cockroachdb/cockroach: technical due diligence, read from its repository

go.mod declares 216 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

133 places in product code build SQL by formatting or joining strings rather than passing parameters, and in 5 of them a value, not a table or column name, goes into the string. Where any of those values comes from a request, it is an injection point. Each site needs a look; the fix, parameters, is small.

108 of 2,967 locked dependencies match 175 published advisories in OSV, 101 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

4 places in the deployment configuration run a container privileged or in the host's network, process or IPC namespace. A compromise of that container is a compromise of the machine, and most acquirers' security reviews block it. Node agents (network, storage, monitoring) are excluded.

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.

LICENSE exists but its text does not match any standard licence. A bespoke or hand-edited licence is not wrong, but it cannot be cleared by recognising its name: counsel has to read it, and until they do neither side knows precisely what rights transfer with the code.

pkg/sql/opt/memo/statistics_builder.go sends to stats.stackexchange.com, and pkg/server/status.go leaves reporting on as shipped. Every installation reports to the vendor unless its operator turns this off. For a buyer running it inside their own product, that is an outbound data flow to a third party: ask what is sent, how often, and whether the buyer's customers were told.