25cb6fc → 599026a
+18,206 commits read
3 findings resolved and 8 appeared; Architecture & Codebase — including AI provenance, Engineering Process & SDLC Maturity improved.
3 findings resolved, 8 appeared, 0 changed severity without clearing. AI-declared share moved from 36% to 19% of added lines — a disclosure, not a rating.
| Dimension | Before | After | ||
|---|---|---|---|---|
| 01 | Architecture & Codebase — including AI provenance | adequate | strong | improved |
| 02 | Engineering Process & SDLC Maturity | adequate | strong | improved |
| 03 | Organization & Key-Person Risk | strong | strong | — |
| 04 | Product & Engineering Maturity | adequate | adequate | — |
| 05 | Security & Reliability Posture | adequate | adequate | — |
| 06 | Observability & Operations | adequate | adequate | — |
| 07 | Fit with the Acquirer | not assessable | not assessable | — |
Product & Engineering Maturity
Appeared — 7 files still carry code deprecated more than two years ago
Appeared — 39 feature flags have been live for over a year
Appeared — Releases are cut from another branch than the one surveyed
Security & Reliability Posture
Resolved — 1 Dockerfile runs the application as root
Resolved — 3 shell commands built from strings
Resolved — 5 SQL statements built from strings
Appeared — 17 advisories against this project in the last 24 months, 5 high or critical
Appeared — The production build publishes source maps
Appeared — 7 places insert HTML from a variable without sanitising it
Still present, reason changed — 7 locked dependencies have published vulnerabilities, 4 high or critical in what ships
Still present, reason changed — The build runs third-party code it does not pin
Still present, reason changed — 3 deserialisers that can run code
Observability & Operations
Appeared — 1 of 3 deployed images carry no version, or `latest`
Appeared — Readiness and liveness probes are identical in 2 of 2 workloads