Find the TODO that hurts
before it finds you.
Every repository has hundreds of them, and a tracker full of them is a tracker nobody reads. debtradar scores each one on how long it has sat there, how hot the file around it runs, and whether the person who wrote it still works here — so you triage the four that matter instead of four hundred issues.
12.4M
TODOs indexed
38,910
repos scanned
91%
triage accuracy
// THE RADAR
Every TODO, ranked by what it will cost you.
DebtRadar walks your tree, parses comments in 30+ languages, and scores each finding on staleness, churn, author activity and marker severity.
acme/monorepo · push to main · a1b2c3d
✓ 2,481 files parsed
■ 27 critical
■ 114 high
■ 632 low
// TODO: remove this before we ever touch prod auth
services/auth/session.ts:214
// FIXME: race condition, patched with a sleep(200) lol
workers/queue/dispatch.go:77
// HACK: duplicate of the v1 parser, delete when v2 ships
packages/parser/legacy.ts:12
// pagination here breaks past 10k rows, needs keyset
api/handlers/list.py:56
// NOTE: rename this variable someday
ui/components/Chart.tsx:9
// TODO: remove this before we ever touch prod auth
services/auth/session.ts:214 · untouched 891d · author gone 2y
98
RISK
// FIXME: race condition, patched with a sleep(200) lol
workers/queue/dispatch.go:77 · untouched 402d · 31 commits/yr
94
RISK
// HACK: duplicate of the v1 parser, delete when v2 ships
packages/parser/legacy.ts:12 · untouched 233d · author gone 8mo
71
RISK
// pagination here breaks past 10k rows, needs keyset
api/handlers/list.py:56 · untouched 128d · 14 commits/yr
63
RISK
// NOTE: rename this variable someday
ui/components/Chart.tsx:9 · untouched 41d · 1 commit/yr
12
RISK
// PIPELINE
Three steps from blind spot to backlog.
Install once. Every push re-scans and re-ranks — there is nothing to run yourself.
Connect the repo
Install the GitHub App on the repositories you pick. Read access to code and metadata, and it never writes to them. GitLab is planned.
Scan & score
Every TODO, FIXME, HACK and XXX gets parsed, cross-referenced with git blame and file churn, then scored 0–100.
Triage the queue
Work the board worst-first. Move a severity by hand, ask Claude whether a finding is really actionable, or dismiss it. Nothing gets filed in your tracker.
// CLAUDE-POWERED ANALYSIS
It reads the comment like a senior engineer would.
A regex knows a TODO exists. Claude knows the one that says “temporary” has been temporary for three years, that it guards a payment path, and that the author left the company.
- Infers real intent behind vague comments
- Reads the file around the line, not just the line
- Says whether it is actionable and how far the fix reaches
// TODO: signature validation disabled for staging — DO NOT SHIP
Signature validation is disabled on a production auth path — requests are accepted unverified whenever the staging flag leaks into a release build.
It was added for a demo two years ago, and the author's last commit was fourteen months back, so there is nobody left to ask.
VERDICT
ACTIONABLE
SCOPE
SINGLE-FILE
CONFIDENCE
0.86
// CAPABILITIES
Built for repos that got away from you.
Indexed, scored, and explained — so the four that matter surface before the four hundred that do not.
Full-tree scanning
Every TODO, FIXME, HACK and XXX across 18 languages and formats. The first scan reads the whole tree; after that, only what changed.
Risk-weighted ranking
Age, file churn, author activity and marker severity fold into one 0–100 score you can actually sort by.
Claude comment reads
Semantic analysis of what the comment actually means, not just which keyword it matched.
Triage, not another backlog
A board you work worst-first. Override a severity by hand, dismiss in bulk, and nothing gets filed in your tracker.
Every score explains itself
Open any finding and see the four factors behind its number, and how many points each one contributed.
Read-only by design
Read access to code and metadata, nothing more. debtradar never writes to your repository and never opens an issue.