bigcapitalhq/bigcapital: technical due diligence, read from its repository

1 of 7 `FROM` lines in product Dockerfiles name an image without a version, or with `latest`. Each build pulls whatever the registry serves that day, so the image that ships can change without a commit, and last month's build cannot be reproduced. Pin a version, or a digest.

187 test files against 5,639 source files (3.3%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

2 test files commit a focused `.only`, which runs that test and silently skips the rest of its suite.

72 of 874 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

packages/webapp/package.json declares 125 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Of 407 fixes in the last 24 months, 71 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Within a single package: CSS-in-JS: emotion, styled-components; utility belts: lodash, ramda. Each duplicate is bundle size, two ways of doing the same thing in one codebase, and two upgrade paths to maintain. It is usually the residue of a migration that stopped halfway.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

17 schema migrations (12%) have no working way back: an empty `downgrade`, a `down` that does nothing, or a data migration with no reverse. A bad deploy that includes one is recovered from a backup, not reverted. Ask when a restore was last rehearsed.

95 of 2,835 locked dependencies match 214 published advisories in OSV, 116 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

Files named `.ee.` are, by the common open-core convention, the paid edition's code, usually under a licence that is not open source even where the rest is. What the buyer may do with each part differs.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.