Rateo sample: Candidate B

At a glance

Files analysed: 44
Findings: 7
Errors: 0
Warnings: 7

platform PHP: Laravel (composer.json requires laravel/framework; artisan)

not analysed: 32 files (Ignore List 13, JavaScript 5, JSON 3, ApacheConf 1, Blade 1, CSS 1, EditorConfig 1, Git Attributes 1, Markdown 1, Shell 1, Text 1, XML 1, ico 1, robots.txt 1)

What it checks

Checked today

Size: long files, classes and functions
Complexity: functions and file level code with too many paths
Naming: mixed styles in a file, generic, one letter and very long names
Duplication: blocks repeated inside a file, even with renamed variables
Security: eval, shell commands, unserialize and includes built from data, SQL with values pasted in, request input never sanitized, output never escaped

Not checked yet

Laravel rules: thin controllers, no queries in views, validation in form requests
Security checks: hard coded secrets
Tests: whether there are any, and how much test code there is next to the app code
Repository hygiene: .gitignore, a lockfile, no committed vendor/ or .env, a README with setup steps

The security checks read one call or statement at a time and never follow a value through variables, so they show where to look, not proof of a hole. A long or branchy function is common in a large, mature project; each finding is a place worth a closer look, not a judgement of the code as a whole.

Findings by check

Check	Limits (warning / error)	Warnings	Errors	Total
Duplication
`duplication.repeated_block` A block repeated later in the same file, even with its names changed	tokens: 50 or more / never an error	3	0	3
Naming
`naming.generic` A local variable or parameter with a name that says nothing, like $data or $tmp	name: on the list of 16 generic names / never an error	3	0	3

A value equal to a limit is no finding.

Where they concentrate

The 10 files with the most findings

File	Findings
`candidate-b/config/database.php`	3
`candidate-b/app/Services/NewYorkTimes.php`	1
`candidate-b/app/Services/NewsAPI.php`	1
`candidate-b/app/Services/TheGuardian.php`	1
`candidate-b/public/index.php`	1

Findings per top level folder

Folder	Findings
`app/`	3
`config/`	3
`public/`	1

Grades

AOverall: 96 out of 100
3 of 5 metrics graded

round((3 × 100Complexity+2 × 88Duplication+1 × 97Naming) ÷ 6) = 96

Weights: Complexity 3, Duplication 2, Naming 1. Size and Security are not graded, so they are left out and the other weights are rescaled.

A summary of the grades below, which you can recompute. Not a pass mark, and not a hiring decision.

The table shows how many files got each letter. A file with nothing to judge for a metric gets no grade for it. The whole project column pools every file's grade, so a file with more code to judge counts for more. The overall above weights those whole project grades. In the full engine output these are CodeLength, CyclomaticComplexity, Duplication, NamingConvention and Security.

Metric	A	B	C	D	F	Not graded	Whole project
Complexity	38	0	0	0	0	6	100 A
Duplication	38	0	0	0	1	5	88 B
Naming	24	0	0	0	0	20	97 A
Security	Findings only, no grade

Security

Findings only, never a grade: a wrong security grade would hurt more than none. A finding the author already silenced with a phpcs comment counts as suppressed, apart from Errors and Warnings, so you can tell reviewed code from unreviewed code.

Check	Errors	Warnings	Suppressed
`security.eval` A call to eval, which runs a string as PHP code	0	0	0
`security.shell` A shell command built from data	0	0	0
`security.unserialize` unserialize without allowed_classes => false	0	0	0
`security.include_variable` An include or require whose path is built from a variable	0	1	0
`security.extract_input` extract of request input, which turns its fields into variables	0	0	0
`security.sql_interpolated` SQL with a value pasted in instead of passed through prepare	0	0	0
`security.unescaped_output` An echo, print or <?= of a value that is not escaped	0	0	0
`security.unsanitized_input` A request input read with no sanitizer around it	0	0	0

Where to look first

Up to 10 places, Errors first, then Warnings, then by path and line. An Error means request input reaches the call or the output directly.

#1 `candidate-b/public/index.php:9`

Warning security.include_variable
require of `$maintenance` builds the file path from data; a crafted path can load another file

9	require $maintenance;
10	}
11
12	// Register the Composer autoloader...
13	require __DIR__.'/../vendor/autoload.php';
14
15	// Bootstrap Laravel and handle the request...
16	(require_once __DIR__.'/../bootstrap/app.php')
17	->handleRequest(Request::capture());

The 10 worst places

Security findings are listed in their own section above. A place is a file and a line, so a function that is both too long and too complex shows once, with both findings. Places rank by their worst finding: errors first, then by how far the measured value goes beyond its limit. Each message is the engine's own, word for word.

#1 `candidate-b/config/database.php:66`

Warning duplication.repeated_block
lines 66 to 85 repeat lines 46 to 65 (190 tokens); repeated code has to be fixed in every copy

66	'driver' => 'mariadb',
67	'url' => env('DB_URL'),
68	'host' => env('DB_HOST', '127.0.0.1'),
69	'port' => env('DB_PORT', '3306'),
70	'database' => env('DB_DATABASE', 'laravel'),
71	'username' => env('DB_USERNAME', 'root'),
72	'password' => env('DB_PASSWORD', ''),
73	'unix_socket' => env('DB_SOCKET', ''),
74	'charset' => env('DB_CHARSET', 'utf8mb4'),
75	'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'),

#2 `candidate-b/config/database.php:104`

Warning duplication.repeated_block
lines 104 to 110 repeat lines 89 to 95 (75 tokens); repeated code has to be fixed in every copy

104	'port' => env('DB_PORT', '1433'),
105	'database' => env('DB_DATABASE', 'laravel'),
106	'username' => env('DB_USERNAME', 'root'),
107	'password' => env('DB_PASSWORD', ''),
108	'charset' => env('DB_CHARSET', 'utf8'),
109	'prefix' => '',
110	'prefix_indexes' => true,
111	// 'encrypt' => env('DB_ENCRYPT', 'yes'),
112	// 'trust_server_certificate' => env('DB_TRUST_SERVER_CERTIFICATE', 'false'),
113	],

#3 `candidate-b/config/database.php:162`

Warning duplication.repeated_block
lines 162 to 168 repeat lines 153 to 159 (73 tokens); repeated code has to be fixed in every copy

162	'cache' => [
163	'url' => env('REDIS_URL'),
164	'host' => env('REDIS_HOST', '127.0.0.1'),
165	'username' => env('REDIS_USERNAME'),
166	'password' => env('REDIS_PASSWORD'),
167	'port' => env('REDIS_PORT', '6379'),
168	'database' => env('REDIS_CACHE_DB', '1'),
169	],
170
171	],

#4 `candidate-b/app/Services/NewYorkTimes.php:38`

Warning naming.generic
variable `data` is a generic name; it says nothing about what it holds

38	$data = array();
39	foreach ($result as $article) {
40	array_push($data, $this->parse($article));
41	}
42	$this->save(collect($data));
43	Log::info(self::NAME . ' article fetched successfully');
44	} catch (\Exception $ex) {
45	Log::critical($ex->getMessage());
46	}
47	}

#5 `candidate-b/app/Services/NewsAPI.php:39`

Warning naming.generic
variable `data` is a generic name; it says nothing about what it holds

39	$data = array();
40	foreach ($result as $article) {
41	array_push($data, $this->parse($article));
42	}
43	$this->save(collect($data));
44	Log::info(self::NAME . ' article fetched successfully');
45	} catch (\Exception $ex) {
46	Log::critical($ex->getMessage());
47	}
48	}

#6 `candidate-b/app/Services/TheGuardian.php:28`

Warning naming.generic
variable `data` is a generic name; it says nothing about what it holds

28	$data = array();
29	foreach ($result as $article) {
30	array_push($data, $this->parse($article));
31	}
32	$this->save(collect($data));
33	Log::info(self::NAME . ' article fetched successfully');
34	} catch (\Exception $ex) {
35	Log::critical($ex->getMessage());
36	}
37	}

Full engine output

All 7 findings, exactly as the engine printed them: laravel-candidate-b.txt (plain text).