Read 2026-10-23
bruin-data/ingestr: technical due diligence, read from its repository
What Borehole read in bruin-data/ingestr's code and history at 3fda7b5: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | strong |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | strong |
| Fit with the Acquirer | not assessable |
What the repository says
LICENSE:1: The licence is FSL-1.1-ALv2: source available, not open sourceLICENSE.md: Relicensed: MIT → FSL-1.1-ALv2 (2026-06-01)
Architecture & Codebase — including AI provenance
strongpkg/source/fluxx/fluxx_resources.go is 7,878 lines, 44× this codebase's median file
adequateThe median source file here is 178 lines. 18 files exceed 1,780 lines, the largest being 7,878. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
pkg/source/fluxx/fluxx_resources.go:1 — 7,878 lines (44× median) |
pkg/destination/bigquery/bigquery.go:1 — 3,838 lines (21× median) |
pkg/pipeline/pipeline.go:1 — 3,556 lines (19× median) |
pkg/source/mysql/cdc.go:1 — 3,310 lines (18× median) |
pkg/source/monday/monday.go:1 — 2,844 lines (15× median) |
Engineering Process & SDLC Maturity
strongAlmost no process scaffolding exists in the repository
adequateOf five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.
| 1 of 5 markers present across 1,698 tracked files |
Product & Engineering Maturity
adequate108 direct dependencies in a single manifest
adequatego.mod declares 108 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.
go.mod — 108 declared |
pyproject.toml — 0 declared |
Security & Reliability Posture
adequateThe build runs third-party code it does not pin
adequate2 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 3 steps pipe a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.
.github/workflows/deploy-docs.yml:35 — action pinned by tag |
.github/workflows/deploy-docs.yml:36 — action pinned by tag |
.github/workflows/release.yml:366 — download piped into a shell |
48 SQL statements built from strings
adequate48 places in product code build SQL by formatting or joining strings rather than passing parameters. 1 of them put a value into the string; in the rest, what the code shows going in is a table or column name, a constant, or something the line does not show. Ask whether any value reaches these strings, rather than a parameter.
pkg/source/duckdb/lakehouse.go:204 — SQL built from a string |
pkg/destination/athena/athena.go:411 — SQL built from a string |
pkg/destination/bigquery/bigquery.go:3514 — SQL built from a string |
3 locked dependencies have published vulnerabilities, 1 high or critical in what ships
adequate3 of 426 locked dependencies match 3 published advisories in OSV, 1 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.
The licence is FSL-1.1-ALv2: source available, not open source
adequateLICENSE grants FSL-1.1-ALv2: source available, not open source; a competing commercial product or service is not allowed; each version becomes Apache-2.0 two years after its release. The reading comes from the licence's own title and clauses. Whether the terms fit the buyer's intended use, and whether any paid licence transfers with the code, is a question for counsel and the licensor.
LICENSE:1 — 105 lines, FSL-1.1-ALv2 |
Relicensed: MIT → FSL-1.1-ALv2 (2026-06-01)
adequateThe root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.
LICENSE.md — MIT from 2024-02-12 |
LICENSE — FSL-1.1-ALv2 from 2026-06-01 |
Observability & Operations
strongNo error reporter is wired in
adequateNothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.
| no error reporter initialised |
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on bruin-data/ingestr: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.