Studying how codebases actually behave.
We build tools and run analyses at the intersection of software complexity, codebase health, and AI-generated code. This org is where that work lives in the open.
Last updated: 2026-03-24 · Full analysis archive
| Repository | Highest Risk Function | Score |
|---|---|---|
| colinhacks/zod | convertBaseSchema | 21.3 |
| FlowiseAI/Flowise | OpenAIAssistant | 21.2 |
| react-hook-form | createFormControl | 20.6 |
| tldraw/tldraw | Editor | 19.3 |
| styled-components | sanitizeCSS | 15.4 |
| Area | Description |
|---|---|
| Structural complexity | The 20% of functions causing 80% of bugs, incidents, and slowdowns |
| AI-generated code | How Copilot, Claude, and coding agents change codebase structure over time |
| OSS health over time | Longitudinal complexity drift in major open source projects |
| Agentic codebases | What happens to a codebase when agents write most of it |
- What Happens When You Run Hotspots on 102,000 Functions — stress-testing against VS Code, finding an O(N³) bug
- AI Agents Can Pass Tests. They Still Can't Maintain Systems. — how AI tools excel at writing but struggle with maintenance
- AI Made Code Cheap. The Bottleneck Is Now Understanding Systems. — comprehension, not production, is now the engineering constraint
hall-of-fame/— Legendary gnarly functions from OSS history, analyzedai-code-studies/— Research into AI-generated code patterns and failure cases
Hotspots finds the riskiest functions in any repo — the ones with high complexity and high churn that cause most of your bugs and slowdowns.
macOS
brew install Stephen-Collins-tech/tap/hotspots
hotspots analyze .Linux
curl -fsSL https://raw.githubusercontent.com/Stephen-Collins-tech/hotspots/main/install.sh | sh
hotspots analyze .- ts-validator — Rust-based static analysis for runtime type safety in TypeScript
- intent-kit — Intent-driven workflow library for LLMs
hotspots.dev · Blog · GitHub