be06318 → c14ac29
-17,274 commits read
13 findings resolved and 1 appeared; Engineering Process & SDLC Maturity, Observability & Operations improved.
13 findings resolved, 1 appeared, 0 changed severity without clearing. AI-declared share moved from 19% to 78% of added lines — a disclosure, not a rating.
| Dimension | Before | After | ||
|---|---|---|---|---|
| 01 | Architecture & Codebase — including AI provenance | adequate | adequate | — |
| 02 | Engineering Process & SDLC Maturity | adequate | strong | improved |
| 03 | Organizational Health | strong | strong | — |
| 04 | Product & Engineering Maturity | adequate | adequate | — |
| 05 | Security & Reliability Posture | adequate | adequate | — |
| 06 | Observability & Operations | adequate | strong | improved |
| 07 | Fit with the Acquirer | not assessable | not assessable | — |
Engineering Process & SDLC Maturity
Resolved — Tests are retried until they pass
Product & Engineering Maturity
Resolved — 7 files still carry code deprecated more than two years ago
Resolved — 39 feature flags have been live for over a year
Still present, reason changed — 142 direct dependencies in a single manifest
Security & Reliability Posture
Resolved — 3 locked dependencies have published vulnerabilities, 2 high or critical
Resolved — 99 of 400 migrations cannot be rolled back
Resolved — 1 environment file is committed
Resolved — The production build publishes source maps
Resolved — The build runs third-party code it does not pin
Resolved — 3 deserialisers that can run code
Resolved — 7 places insert HTML from a variable without sanitising it
Appeared — 1 Dockerfile(s) run the application as root
Observability & Operations
Resolved — 1 of 3 deployed images carry no version, or `latest`
Resolved — No error reporter is wired in
Resolved — Readiness and liveness probes are identical in 2 of 2 workloads