The Rateo engine, run on Candidate A, a Laravel 13 take home assignment. Every number below comes from the engine's output, which is linked in full at the end.
Names that identify the project or its authors are replaced by stand ins of the same length, so every number on this page is what the engine prints for the original code.
2026.10.122026.10.7-provisional1b09335f7d67bbb055b533c9f374ba48b3ee423f4ceb1286975cfd3a33b6c8e9build/rateo candidate-a --cache=noneplatform PHP: Laravel (composer.json requires laravel/framework; artisan)
not analysed: 68 files (Markdown 37, Ignore List 13, JSON 5, Shell 2, ApacheConf 1, EditorConfig 1, Git Attributes 1, NEON 1, NPM Config 1, SQL 1, Text 1, XML 1, YAML 1, ico 1, robots.txt 1)
eval, shell commands, unserialize and includes built from data, SQL with values pasted in, request input never sanitized, output never escaped.gitignore, a lockfile, no committed vendor/ or .env, a README with setup stepsThe security checks read one call or statement at a time and never follow a value through variables, so they show where to look, not proof of a hole. A long or branchy function is common in a large, mature project; each finding is a place worth a closer look, not a judgement of the code as a whole.
| Check | Limits (warning / error) | Warnings | Errors | Total |
|---|---|---|---|---|
| Size | ||||
length.functionA function or method body with too many lines | body lines: above 50 / above 100 | 1 | 0 | 1 |
| Duplication | ||||
duplication.repeated_blockA block repeated later in the same file, even with its names changed | tokens: 50 or more / never an error | 14 | 0 | 14 |
| Naming | ||||
naming.inconsistent_styleA name in a different style from most names of its kind in the file | style: differs from the file's main style (groups of 3 or more names) / never an error | 1 | 0 | 1 |
naming.genericA local variable or parameter with a name that says nothing, like $data or $tmp | name: on the list of 16 generic names / never an error | 2 | 0 | 2 |
naming.too_longA very long name | characters: above 30 / never an error | 3 | 0 | 3 |
A value equal to a limit is no finding.
| File | Findings |
|---|---|
candidate-a/tests/Feature/AppointmentControllerTest.php | 9 |
candidate-a/config/database.php | 4 |
candidate-a/tests/Feature/FreeSlotControllerTest.php | 3 |
candidate-a/app/Data/FreeSlot.php | 1 |
candidate-a/app/Rules/EndsAtFitsSlotDuration.php | 1 |
candidate-a/app/Rules/SameDayAs.php | 1 |
candidate-a/app/Services/FreeSlotService.php | 1 |
candidate-a/database/seeders/DatabaseSeeder.php | 1 |
candidate-a/public/index.php | 1 |
| Folder | Findings |
|---|---|
tests/ | 12 |
app/ | 4 |
config/ | 4 |
database/ | 1 |
public/ | 1 |
AOverall: 95 out of 100
3 of 5 metrics graded
round((3 × 100Complexity+2 × 85Duplication+1 × 98Naming) ÷ 6) = 95
Weights: Complexity 3, Duplication 2, Naming 1. Size and Security are not graded, so they are left out and the other weights are rescaled.
A summary of the grades below, which you can recompute. Not a pass mark, and not a hiring decision.
The table shows how many files got each letter. A file with nothing to judge for a metric gets no grade for it. The whole project column pools every file's grade, so a file with more code to judge counts for more. The overall above weights those whole project grades. In the full engine output these are CodeLength, CyclomaticComplexity, Duplication, NamingConvention and Security.
| Metric | A | B | C | D | F | Not graded | Whole project |
|---|---|---|---|---|---|---|---|
| Size | Findings only, no grade | ||||||
| Complexity | 71 | 0 | 0 | 0 | 0 | 10 | 100 A |
| Duplication | 70 | 1 | 0 | 0 | 2 | 8 | 85 B |
| Naming | 57 | 1 | 1 | 0 | 0 | 22 | 98 A |
| Security | Findings only, no grade | ||||||
Findings only, never a grade: a wrong security grade would hurt more than none. A finding the author already silenced with a phpcs comment counts as suppressed, apart from Errors and Warnings, so you can tell reviewed code from unreviewed code.
| Check | Errors | Warnings | Suppressed |
|---|---|---|---|
security.evalA call to eval, which runs a string as PHP code | 0 | 0 | 0 |
security.shellA shell command built from data | 0 | 0 | 0 |
security.unserializeunserialize without allowed_classes => false | 0 | 0 | 0 |
security.include_variableAn include or require whose path is built from a variable | 0 | 1 | 0 |
security.extract_inputextract of request input, which turns its fields into variables | 0 | 0 | 0 |
security.sql_interpolatedSQL with a value pasted in instead of passed through prepare | 0 | 0 | 0 |
security.unescaped_outputAn echo, print or <?= of a value that is not escaped | 0 | 0 | 0 |
security.unsanitized_inputA request input read with no sanitizer around it | 0 | 0 | 0 |
Up to 10 places, Errors first, then Warnings, then by path and line. An Error means request input reaches the call or the output directly.
candidate-a/public/index.php:10require of `$maintenance` builds the file path from data; a crafted path can load another file
| 10 | require $maintenance; |
| 11 | } |
| 12 | |
| 13 | // Register the Composer autoloader... |
| 14 | require __DIR__.'/../vendor/autoload.php'; |
| 15 | |
| 16 | // Bootstrap Laravel and handle the request... |
| 17 | /** @var Application $app */ |
| 18 | $app = require_once __DIR__.'/../bootstrap/app.php'; |
| 19 |
Security findings are listed in their own section above. A place is a file and a line, so a function that is both too long and too complex shows once, with both findings. Places rank by their worst finding: errors first, then by how far the measured value goes beyond its limit. Each message is the engine's own, word for word.
candidate-a/config/database.php:68lines 68 to 87 repeat lines 48 to 67 (190 tokens); repeated code has to be fixed in every copy
| 68 | 'driver' => 'mariadb', |
| 69 | 'url' => env('DB_URL'), |
| 70 | 'host' => env('DB_HOST', '127.0.0.1'), |
| 71 | 'port' => env('DB_PORT', '3306'), |
| 72 | 'database' => env('DB_DATABASE', 'laravel'), |
| 73 | 'username' => env('DB_USERNAME', 'root'), |
| 74 | 'password' => env('DB_PASSWORD', ''), |
| 75 | 'unix_socket' => env('DB_SOCKET', ''), |
| 76 | 'charset' => env('DB_CHARSET', 'utf8mb4'), |
| 77 | 'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'), |
candidate-a/tests/Feature/AppointmentControllerTest.php:549lines 549 to 568 repeat lines 527 to 546 (108 tokens); repeated code has to be fixed in every copy
| 549 | $appointment = appointmentStartingAt($startTime)->confirmed()->create(); |
| 550 | |
| 551 | $response = $this->postJson(route('appointments.cancel', $appointment), validCancelPayload()); |
| 552 | |
| 553 | $appointment->refresh(); |
| 554 | |
| 555 | $response |
| 556 | ->assertOk() |
| 557 | ->assertExactJson([ |
| 558 | 'data' => appointmentResourceMap($appointment), |
candidate-a/tests/Feature/AppointmentControllerTest.php:226lines 226 to 237 repeat lines 206 to 217 (88 tokens); repeated code has to be fixed in every copy
| 226 | test('returns the second page of appointments', function () { |
| 227 | $start = CarbonImmutable::createFromFormat(ApiDateTime::FORMAT, '2026-09-03 08:00:00'); |
| 228 | |
| 229 | Appointment::factory() |
| 230 | ->count(16) |
| 231 | ->sequence(fn ($sequence) => [ |
| 232 | 'start_time' => $start->addMinutes($sequence->index * 30), |
| 233 | 'end_time' => $start->addMinutes($sequence->index * 30 + 30), |
| 234 | ]) |
| 235 | ->create(); |
candidate-a/tests/Feature/AppointmentControllerTest.php:484lines 484 to 502 repeat lines 439 to 457 (83 tokens); repeated code has to be fixed in every copy
| 484 | $response = $this->postJson(route('appointments.complete', $appointment)); |
| 485 | |
| 486 | $appointment->refresh(); |
| 487 | |
| 488 | $response |
| 489 | ->assertOk() |
| 490 | ->assertExactJson([ |
| 491 | 'data' => appointmentResourceMap($appointment), |
| 492 | ]); |
| 493 |
candidate-a/config/database.php:106lines 106 to 112 repeat lines 91 to 97 (75 tokens); repeated code has to be fixed in every copy
| 106 | 'port' => env('DB_PORT', '1433'), |
| 107 | 'database' => env('DB_DATABASE', 'laravel'), |
| 108 | 'username' => env('DB_USERNAME', 'root'), |
| 109 | 'password' => env('DB_PASSWORD', ''), |
| 110 | 'charset' => env('DB_CHARSET', 'utf8'), |
| 111 | 'prefix' => '', |
| 112 | 'prefix_indexes' => true, |
| 113 | // 'encrypt' => env('DB_ENCRYPT', 'yes'), |
| 114 | // 'trust_server_certificate' => env('DB_TRUST_SERVER_CERTIFICATE', 'false'), |
| 115 | ], |
candidate-a/config/database.php:169lines 169 to 175 repeat lines 156 to 162 (73 tokens); repeated code has to be fixed in every copy
| 169 | 'cache' => [ |
| 170 | 'url' => env('REDIS_URL'), |
| 171 | 'host' => env('REDIS_HOST', '127.0.0.1'), |
| 172 | 'username' => env('REDIS_USERNAME'), |
| 173 | 'password' => env('REDIS_PASSWORD'), |
| 174 | 'port' => env('REDIS_PORT', '6379'), |
| 175 | 'database' => env('REDIS_CACHE_DB', '1'), |
| 176 | 'max_retries' => env('REDIS_MAX_RETRIES', 3), |
| 177 | 'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'), |
| 178 | 'backoff_base' => env('REDIS_BACKOFF_BASE', 100), |
candidate-a/tests/Feature/AppointmentControllerTest.php:514lines 514 to 520 repeat lines 469 to 475 (71 tokens); repeated code has to be fixed in every copy
| 514 | 'pending' => fn () => Appointment::factory()->pending()->create(), |
| 515 | 'cancelled' => fn () => Appointment::factory()->cancelled()->create(), |
| 516 | 'completed' => fn () => Appointment::factory()->completed()->create(), |
| 517 | ]); |
| 518 | |
| 519 | test('returns 404 when the appointment does not exist', function () { |
| 520 | $this->postJson(route('appointments.complete', 1)) |
| 521 | ->assertNotFound(); |
| 522 | }); |
| 523 | }); |
candidate-a/tests/Feature/AppointmentControllerTest.php:529lines 529 to 543 repeat lines 439 to 453 (71 tokens); repeated code has to be fixed in every copy
| 529 | $response = $this->postJson(route('appointments.cancel', $appointment), validCancelPayload()); |
| 530 | |
| 531 | $appointment->refresh(); |
| 532 | |
| 533 | $response |
| 534 | ->assertOk() |
| 535 | ->assertExactJson([ |
| 536 | 'data' => appointmentResourceMap($appointment), |
| 537 | ]); |
| 538 |
candidate-a/tests/Feature/FreeSlotControllerTest.php:178lines 178 to 186 repeat lines 157 to 165 (65 tokens); repeated code has to be fixed in every copy
| 178 | Appointment::factory()->cancelled()->create([ |
| 179 | 'doctor_id' => $doctor->id, |
| 180 | 'start_time' => '2026-09-03 09:00:00', |
| 181 | 'end_time' => '2026-09-03 09:30:00', |
| 182 | ]); |
| 183 | |
| 184 | $this->getJson(route('free-slots.index', ['doctor_id' => $doctor->id])) |
| 185 | ->assertOk() |
| 186 | ->assertJsonPath('data', morningFreeSlotMaps($doctor->id)); |
| 187 | }); |
candidate-a/config/database.php:175lines 175 to 180 repeat lines 162 to 167 (59 tokens); repeated code has to be fixed in every copy
| 175 | 'database' => env('REDIS_CACHE_DB', '1'), |
| 176 | 'max_retries' => env('REDIS_MAX_RETRIES', 3), |
| 177 | 'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'), |
| 178 | 'backoff_base' => env('REDIS_BACKOFF_BASE', 100), |
| 179 | 'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000), |
| 180 | ], |
| 181 | |
| 182 | ], |
| 183 | |
| 184 | ]; |
All 22 findings, exactly as the engine printed them: laravel-candidate-a.txt (plain text).