analogdotnow/analog: technical due diligence, read from its repository

3 test files against 928 source files (0.3%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

Across 1.3 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.

31 of 320 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

apps/web/package.json declares 120 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Of 87 fixes in the last 24 months, 0 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.