> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.

# File analysis: understand scores, findings, and function metrics

> Understand the health score, complexity, functions, code smells, security findings, and committed credentials reported for the open file.

A file scan checks the file you are working on and gives it a health score from 0 to 100. Findings explain what needs attention, such as a secret in the code, repeated code or a function that is difficult to follow. Use the findings to choose what to review rather than treating the score as a guarantee that the code works.

Iris Code scans supported files when you open or save them. Open the sidebar?s **File tab** to see the result for the current file.

## The File tab

It opens with a readiness summary: the score, any blockers, whether a hook is installed, and the trend direction. Below that is the full breakdown:

| What you see | What it means |
| - | - |
| **Health score** | 0 to 100, reduced by warnings, secrets, security smells, deep nesting, long functions and debug prints |
| **Trend** | Movement since the previous snapshot, once trend history exists |
| **Language badge** | TypeScript, JavaScript, Go, Python, Ruby, C#, Java or Rust, in the header |
| **Line counts** | Total, blank, and actual code |
| **Complexity** | 1 to 10, from function density, nesting, control flow and imports |
| **Functions** | Every detected function with its line number, clickable |
| **Code smells** | TODOs, unused code, magic numbers, debug prints, long parameter lists |
| **Tests** | Whether a matching test file was found, using your `testConvention` |

## TypeScript-specific checks

Four additional signals appear in `.ts`, `.tsx`, `.js` and `.jsx` files. They are hidden entirely in Go, Python, Ruby, C#, Java, and Rust rather than shown as empty rows.

| Metric | What it counts |
| - | - |
| `any` usages | Explicit `: any` and `as any`, each clickable |
| `@ts-ignore` | Suppression comments |
| Non-null assertions | Every `!` |
| Missing return types | Exported functions without an annotated return |

## Code smells

Every finding is clickable and jumps to the exact line.

| Smell | Where | Toggle |
| - | - | - |
| Debug prints: `console.log`, `console.warn`, `console.error` | JS / TS | `enableConsoleLogWarnings` |
| Debug prints: `fmt.Print*`, `log.Print*`, `log.Fatal*`, `log.Panic*` | Go | `enableConsoleLogWarnings` |
| Debug prints: `print()` | Python | `enableConsoleLogWarnings` |
| Magic numbers: raw literals other than `0` and `1`, used inline | All | `enableMagicNumberDetection` |
| TODO / FIXME / HACK comments | All | `enableTodoDetection` |
| Long parameter lists, past your threshold | All | `enableLongParamDetection` |
| Unused variables, declared and never used | All | `enableUnusedDetection` |
| Unused functions, defined, never called, not exported | All | `enableUnusedDetection` |

<Tip>
  Turning a toggle off hides both the counter and the detail section, rather than showing a zero. This keeps the sidebar free of categories that are not relevant to your project.
</Tip>

## Security smells

Nine patterns, in every supported language. They count as **Blockers**, the same category as hardcoded secrets, rather than as warnings.

| Pattern | What it catches |
| - | - |
| `evalUsage` | `eval()` in JS/TS, `exec()` in Python and Go |
| `sqlConcatenation` | SQL built by concatenation or template literals |
| `insecureRandom` | `Math.random()`, `rand.Intn()`, `random.random()` somewhere security-sensitive |
| `unsafeRegex` | Nested quantifiers that can backtrack catastrophically |
| `hardcodedLocalhost` | `http://localhost` or `127.0.0.1` in production code |
| `disabledTlsVerification` | `rejectUnauthorized: false`, `InsecureSkipVerify: true`, `verify=False` |
| `debugFlagsEnabled` | `debug: true` in config, ignoring test files |
| `weakHashing` | MD5 or SHA-1 |
| `openRedirect` | Redirecting to unvalidated user input |

All nine share one toggle, `enableSecuritySmells`.

<Tip>
  To keep them scored without squiggles, leave `enableSecuritySmells` on and set `inlineDiagnostics.securitySmells` to `false`. Full pattern reference in [Security Smells](/features/security-smells).
</Tip>

## Warnings

Five warning types, each with a threshold you set in `.irisconfig.json` and a severity you can override independently.

| Type | Severity | Fires when |
| - | - | - |
| `file-too-long` | error / warning | Past the threshold, or two-thirds of it for the warning |
| `function-too-long` | error / warning | Twice the threshold for an error, once for a warning |
| `too-many-functions` | warning | Over `maxFunctionsPerFile` |
| `too-many-imports` | warning | Over `maxImportsPerFile` |
| `no-exports` | info | Nothing in the file is exported |

<Tip>
  `severityOverrides` adjusts any of these. Promote `no-exports` to a warning where it matters on your project, or demote `file-too-long` from error to warning while working through a backlog.
</Tip>

<Note>
  Unused *import* detection is available for TypeScript, JavaScript and Java. Other languages are not checked for unused imports by Iris Code; their compilers or linters may offer additional checks.

  Some imports matter even when the name is never written again. Rust imports can make a trait?s methods available, while Ruby and C# can resolve names indirectly at runtime. Removing those imports needs language-specific review.

  In Java, references in Javadoc links count as usage, so a name used only in documentation is kept.
</Note>

The [refactor playbook](/refactor/overview) turns size and complexity failures into a deterministic plan, mechanical fixes and verification.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.