Is a single commented-out line a problem?

No. The check fires on runs of 8+ comment-only lines so a one-line note or a small placeholder never triggers it. The pattern — not the instance — is the finding.

What should happen to commented-out code?

Delete it or restore it. The repository already stores the deleted version, so a comment block that mirrors old code adds noise without adding information.

When is a TODO acceptable?

When it has a tracking reference and a date, and the total stays low. The scan's threshold represents the density at which TODOs stop being notes and become an accounting problem.

AI code debt

Comment Rot Check — Is Commented-Out Code and TODO Debt Piling Up?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

Commented-out code blocks and a market of unresolved TODOs make the codebase harder to trust: readers cannot tell what the app does from what the comments claim it did, and abandoned threads look identical to planned features.

Why AI tools generate it

Agents disable code with a comment instead of deleting it because a revert is cheaper than a decision, and they mark unfinished threads TODO because the release is the priority. Both habits compound file by file.

How DevMeth detects it

The scan finds runs of 8+ consecutive comment-only lines where most still look like code (JSDoc excluded), counts TODO/FIXME/HACK/XXX markers, and reports marker density over 10 per 1000 lines with at least 15 total.

What a finding looks like

Medium

Blocks of commented-out code and a rising tide of TODO markers clutter the codebase

WHAT WE FOUND

lib/legacy.ts — 10 consecutive commented-out code lines

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Delete or restore each commented-out block, and turn every marker into a resolution or a tracked issue with a link. Version control is the real history; comments are the residue.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Maintainability findings ship in the Rescue Report — bundled with the Launch Pack or available on its own.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.