Blog

Essays, playbooks, and product updates.

Hotspots v1.25.1–v1.31.0: Explanations, a Regime-Aware Ranker, and a Burst-Score Formula Term

Stephen Collins · Jul 14, 2026

Six versions in four weeks. Most of it is quieter infrastructure — easier installs, a cleaner ranker feature set, tighter CI policy control. The two releases worth reading closely …

Why I let AI train on this

Stephen Collins · Jul 2, 2026

I just flipped ai-train=yes in robots.txt. Here's the reasoning, not just the setting.

How phrasing affects LLM compliance with spec security clauses

Stephen Collins · Jun 29, 2026

I tested five ways to phrase a security requirement across four language models. The phrasing most commonly used in practice was near the bottom on all four of them. The phrasing t…

How hotspots measures itself

Stephen Collins · Jun 28, 2026

A ranking tool that can't measure its own accuracy is just vibes with syntax highlighting. Here's how hotspots keeps itself honest.

When You Don't Have Enough History to Train

Stephen Collins · Jun 24, 2026

Every new repo starts with the same problem: no defect labels, no training signal, no basis for a risk ranking beyond 'how often does this file change?'

The Signal That Evaporated (And the One That Didn't)

Stephen Collins · Jun 24, 2026

Two signals looked nearly identical on paper. One collapsed under temporal holdout. The other survived — and the difference tells you something important about how to design defect…

Spearman ρ Looked Fine. P@10 Was Zero.

Stephen Collins · Jun 24, 2026

Spearman ρ can be positive and meaningful while the top-ranked files contain zero future bugs. Here's how I found that out, why it happens, and how to catch it before it reaches a …

Tabular Beats LLM, and That's the Right Answer

Stephen Collins · Jun 24, 2026

On most codebases, a small XGBoost model trained on git history features outperforms a fine-tuned 7B LLM at defect risk ranking — not because the LLM is bad, but because the data i…

Hotspots v1.25.0: Repo Screener, CI Workflows, and Cleaner TypeScript Names

Stephen Collins · Jun 16, 2026

Three things that should have existed already: a way to know if training is worth running, a one-command CI setup, and TypeScript functions that show up under their actual names.

The Coupling Signal That Kept Inverting Itself

Stephen Collins · Jun 10, 2026

I tried three formulations of co-change coupling for defect risk ranking. Raw co-occurrence inverted on dense codebases. Mutual information made it worse.

Your Transformer Featurizer Only Helps When Your History Is Broken

Stephen Collins · Jun 10, 2026

Transformer embeddings on source code improved defect ranking on exactly the repos where git history had already failed — and added near-zero or negative signal everywhere else. He…

Java Code Health: Patterns Across 10 Open-Source Repositories

Stephen Collins · Jun 6, 2026

I analyzed 10 popular Java repositories and found the same three antipatterns in every single one. Here's what that tells us about Java development practices at scale.

The Defect Prediction Trap

Stephen Collins · Jun 5, 2026

I fine-tuned a model that scored Spearman ρ=+0.678 on defect risk. Then I zeroed out the git history fields and it dropped to −0.142. The model wasn't reading code. It was relaying…

The Metric That Hides Failure

Stephen Collins · Jun 5, 2026

Spearman ρ measures average rank agreement across all files. Precision@K measures whether the files engineers actually review are in the right place. On mature, stable codebases, a…

Which LLM Vendor Wins at Defect Risk Prediction?

Stephen Collins · Jun 5, 2026

When evaluating open-weight models for code analysis, the vendor comparison you run in 2024 might give you the wrong answer in 2025.

When Your Labels Lie: File-Level Bug Attribution Inflates Defect Rates

Stephen Collins · May 31, 2026

Most defect prediction pipelines share a quiet assumption: if a file was touched in a bug-fix commit, every function in that file was 'buggy' — and that assumption silently inflate…

How to Know If Fine-Tuning Will Help Before You Run It

Stephen Collins · May 25, 2026

Before you spend compute on per-repo fine-tuning, one scalar from the codebase's bug-fix history can tell you whether it's worth running. Here's how it works and what it can't pred…

Go Code Health: Patterns Across 12 Open-Source Repositories

Stephen Collins · May 22, 2026

I analyzed 12 Go repositories and found the same structural antipatterns in every single one. Here's what the data shows.

JavaScript Code Health: Patterns Across 19 Open-Source Repositories

Stephen Collins · May 22, 2026

I analyzed 19 open-source JavaScript repositories and found exit-heavy functions in 89% of them. Here's what the data reveals about structural debt in the JavaScript ecosystem.

Python Code Health: Patterns Across 12 Open-Source Repositories

Stephen Collins · May 22, 2026

I analyzed 12 open-source Python repositories and found complex branching in 100% of them. Here's what the data reveals about Python code health patterns.

Rust Code Health: Patterns Across 11 Open-Source Repositories

Stephen Collins · May 22, 2026

I analyzed 11 popular Rust repositories to find the most common code health antipatterns. Every single one had exit-heavy functions and long functions — Rust's ownership model does…

TypeScript Code Health: Patterns Across 44 Open-Source Repositories

Stephen Collins · May 22, 2026

I analyzed 44 TypeScript repositories and found structural antipatterns in nearly all of them. Here's what the data shows about where complexity accumulates.

Hotspots v1.18.0: Compact Storage

Stephen Collins · May 21, 2026

Snapshot history is valuable. Unbounded snapshot growth is not. v1.18.0 ships two compaction levels that shrink your .hotspots directory without losing the history that matters.

Hotspots v1.17.0: Model Risk Map and Monorepo Subsystems

Stephen Collins · May 20, 2026

Hotspots already tells you which functions are risky. v1.17.0 tells you which models those functions cluster around — and makes risk scores meaningful inside monorepo package bound…

Can a Fine-Tuned LLM Learn Which Code Is Risky?

Stephen Collins · May 16, 2026

I spent a few weeks running a controlled experiment: can a small language model, fine-tuned on a specific codebase's history, learn to rank code by defect risk better than a hand-t…

Hotspots now handles monorepos — what changed from v1.11 to v1.15.1

Stephen Collins · Apr 24, 2026

The diff command shipped in v1.11. Since then: four months of OOM fixes, a new SQLite pipeline, hybrid touch mode, and --auto-analyze. Hotspots now handles 28k-function monorepos a…

TypeScript produces less exit-heavy code than Go or Python — and more branching

Stephen Collins · Apr 17, 2026

exit_heavy averages 5.3 in non-TypeScript repos and 4.5 in TypeScript. complex_branching has the highest max-out rate of any pattern in TS. The flip is structural, not stylistic — …

Hub functions are a frontend framework problem — here's the data

Stephen Collins · Apr 17, 2026

hub_function barely appears in Go, Rust, or Python repos. In TypeScript UI framework code it's concentrated in coordinator functions with fan-out values of 37–112. Here's why.

Five structural patterns appear in nearly every TypeScript OSS repo I've analysed

Stephen Collins · Apr 17, 2026

Five structural patterns — god_function, long_function, exit_heavy, complex_branching, deeply_nested — appear in 86–100% of the 28 TypeScript OSS repos I've analysed. Here's what t…

Running Hotspots on expo/expo Without Running Out of Memory

Stephen Collins · Apr 12, 2026

expo/expo crashed Hotspots with an OOM. Here's the full account: what broke, the systematic fixes across memory and CPU, and the new escape-hatch flags that make very large repos p…

hotspots diff: Compare Complexity Between Any Two Branches, Tags, or Commits

Stephen Collins · Mar 26, 2026

Delta mode compares a commit to its parent. That's fine for local development — but CI needs to compare a PR branch to main, and tag comparisons need to reach back further. hotspot…

What Happens When You Run Hotspots on 102,000 Functions

Stephen Collins · Mar 14, 2026

I stress-tested Hotspots against VS Code (102k functions) and found an O(N³) bug, a sampling tail exclusion bug, and a philosophical question about approximation accuracy — all in …

AI Agents Can Pass Tests. They Still Can't Maintain Systems.

Stephen Collins · Mar 11, 2026

AI coding tools have made writing software dramatically easier. A new benchmark shows maintaining it is still the hard part — and the failure modes are predictable.

AI Made Code Cheap. The Bottleneck Is Now Understanding Systems.

Stephen Collins · Mar 8, 2026

AI removed code production as the engineering bottleneck. The new constraint is comprehension - and most developer tooling wasn't built for that problem.

The 20% Rule for Codebases: A Practical Refactoring Playbook

Stephen Collins · Feb 22, 2026

Use this practical worksheet to intersect change and complexity, pick three high‑leverage targets, and add simple guardrails to prevent backslide.

Stop Missing Regressions in PRs: Complexity Policy Checks in CI

Stephen Collins · Feb 22, 2026

Code review misses slow creep. Use Hotspots policies in CI to stop risky complexity changes before they merge — start warn‑only, then flip to blocking.

Introducing Hotspots: Find Risky Functions and Stop Regressions

Stephen Collins · Feb 21, 2026

Meet Hotspots — a lightweight analyzer with explainable risk, shareable reports, and CI policies so you fix what matters and keep it from slipping back.

Blog

Hotspots v1.25.1–v1.31.0: Explanations, a Regime-Aware Ranker, and a Burst-Score Formula Term

Why I let AI train on this

How phrasing affects LLM compliance with spec security clauses

How hotspots measures itself

When You Don't Have Enough History to Train

The Signal That Evaporated (And the One That Didn't)

Spearman ρ Looked Fine. P@10 Was Zero.

Tabular Beats LLM, and That's the Right Answer

Hotspots v1.25.0: Repo Screener, CI Workflows, and Cleaner TypeScript Names

The Coupling Signal That Kept Inverting Itself

Your Transformer Featurizer Only Helps When Your History Is Broken

Java Code Health: Patterns Across 10 Open-Source Repositories

The Defect Prediction Trap

The Metric That Hides Failure

Which LLM Vendor Wins at Defect Risk Prediction?

When Your Labels Lie: File-Level Bug Attribution Inflates Defect Rates

How to Know If Fine-Tuning Will Help Before You Run It

Go Code Health: Patterns Across 12 Open-Source Repositories

JavaScript Code Health: Patterns Across 19 Open-Source Repositories

Python Code Health: Patterns Across 12 Open-Source Repositories

Rust Code Health: Patterns Across 11 Open-Source Repositories

TypeScript Code Health: Patterns Across 44 Open-Source Repositories

Hotspots v1.18.0: Compact Storage

Hotspots v1.17.0: Model Risk Map and Monorepo Subsystems

Can a Fine-Tuned LLM Learn Which Code Is Risky?

Hotspots now handles monorepos — what changed from v1.11 to v1.15.1

TypeScript produces less exit-heavy code than Go or Python — and more branching

Hub functions are a frontend framework problem — here's the data

Five structural patterns appear in nearly every TypeScript OSS repo I've analysed

Running Hotspots on expo/expo Without Running Out of Memory

hotspots diff: Compare Complexity Between Any Two Branches, Tags, or Commits

What Happens When You Run Hotspots on 102,000 Functions

AI Agents Can Pass Tests. They Still Can't Maintain Systems.

AI Made Code Cheap. The Bottleneck Is Now Understanding Systems.

The 20% Rule for Codebases: A Practical Refactoring Playbook

Stop Missing Regressions in PRs: Complexity Policy Checks in CI

Introducing Hotspots: Find Risky Functions and Stop Regressions

Repository Analyses

Fabric's streamlit UI carries the complexity outlier — main hits CC 192

cli/cli's command layer carries the highest activity risk — 5 functions to address first

LocalAI's static asset layer carries the highest activity risk

gogs/gogs's highest structural debt is in vendored CodeMirror plugins

Terraform's type and backend layer — 5 functions to address first

Textual's parser and layout engine carry the highest activity risk

supervision's metrics layer carries the highest risk — 5 functions to fix first

MockingBird's training loops carry the most structural debt — 5 functions to fix first

sqlmap's core engine carries the highest activity risk — 5 functions to address first

agno-agi/agno's async run layer — 5 functions to address first

paperless-ngx's signal handlers — 5 functions to address first

vllm's streaming layer carries the highest activity risk — 5 functions to address first

pingcap/tidb's planner and DDL layer — 5 functions to address first

ray-project/ray's RLlib and DAG layers carry the highest risk — 5 functions to fix first

DeepSpeed's accelerator and MoE layers carry the highest risk — 5 functions to fix first

gradio-app/gradio's event pipeline carries the highest activity risk — 5 functions to address first

mitmproxy's web layer carries the highest activity risk — 5 functions to address first

getsentry/sentry's backup, metrics, and query layers carry the highest activity risk — 5 functions to address first

fzf's terminal and options layer carries the highest activity risk — 5 functions to address first

apache/airflow's dev tooling carries the highest activity risk — 5 functions to flag

crewAI's LLM streaming layer carries the highest activity risk — 5 functions to flag

alibaba/zvec's concurrency layer carries the highest activity risk — 5 functions to flag

llama_index's integration layer carries the highest activity risk — 5 functions to address first

pandas-dev/pandas: parser, JSON encoder, and DataFrame construction carry the highest risk

tiptap's markdown layer carries the highest activity risk — 5 functions to address first

Mongoose's query/document layer carries the highest activity risk — 5 functions to address first

nestjs/nest's validation and transport layer carries the highest activity risk — 5 functions to address first

prettier/prettier's printer layer carries the highest activity risk — 5 functions to address first

vitejs/vite's import analysis layer carries the highest activity risk — 5 functions to address first

swagger-ui's JSON Schema layer carries the highest structural debt — 5 functions to address first

lighthouse's audits and renderer carry the highest activity risk — 5 to address first

parallax/jsPDF: WebPDecoder.js holds the highest structural debt — 4 functions to address

sharp's _createInputDescriptor carries the top risk — CC 183, five times the next hotspot

netron's core viewer and tooling carry the highest activity risk — 5 functions to address first

learnGitBranching's app layer carries structural debt — 5 functions to address first

large-monorepo's benchmark.js carries the highest activity risk — 3 functions to watch first

Aider's core coder and I/O layers carry the highest structural debt — 5 functions to address first

CyberChef's core ops carry the highest activity risk — 5 functions to address first

react-bits' tools and backgrounds carry the highest activity risk — 5 functions to address first

streamlit's server and script-runner layer carries the highest activity risk — 5 functions to address first

tesseract.js's worker-script carries the highest activity risk — 4 functions