Source code
Code quality
TODO/FIXME/mock data in production
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
A TODO, FIXME, stub return, or hardcoded mock response is still present on a code path that runs in production.
Why it matters
Generated scaffolding often includes a placeholder that returns a fixed value so the shape compiles. Left in, it silently answers real requests with test data — the function works, it just is not doing anything.
How to fix it
Implement the path or delete it. If it must ship unfinished, fail loudly behind a feature flag rather than returning a plausible-looking placeholder.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.