd/defaults.yaml	1541	# AuditLogRetention limits the number of events that can be queried via the events API by their age.	COMMENT
LOW	cmd/defaults.yaml	1561	# If one report fails, it will be retried up to this number of times.	COMMENT
LOW	cmd/setup/steps.yaml	1	Instrumentation:	COMMENT
LOW	cmd/setup/steps.yaml	21	# Interval for batching traces before export	COMMENT
LOW	cmd/setup/steps.yaml	61	# regardless of their position in the attribute hierarchy.	COMMENT
LOW	cmd/setup/steps.yaml	81	Format: "disabled" # ZITADEL_INSTRUMENTATION_LOG_STDERR	COMMENT
LOW	cmd/mirror/defaults.yaml	1	Instrumentation:	COMMENT
LOW	cmd/mirror/defaults.yaml	21	# Interval for batching traces before export	COMMENT
LOW	cmd/mirror/defaults.yaml	61	# regardless of their position in the attribute hierarchy.	COMMENT
LOW	cmd/mirror/defaults.yaml	81	Format: "disabled" # ZITADEL_INSTRUMENTATION_LOG_STDERR	COMMENT
LOW	deploy/compose/docker-compose.test.yml	1	# Test overlay: replaces published images with locally-built ones.	COMMENT
LOW	tests/functional-ui/cypress/support/e2e.ts	1	// ***********************************************************	COMMENT
LOW	internal/idp/providers/ldap/fetch_user_mock.go	21	// FetchUser implements the [idp.Session] interface.	COMMENT
LOW	internal/crypto/hmac.go	1	package crypto	COMMENT
LOW	internal/cache/cache.go	21	PurposeFederatedLogout	COMMENT
LOW	internal/cache/cache.go	41	// Get an object through specified index.	COMMENT
LOW	internal/cache/cache.go	61		COMMENT
LOW	internal/cache/connector/redis/connector.go	21		COMMENT
LOW	internal/cache/connector/redis/connector.go	41	// This can have destructive consequences when overlapping DB namespaces are used.	COMMENT
LOW	internal/cache/connector/redis/connector.go	61	// - `-2` - disables SetReadDeadline calls completely.	COMMENT
LOW	internal/cache/connector/redis/connector.go	81	// are busy before returning an error.	COMMENT
LOW	…pository/eventsourcing/eventstore/auth_request_test.go	2441	tests := []struct {	COMMENT
LOW	internal/integration/sink/sink.go	1	// Package sink provides a simple HTTP server where Zitadel can send HTTP based messages,	COMMENT
LOW	internal/zerrors/zerror.go	41	// KindPermissionDenied indicates that the caller doesn't have permission to	COMMENT
LOW	internal/eventstore/config.go	21	// AutovacuumConfig configures table-level autovacuum and autoanalyze tuning	COMMENT
LOW	internal/eventstore/event.go	21	// Type describes the action	COMMENT
LOW	internal/eventstore/handler/v2/statement_test.go	1681	// type fields struct {	COMMENT
202 more matches not shown…

Fake / Example Data185 hits · 180 pts

Severity	File	Line	Snippet	Context
LOW	…l-ui/cypress/e2e/instance/settings/notifications.cy.ts	41	cy.get('input[name="smtp-user"]').should('be.enabled').clear().type('user@example.com');	CODE
LOW	…l-ui/cypress/e2e/instance/settings/notifications.cy.ts	62	cy.get('input[name="smtp-user"]').should('be.enabled').clear().type('user@example.com');	CODE
LOW⚡	internal/eventstore/bench_payload.txt	1	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla nec pharetra neque. Nam viverra elit lorem, sit amet euis	CODE
LOW⚡	internal/eventstore/bench_payload.txt	1	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla nec pharetra neque. Nam viverra elit lorem, sit amet euis	CODE
LOW⚡	internal/eventstore/bench_payload.txt	5	Duis convallis, dui aliquet imperdiet aliquam, nisl sem vehicula nisi, eleifend dignissim velit nunc nec sem. In euismod	CODE
LOW⚡	internal/eventstore/bench_payload.txt	5	Duis convallis, dui aliquet imperdiet aliquam, nisl sem vehicula nisi, eleifend dignissim velit nunc nec sem. In euismod	CODE
LOW⚡	…api/scim/resources/filter/filter_query_builder_test.go	265	filter: `userName eq "Hans" and emails[value ew "@example.org" or value ew "@example.com"]`,	CODE
LOW⚡	…api/scim/resources/filter/filter_query_builder_test.go	269	test.Must(query.NewTextQuery(query.HumanEmailCol, "@example.org", query.TextEndsWith)),	CODE
LOW⚡	…api/scim/resources/filter/filter_query_builder_test.go	276	filter: `emails[value ew "@example.org" and value co "@example.com"] or emails[value sw "hans" or value sw "peter"]`,	CODE
LOW⚡	…api/scim/resources/filter/filter_query_builder_test.go	279	test.Must(query.NewTextQuery(query.HumanEmailCol, "@example.org", query.TextEndsWith)),	CODE
LOW	…api/scim/resources/filter/filter_query_builder_test.go	307	filter: `emails[not(value ew "@example.org" or value ew "@example.com")]`,	CODE
LOW	…api/scim/resources/filter/filter_query_builder_test.go	310	test.Must(query.NewTextQuery(query.HumanEmailCol, "@example.org", query.TextEndsWith)),	CODE
LOW	internal/api/grpc/oidc/v2beta/oidc_test.go	36	LoginHint: gu.Ptr("foo@bar.com"),	CODE
LOW	internal/api/grpc/oidc/v2beta/oidc_test.go	56	LoginHint: gu.Ptr("foo@bar.com"),	CODE
LOW	internal/api/grpc/oidc/v2/oidc_test.go	36	LoginHint: gu.Ptr("foo@bar.com"),	CODE
LOW	internal/api/grpc/oidc/v2/oidc_test.go	56	LoginHint: gu.Ptr("foo@bar.com"),	CODE
LOW	…ernal/api/grpc/user/v2/integration_test/intent_test.go	1402	LoginHint: "user@example.com",	CODE
LOW	…ernal/api/grpc/user/v2/integration_test/intent_test.go	1414	"login_hint": "user@example.com",	CODE
LOW	internal/api/grpc/user/v2/convert/user_test.go	87	DisplayName: "John Doe",	CODE
LOW	internal/api/oidc/auth_request_test.go	41	logoutHint: "user@example.com",	CODE
LOW	internal/api/oidc/auth_request_test.go	44	"logout_hint": "user@example.com",	CODE
LOW	internal/api/oidc/userinfo_test.go	224	Email: "foo@bar.com",	CODE
LOW	internal/api/oidc/userinfo_test.go	349	Email: "foo@bar.com",	CODE
LOW	internal/command/idp_intent_test.go	649	loginHint: "user@example.com",	CODE
LOW	internal/query/user_login_name_exists_test.go	115	emailQuery, err := NewUserEmailSearchQuery("user@example.com", TextEqualsIgnoreCase)	CODE
LOW	internal/query/user_login_name_exists_test.go	233	emailQuery, err := NewUserEmailSearchQuery("user@example.com", TextEqualsIgnoreCase)	CODE
LOW	internal/query/user_login_name_exists_test.go	253	assert.Contains(t, args, "user@example.com")	CODE
LOW	internal/query/user_login_name_exists_test.go	260	emailQuery, err := NewUserEmailSearchQuery("user@example.com", TextEqualsIgnoreCase)	CODE
LOW	internal/query/user_login_name_exists_test.go	280	assert.Contains(t, args, "user@example.com")	CODE
LOW	internal/query/user_login_name_exists_test.go	285	emailQuery, err := NewUserEmailSearchQuery("user@example.com", TextEqualsIgnoreCase)	CODE
LOW	internal/query/user_login_name_exists_test.go	305	assert.Contains(t, args, "user@example.com")	CODE
LOW	internal/query/user_login_name_exists_test.go	656	emailQuery, err := NewUserEmailSearchQuery("user@example.com", TextEqualsIgnoreCase)	CODE
LOW	internal/query/user_login_name_exists_test.go	675	assert.Contains(t, args, "user@example.com")	CODE
LOW	internal/domain/org_domain_test.go	60	orgName: "Lorem ipsum dolor sit amet",	CODE
LOW	internal/domain/org_domain_test.go	60	orgName: "Lorem ipsum dolor sit amet",	CODE
LOW	…d/v3/api/session/v2/convert/session_check_user_test.go	39	Search: &session_grpc.CheckUser_LoginName{LoginName: "user@example.com"},	CODE
LOW	…d/v3/api/session/v2/convert/session_check_user_test.go	41	expectedDomainCheckUser: &domain.CheckUserType{LoginName: "user@example.com"},	CODE
LOW	backend/v3/domain/session_challenge_passkey_test.go	980	Address: "user@example.com",	CODE
LOW⚡	backend/v3/domain/session_check_user_test.go	224	repo.LoginNameCondition(database.TextOperationEqual, "user@example.com"),	CODE
LOW⚡	backend/v3/domain/session_check_user_test.go	230	LoginNames: []domain.LoginName{{LoginName: "user@example.com"}},	CODE
LOW⚡	backend/v3/domain/session_check_user_test.go	237	InputCheckUser: &domain.CheckUserType{LoginName: "user@example.com"},	CODE
LOW	apps/login/src/app/(login)/signedin/page.test.tsx	43	factors: { user: { id: "user-1", loginName: "user@example.com", displayName: "User", organizationId: "org-1" } },	CODE
LOW	apps/login/src/app/(login)/device/consent/page.test.tsx	43	factors: { user: { id: "user-1", loginName: "user@example.com", displayName: "User", organizationId: "org-1" } },	CODE
LOW	apps/login/src/app/(login)/device/consent/page.test.tsx	114	expect(UserAvatar).toHaveBeenCalledWith(expect.objectContaining({ loginName: "user@example.com" }), undefined);	CODE
LOW	apps/login/src/components/input.test.tsx	29	const { container } = render(<TextInput label="Name" defaultValue="John Doe" />);	CODE
LOW	apps/login/src/components/input.test.tsx	31	expect(input?.defaultValue).toBe("John Doe");	CODE
LOW	apps/login/src/components/avatar.test.tsx	30	const initials = getInitials("John Doe", "john.doe@example.com");	CODE
LOW	apps/login/src/components/avatar.test.tsx	67	const { container } = render(<Avatar name="John Doe" loginName="john@example.com" />);	CODE
LOW⚡	apps/login/src/lib/auth-utils.test.ts	20	expect(equalsIgnoreCase("user@example.com", "user@other.com")).toBe(false);	CODE
LOW⚡	apps/login/src/lib/auth-utils.test.ts	24	expect(equalsIgnoreCase(undefined, "user@example.com")).toBe(false);	CODE
LOW⚡	apps/login/src/lib/auth-utils.test.ts	25	expect(equalsIgnoreCase("user@example.com", undefined)).toBe(false);	CODE
LOW	apps/login/src/lib/verify-helper.test.ts	366	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/verify-helper.test.ts	477	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/verify-helper.test.ts	562	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/verify-helper.test.ts	755	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/cookies.test.ts	112	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/cookies.test.ts	155	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/cookies.test.ts	280	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/cookies.test.ts	649	loginName: "user@example.com",	CODE
LOW	apps/login/src/lib/cookies.test.ts	803	await expect(getSessionCookieByLoginName({ loginName: "user@example.com" })).resolves.toBeUndefined();	CODE
125 more matches not shown…

Hallucination Indicators10 hits · 100 pts

Severity	File	Line	Snippet	Context
CRITICAL	cmd/setup/03.go	123	mig.instanceSetup.Org.Human.Email.Address = mig.instanceSetup.Org.Human.Email.Address.Normalize()	CODE
CRITICAL	backend/v3/storage/database/repository/user_test.go	2666	assert.False(t, u.Human.Email.OTP.EnabledAt.Equal(now))	CODE
CRITICAL	backend/v3/storage/database/repository/user_test.go	2702	assert.False(t, u.Human.Email.OTP.LastSuccessfullyCheckedAt.Equal(now))	CODE
CRITICAL	backend/v3/storage/database/repository/user_human.go	136	if user.Human.Password.PendingVerification.ExpiresAt != nil && !user.Human.Password.PendingVerification.ExpiresAt.IsZe	CODE
CRITICAL	backend/v3/storage/database/repository/user_human.go	163	if user.Human.Email.PendingVerification.ExpiresAt != nil && !user.Human.Email.PendingVerification.ExpiresAt.IsZero() {	CODE
CRITICAL	backend/v3/storage/database/repository/user_human.go	198	if user.Human.Phone.PendingVerification.ExpiresAt != nil && !user.Human.Phone.PendingVerification.ExpiresAt.IsZero() {	CODE
CRITICAL	backend/v3/storage/database/repository/user_human.go	233	if user.Human.Invite.PendingVerification.ExpiresAt != nil && !user.Human.Invite.PendingVerification.ExpiresAt.IsZero()	CODE
CRITICAL	backend/v3/domain/session_challenge_otp_sms.go	122	if retrievedUser.Human.Phone.OTP.EnabledAt.IsZero() {	CODE
CRITICAL	backend/v3/domain/session_challenge_otp_email.go	118	if retrievedUser.Human.Email.OTP.EnabledAt.IsZero() {	CODE
CRITICAL	…c/app/modules/smtp-provider/smtp-provider.component.ts	251	scopes: state.config.config.value.Auth.value.scopes.join(','),	CODE

Hyper-Verbose Identifiers87 hits · 87 pts

Severity	File	Line	Snippet	Context
LOW	tests/functional-ui/cypress/support/api/sms.ts	21	export function ensureSMSProviderDoesntExist(api: API) {	CODE
LOW	…onal-ui/cypress/support/api/external-links-settings.ts	4	export function ensureExternalLinksSettingsSet(api: API, tosLink: string, privacyPolicyLink: string, docsLink: string) {	CODE
LOW	tests/functional-ui/cypress/support/api/projects.ts	37	export function ensureProjectResourceDoesntExist(	CODE
LOW	tests/functional-ui/cypress/support/api/grants.ts	21	export function ensureProjectGrantDoesntExist(ctx: Context, projectId: number, foreignOrgId: string) {	CODE
LOW	tests/functional-ui/cypress/support/api/members.ts	5	export function ensureHumanIsNotOrgMember(api: API, username: string) {	CODE
LOW	tests/functional-ui/cypress/support/api/members.ts	36	export function ensureHumanIsNotProjectMember(	CODE
LOW	tests/functional-ui/cypress/support/api/members.ts	50	export function ensureHumanIsProjectMember(	CODE
LOW	internal/api/ui/login/static/resources/scripts/theme.js	16	function hasDarkModeOverwriteCookie() {	CODE
LOW	internal/api/ui/login/static/resources/scripts/theme.js	20	function hasLightModeOverwriteCookie() {	CODE
LOW	…/ui/login/static/resources/scripts/loginname_suffix.js	1	function RenderDefaultLoginnameSuffix() {	CODE
LOW	packages/zitadel-client/src/interceptors.ts	7	export function NewAuthorizationBearerInterceptor(token: string): Interceptor {	CODE
LOW	apps/docs/scripts/clean-openapi.ts	29	function removeAdditionalPropertiesFalse(obj: any) {	CODE
LOW	apps/login/acceptance/tests/login.ts	28	export async function loginWithPasswordAndEmailOTP(page: Page, username: string, password: string, email: string) {	CODE
LOW	apps/login/acceptance/tests/login.ts	33	export async function loginWithPasswordAndPhoneOTP(page: Page, username: string, password: string, phone: string) {	CODE
LOW	apps/login/acceptance/tests/passkey.ts	71	async function simulateSuccessfulPasskeyRegister(	CODE
LOW	apps/login/acceptance/tests/passkey.ts	91	async function simulateSuccessfulPasskeyInput(	CODE
LOW	apps/login/acceptance/tests/password-screen.ts	34	export async function changePasswordScreenExpect(	CODE
LOW	apps/login/acceptance/tests/password-screen.ts	83	export async function resetPasswordScreenExpect(	CODE
LOW	apps/login/acceptance/tests/register-screen.ts	6	export async function registerUserScreenPassword(page: Page, firstname: string, lastname: string, email: string) {	CODE
LOW	apps/login/acceptance/tests/register-screen.ts	11	export async function registerUserScreenPasskey(page: Page, firstname: string, lastname: string, email: string) {	CODE
LOW	apps/login/src/instrumentation.ts	67	async function logSessionCookieSecretNotice(): Promise<void> {	CODE
LOW	…login/src/components/choose-authenticator-to-login.tsx	12	export function ChooseAuthenticatorToLogin({ authMethods, params, loginSettings }: Props) {	CODE
LOW	…/login/src/components/register-form-idp-incomplete.tsx	43	export function RegisterFormIDPIncomplete({	CODE
LOW	…login/src/components/choose-second-factor-to-setup.tsx	28	export function ChooseSecondFactorToSetup({	CODE
LOW	…s/login/src/components/authentication-method-radio.tsx	13	export function AuthenticationMethodRadio({	CODE
LOW	…login/src/components/choose-authenticator-to-setup.tsx	13	export function ChooseAuthenticatorToSetup({ authMethods, params, loginSettings }: Props) {	CODE
LOW	apps/login/src/components/login-passkey.tsx	74	async function updateOrCreateSessionForChallenge(	CODE
LOW	apps/login/src/components/theme-switch.tsx	14	function getThemeSwitchCardAppearance(): string {	CODE
LOW	apps/login/src/components/language-switcher.tsx	14	function getLanguageSwitcherRoundness(): string {	CODE
LOW	apps/login/src/components/language-switcher.tsx	19	function getLanguageSwitcherCardAppearance(): string {	CODE
LOW	apps/login/src/components/register-u2f.tsx	60	async function submitRegisterAndContinue(): Promise<boolean \| void \| null> {	CODE
LOW	apps/login/src/components/button.tsx	57	function getDefaultButtonRoundness(): string {	CODE
LOW	apps/login/src/components/button.tsx	62	function getDefaultButtonAppearance(): string {	CODE
LOW	apps/login/src/components/session-item.tsx	19	export function isSessionPrimaryFactorAndLifetimeValid(session: Partial<Session>): {	CODE
LOW	apps/login/src/components/idps/base-button.tsx	18	function getDefaultIdpButtonAppearance(): string {	CODE
LOW	apps/login/src/lib/auth-utils.ts	34	export function getValidLocaleFromUILocales(uiLocales: string[] \| undefined): string \| null {	CODE
LOW	apps/login/src/lib/themeUtils.tsx	25	export function getButtonRoundnessClasses(roundness: string) {	CODE
LOW	apps/login/src/lib/i18n.ts	72	export function shouldUILocalesOverrideCookie(): boolean {	CODE
LOW	apps/login/src/lib/client-utils.ts	10	export function handleServerActionResponse(	CODE
LOW	apps/login/src/lib/verification-check.ts	30	export async function setUserVerificationCheckCookie(userId: string): Promise<void> {	CODE
LOW	apps/login/src/lib/verification-check.ts	43	export async function hasValidUserVerificationCheckCookie(userId: string): Promise<boolean> {	CODE
LOW	apps/login/src/lib/session-cookie-signature.ts	71	export function getSessionCookieSecretConfigError(): string \| undefined {	CODE
LOW	apps/login/src/lib/session-cookie-signature.ts	110	export function isUsingCredentialFallback(): boolean {	CODE
LOW	apps/login/src/lib/session-cookie-signature.ts	117	export function getSessionCookieSecretStartupNotice(): { level: "error" \| "warn"; message: string } \| undefined {	CODE
LOW	apps/login/src/lib/legal-links.ts	3	export function resolveLocalizedLegalLink(link: string \| undefined, locale: string \| undefined): string \| undefined {	CODE
LOW	apps/login/src/lib/verify-helper.ts	9	export function checkPasswordChangeRequired(	CODE
LOW	apps/login/src/lib/zitadel.ts	97	export async function getHostedLoginTranslation({	CODE
LOW	apps/login/src/lib/zitadel.ts	228	export async function getPasswordExpirySettings({ serviceConfig, orgId }: WithServiceConfig<{ orgId?: string }>) {	CODE
LOW	apps/login/src/lib/zitadel.ts	287	export async function getLegalAndSupportSettings({	CODE
LOW	apps/login/src/lib/zitadel.ts	308	export async function getPasswordComplexitySettings({	CODE
LOW	apps/login/src/lib/zitadel.ts	329	export async function createSessionFromChecksAndChallenges({	CODE
LOW	apps/login/src/lib/zitadel.ts	346	export async function createSessionForUserIdAndIdpIntent({	CODE
LOW	apps/login/src/lib/zitadel.ts	935	export async function startIdentityProviderFlow({	CODE
LOW	apps/login/src/lib/zitadel.ts	977	export async function startLDAPIdentityProviderFlow({	CODE
LOW	apps/login/src/lib/zitadel.ts	1014	export async function getDeviceAuthorizationRequest({	CODE
LOW	apps/login/src/lib/zitadel.ts	1027	export async function authorizeOrDenyDeviceAuthorization({	CODE
LOW	apps/login/src/lib/zitadel.ts	1250	export async function createPasskeyRegistrationLink({	CODE
LOW	apps/login/src/lib/zitadel.ts	1314	export async function getActiveIdentityProviders({	CODE
LOW	apps/login/src/lib/zitadel.ts	1337	export async function verifyPasskeyRegistration({	CODE
LOW	apps/login/src/lib/zitadel.ts	1381	export async function listAuthenticationMethodTypes({	CODE
27 more matches not shown…

Decorative Section Separators8 hits · 24 pts

Severity	File	Line	Snippet	Context
MEDIUM	apps/docs/scripts/install-proto-plugins.sh	16	# ── VERSIONS & CHECKSUMS ────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/docs/scripts/install-proto-plugins.sh	28	# ── HELPERS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/docs/scripts/install-proto-plugins.sh	46	# ── PLATFORM DETECTION ───────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/docs/scripts/install-proto-plugins.sh	67	# ── INSTALL ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	console/scripts/install-proto-plugins.sh	16	# ── VERSIONS & CHECKSUMS ────────────────────────────────────────────────────	COMMENT
MEDIUM	console/scripts/install-proto-plugins.sh	40	# ── HELPERS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	console/scripts/install-proto-plugins.sh	58	# ── PLATFORM DETECTION ───────────────────────────────────────────────────────	COMMENT
MEDIUM	console/scripts/install-proto-plugins.sh	79	# ── INSTALL ───────────────────────────────────────────────────────────────────	COMMENT

Verbosity Indicators9 hits · 17 pts

Severity	File	Line	Snippet	Context
LOW	…/api/ui/login/integration_test/username_change_test.go	106	// Step 1: create a Login V1 auth request by hitting the OIDC authorize endpoint WITHOUT the	COMMENT
LOW⚡	…/api/ui/login/integration_test/username_change_test.go	121	// Step 2: load the login page. This renders the login form and lets us scrape the CSRF token,	COMMENT
LOW⚡	…/api/ui/login/integration_test/username_change_test.go	126	// Step 3: the binding. POST the victim's login name. handleLoginNameCheck -> checkLoginName ->	COMMENT
LOW	…/api/ui/login/integration_test/username_change_test.go	148	// Step 4: the attack. POST a new username. Before the fix this renamed the bound victim; the fix	COMMENT
LOW	…l/api/ui/login/integration_test/external_login_test.go	134	// Step 1: create a Login V1 auth request by hitting the OIDC authorize endpoint WITHOUT the	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	149	// Step 2: load the login page. This renders the login form and lets us scrape the CSRF token	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	154	// Step 3: select the external IDP. handleExternalLogin -> handleIDP persists SelectedIDPConfigID on	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	163	// Step 4: the attack. POST forged "external account not found" data. Every external-* field below is	COMMENT
LOW	apps/login/src/lib/server/password.ts	487	// if the user has no authmethods set, we need to check if the user was verified	COMMENT

Structural Annotation Overuse8 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	…/api/ui/login/integration_test/username_change_test.go	106	// Step 1: create a Login V1 auth request by hitting the OIDC authorize endpoint WITHOUT the	COMMENT
LOW⚡	…/api/ui/login/integration_test/username_change_test.go	121	// Step 2: load the login page. This renders the login form and lets us scrape the CSRF token,	COMMENT
LOW⚡	…/api/ui/login/integration_test/username_change_test.go	126	// Step 3: the binding. POST the victim's login name. handleLoginNameCheck -> checkLoginName ->	COMMENT
LOW	…/api/ui/login/integration_test/username_change_test.go	148	// Step 4: the attack. POST a new username. Before the fix this renamed the bound victim; the fix	COMMENT
LOW	…l/api/ui/login/integration_test/external_login_test.go	134	// Step 1: create a Login V1 auth request by hitting the OIDC authorize endpoint WITHOUT the	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	149	// Step 2: load the login page. This renders the login form and lets us scrape the CSRF token	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	154	// Step 3: select the external IDP. handleExternalLogin -> handleIDP persists SelectedIDPConfigID on	COMMENT
LOW⚡	…l/api/ui/login/integration_test/external_login_test.go	163	// Step 4: the attack. POST forged "external account not found" data. Every external-* field below is	COMMENT

Example Usage Blocks6 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	deploy/compose/docker-compose.test.yml	7	# Usage:	COMMENT
LOW	backend/v3/storage/database/repository/org.go	205	// Example usage:	COMMENT
LOW	backend/v3/storage/database/repository/org.go	230	// Example usage:	COMMENT
LOW	backend/v3/storage/database/repository/instance.go	192	// Example usage:	COMMENT
LOW	backend/v3/storage/database/repository/project_grant.go	201	// Example usage:	COMMENT
LOW	backend/v3/instrumentation/logging/logging.go	15	// Example usage:	COMMENT

Slop Phrases3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/defaults.yaml	1580	# so you can adjust the bulk size if you see that the requests are too large.	COMMENT
LOW	internal/query/projection/projection.go	205	// Don't forget to add the new field handler to [ProjectInstanceFields]	COMMENT
MEDIUM	apps/login/acceptance/oidcrp/main.go	111	// for demonstration purposes the returned userinfo response is written as JSON object onto response	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…th/repository/eventsourcing/eventstore/auth_request.go	871	// discovery was allowed, so set the org as requested org	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	backend/v3/storage/database/query.go	155	// these objects are basically string builders, so we can leverage their String()	COMMENT
MEDIUM	apps/docs/components/version-selector.tsx	26	// Let's implement robust segment swapping.	COMMENT

TODO Padding3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	internal/command/preparation/command_test.go	155	// TODO: Add test cases.	COMMENT
LOW	backend/v3/storage/database/condition.go	395	// TODO: implement actual permission check once we have the necessary tables and functions in place.	COMMENT
LOW	backend/v3/domain/session_delete.go	68	database.PermissionCheck(SessionDeletePermission, true), // TODO: implement check once permissions are implemented	CODE

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	deploy/compose/docker-compose.test.yml	18	# Create an IAM_OWNER machine user and write its PAT to the bootstrap volume.	COMMENT

zitadel/zitadel

Open-Source Code Quality, Security and Technical Debt Review