Нейросети и анализ кода

graker — Wed, 22 Jul 2026 09:15:00 +0000

Yesterday I was estimating a group of ~40 tickets. All of them were created from an AI code analysis report on a large Drupal project. The project is about 10 years old, the codebase has evolved all this time, 20 subdomains, integrations, APIs, content synchronization — all in all, a cool project.

The report is structured, the neural network checked the project for all four horsemen of the apocalypse: Vulnerabilities, Bugs, Slowness and Dirty Code. Originally the report produced many more tasks, but I slapped won't fix on about 30% of them right away. There were glitches and misunderstandings of the context. But 40 tickets still remained.

Most of them are also tasks of the very lowest priority, like

a custom module doesn't declare a dependency on something like paragraphs;
somewhere in the code a brazen programmer called \Drupal::service() instead of using dependency injection;
somewhere deprecated Drupal versions haven't been removed from the supported versions, and so on.

There were also a few more serious issues:

a couple of N+1 problems;
several XSS vulnerabilities (only accessible to admins, but still);
several places lacking checks for whether a key exists in an array (spamming the log with warnings);
and even one timing oracle vulnerability.

Yes, dirty code is a sign of dirty thoughts :) Yes, it would be nice to clean it all up. But apart from 3–4 issues, it adds up to more than a hundred hours of work in total, and the payoff is slightly cleaner code, tidied-up legacy, a bit less tech debt and fewer warning/debug entries in the log. It's nice, of course, when the client doesn't mind such a spring cleaning. And all honor and glory to the account managers who can convince the client of the need for such cleaning when its value to the end user is roughly zero.

And these reports still leave a strange feeling. They do find something. But so far these reports bring much more fuss than benefit.

Drupals

Нейросети и анализ кода