> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.
# File Analysis: Health Scores, Code Smells, and Secrets
> What the File tab tells you about the file you're in: score, complexity, functions, smells, security patterns and secrets.
Iris Code analyses every supported file as you open or save it, with no command to run.
The **File tab** is where that lands: a line-level picture of the current file, and where each problem sits.
## The File tab
It opens with a readiness summary: the score, any blockers, whether a hook is installed, and the trend direction. Below that is the full breakdown:
| What you see | What it means |
| ------------------ | ------------------------------------------------------------------------------------------------------ |
| **Health score** | 0 to 100, reduced by warnings, secrets, security smells, deep nesting, long functions and debug prints |
| **Trend** | Movement since the previous snapshot, once trend history exists |
| **Language badge** | TypeScript, JavaScript, Go, Python, Ruby, C#, Java or Rust, in the header |
| **Line counts** | Total, blank, and actual code |
| **Complexity** | 1 to 10, from function density, nesting, control flow and imports |
| **Functions** | Every detected function with its line number, clickable |
| **Code smells** | TODOs, unused code, magic numbers, debug prints, long parameter lists |
| **Tests** | Whether a matching test file was found, using your `testConvention` |
## TypeScript-specific checks
Four additional signals appear in `.ts`, `.tsx`, `.js` and `.jsx` files. They are hidden entirely in Go, Python, Ruby, C#, Java, and Rust rather than shown as empty rows.
| Metric | What it counts |
| -------------------- | ---------------------------------------------- |
| `any` usages | Explicit `: any` and `as any`, each clickable |
| `@ts-ignore` | Suppression comments |
| Non-null assertions | Every `!` |
| Missing return types | Exported functions without an annotated return |
## Code smells
Every finding is clickable and jumps to the exact line.
| Smell | Where | Toggle |
| -------------------------------------------------------------------- | ------- | ---------------------------- |
| Debug prints: `console.log`, `console.warn`, `console.error` | JS / TS | `enableConsoleLogWarnings` |
| Debug prints: `fmt.Print*`, `log.Print*`, `log.Fatal*`, `log.Panic*` | Go | `enableConsoleLogWarnings` |
| Debug prints: `print()` | Python | `enableConsoleLogWarnings` |
| Magic numbers: raw literals other than `0` and `1`, used inline | All | `enableMagicNumberDetection` |
| TODO / FIXME / HACK comments | All | `enableTodoDetection` |
| Long parameter lists, past your threshold | All | `enableLongParamDetection` |
| Unused variables, declared and never used | All | `enableUnusedDetection` |
| Unused functions, defined, never called, not exported | All | `enableUnusedDetection` |
Turning a toggle off hides both the counter and the detail section, rather than showing a zero. This keeps the sidebar free of categories that are not relevant to your project.
## Security smells
Nine patterns, in every supported language. They count as **Blockers**, the same category as hardcoded secrets, rather than as warnings.
| Pattern | What it catches |
| ------------------------- | ------------------------------------------------------------------------------ |
| `evalUsage` | `eval()` in JS/TS, `exec()` in Python and Go |
| `sqlConcatenation` | SQL built by concatenation or template literals |
| `insecureRandom` | `Math.random()`, `rand.Intn()`, `random.random()` somewhere security-sensitive |
| `unsafeRegex` | Nested quantifiers that can backtrack catastrophically |
| `hardcodedLocalhost` | `http://localhost` or `127.0.0.1` in production code |
| `disabledTlsVerification` | `rejectUnauthorized: false`, `InsecureSkipVerify: true`, `verify=False` |
| `debugFlagsEnabled` | `debug: true` in config, ignoring test files |
| `weakHashing` | MD5 or SHA-1 |
| `openRedirect` | Redirecting to unvalidated user input |
All nine share one toggle, `enableSecuritySmells`.
To keep them scored without squiggles, leave `enableSecuritySmells` on and set `inlineDiagnostics.securitySmells` to `false`. Full pattern reference in [Security Smells](/features/security-smells).
## Warnings
Five warning types, each with a threshold you set in `.irisconfig.json` and a severity you can override independently.
| Type | Severity | Fires when |
| -------------------- | --------------- | ------------------------------------------------------- |
| `file-too-long` | error / warning | Past the threshold, or two-thirds of it for the warning |
| `function-too-long` | error / warning | Twice the threshold for an error, once for a warning |
| `too-many-functions` | warning | Over `maxFunctionsPerFile` |
| `too-many-imports` | warning | Over `maxImportsPerFile` |
| `no-exports` | info | Nothing in the file is exported |
`severityOverrides` adjusts any of these. Promote `no-exports` to a warning where it matters on your project, or demote `file-too-long` from error to warning while working through a backlog.
Unused *import* detection runs for TypeScript, JavaScript, and Java. Go and Python handle unused imports at the compiler or runtime level, so Iris Code does not duplicate that. Ruby resolves constants at runtime, where static analysis cannot tell an unused require from one loaded through `send` or Rails autoloading, and C# resolves types through dependency injection, reflection, and source generators for the same reason. Rust is excluded because a trait must be imported for its methods to be callable and its name is then never written again, so the usage is invisible to a static read. Java is the one addition where the verdict is safe: an import there is a compile-time type alias and javac itself warns, and the check reads Javadoc so a `{@link}` reference counts as usage.