File Analysis: Health Scores, Code Smells, and Secrets

Iris Code analyses every supported file as you open or save it, with no command to run. The File tab is where that lands: a line-level picture of the current file, and where each problem sits.

The File tab

It opens with a readiness summary: the score, any blockers, whether a hook is installed, and the trend direction. Below that is the full breakdown:

What you see	What it means
Health score	0 to 100, reduced by warnings, secrets, security smells, deep nesting, long functions and debug prints
Trend	Movement since the previous snapshot, once trend history exists
Language badge	TypeScript, JavaScript, Go, Python, Ruby, C#, Java or Rust, in the header
Line counts	Total, blank, and actual code
Complexity	1 to 10, from function density, nesting, control flow and imports
Functions	Every detected function with its line number, clickable
Code smells	TODOs, unused code, magic numbers, debug prints, long parameter lists
Tests	Whether a matching test file was found, using your `testConvention`

TypeScript-specific checks

Four additional signals appear in .ts, .tsx, .js and .jsx files. They are hidden entirely in Go, Python, Ruby, C#, Java, and Rust rather than shown as empty rows.

Metric	What it counts
`any` usages	Explicit `: any` and `as any`, each clickable
`@ts-ignore`	Suppression comments
Non-null assertions	Every `!`
Missing return types	Exported functions without an annotated return

Code smells

Every finding is clickable and jumps to the exact line.

Smell	Where	Toggle
Debug prints: `console.log`, `console.warn`, `console.error`	JS / TS	`enableConsoleLogWarnings`
Debug prints: `fmt.Print`, `log.Print`, `log.Fatal`, `log.Panic`	Go	`enableConsoleLogWarnings`
Debug prints: `print()`	Python	`enableConsoleLogWarnings`
Magic numbers: raw literals other than `0` and `1`, used inline	All	`enableMagicNumberDetection`
TODO / FIXME / HACK comments	All	`enableTodoDetection`
Long parameter lists, past your threshold	All	`enableLongParamDetection`
Unused variables, declared and never used	All	`enableUnusedDetection`
Unused functions, defined, never called, not exported	All	`enableUnusedDetection`

Turning a toggle off hides both the counter and the detail section, rather than showing a zero. This keeps the sidebar free of categories that are not relevant to your project.

Security smells

Nine patterns, in every supported language. They count as Blockers, the same category as hardcoded secrets, rather than as warnings.

Pattern	What it catches
`evalUsage`	`eval()` in JS/TS, `exec()` in Python and Go
`sqlConcatenation`	SQL built by concatenation or template literals
`insecureRandom`	`Math.random()`, `rand.Intn()`, `random.random()` somewhere security-sensitive
`unsafeRegex`	Nested quantifiers that can backtrack catastrophically
`hardcodedLocalhost`	`http://localhost` or `127.0.0.1` in production code
`disabledTlsVerification`	`rejectUnauthorized: false`, `InsecureSkipVerify: true`, `verify=False`
`debugFlagsEnabled`	`debug: true` in config, ignoring test files
`weakHashing`	MD5 or SHA-1
`openRedirect`	Redirecting to unvalidated user input

All nine share one toggle, enableSecuritySmells.

To keep them scored without squiggles, leave enableSecuritySmells on and set inlineDiagnostics.securitySmells to false. Full pattern reference in Security Smells.

Warnings

Five warning types, each with a threshold you set in .irisconfig.json and a severity you can override independently.

Type	Severity	Fires when
`file-too-long`	error / warning	Past the threshold, or two-thirds of it for the warning
`function-too-long`	error / warning	Twice the threshold for an error, once for a warning
`too-many-functions`	warning	Over `maxFunctionsPerFile`
`too-many-imports`	warning	Over `maxImportsPerFile`
`no-exports`	info	Nothing in the file is exported

severityOverrides adjusts any of these. Promote no-exports to a warning where it matters on your project, or demote file-too-long from error to warning while working through a backlog.

Unused import detection runs for TypeScript, JavaScript, and Java. Go and Python handle unused imports at the compiler or runtime level, so Iris Code does not duplicate that. Ruby resolves constants at runtime, where static analysis cannot tell an unused require from one loaded through send or Rails autoloading, and C# resolves types through dependency injection, reflection, and source generators for the same reason. Rust is excluded because a trait must be imported for its methods to be callable and its name is then never written again, so the usage is invisible to a static read. Java is the one addition where the verdict is safe: an import there is a compile-time type alias and javac itself warns, and the check reads Javadoc so a {@link} reference counts as usage.

Start here

What Iris Code finds

Blocking bad code

Configuration

Editors

Reference

File Analysis: Health Scores, Code Smells, and Secrets

The File tab

TypeScript-specific checks

Code smells

Security smells

Warnings

​The File tab

​TypeScript-specific checks

​Code smells

​Security smells

​Warnings

The File tab

TypeScript-specific checks

Code smells

Security smells

Warnings