chatboxai/chatbox: technical due diligence, read from its repository

The median source file here is 93 lines. 21 files exceed 1,000 lines, the largest being 2,649. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — none are present. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

The suite is configured to retry failing tests (src/renderer/components/InputBox/PendingActionBar.test.tsx). A retry turns a flaky test green without saying why it failed, so a green build means the tests passed eventually. Ask how many retries a typical run needs, and which tests need them.

4 places in product code build SQL by formatting or joining strings rather than passing parameters. In each, what the code shows going in is a table or column name, a constant, or something the line does not show, not a request's value. Ask whether any value reaches these strings, rather than a parameter.

The newest was published on 2026-04-12. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 1 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 1.23.5. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 21 records name chatbox with nothing tying them to this repository (CVE-2006-0857, CVE-2014-5958, CVE-2020-35852, …).