crbnos/carbon: technical due diligence, read from its repository

Across 3.9 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.

382 of 4081 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

apps/erp/package.json declares 133 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Of 1685 fixes in the last 24 months, 217 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

27 of 2,919 locked dependencies match 39 published advisories in OSV, 5 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

Cargo.toml declares MIT. LICENSE contains the text of AGPL-3.0. Package managers and downstream users read the first; auditors and acquirers read the second. One of them is wrong, and until it is settled the terms this code is offered under are genuinely ambiguous.

A directory named for a paid edition carries its own licence. That code is usually not open source even where the rest is; what the buyer may do with each part differs.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.