Borehole · Project · free tier
dani-garcia/vaultwarden
Free reading: not for reliance
061694d · 3,096 commits · 565 files
Read 2026-10-04

dani-garcia/vaultwarden: technical due diligence, read from its repository

What Borehole read in dani-garcia/vaultwarden's code and history at 061694d: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturityadequate
Product & Engineering Maturityadequate
Security & Reliability Posturestrong
Observability & Operationsnot assessable
Fit with the Acquirernot assessable

What the repository says

  • LICENSE.txt: Relicensed: GPL-3.0 → AGPL-3.0 (2023-02-12)

Architecture & Codebase — including AI provenance

strong
01.6

src/api/core/organizations.rs is 3,294 lines, 823× this codebase's median file

adequate

The median source file here is 4 lines. 9 files exceed 1,000 lines, the largest being 3,294. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
src/api/core/organizations.rs:1 — 3,294 lines (823× median)
src/api/core/ciphers.rs:1 — 2,254 lines (563× median)
src/config.rs:1 — 1,876 lines (469× median)
src/api/core/accounts.rs:1 — 1,857 lines (464× median)
src/api/identity.rs:1 — 1,370 lines (342× median)

Engineering Process & SDLC Maturity

adequate
02.3

Tests cover a thin slice of the codebase

adequate

33 test files against 417 source files (7.9%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

Evidence
33 test files / 417 source files

Product & Engineering Maturity

adequate
04.19

3% of bug fixes add or change a test

adequate

Of 141 fixes in the last 24 months, 4 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Evidence
4 of 141

Security & Reliability Posture

strong
05.26

5 locked dependencies have published vulnerabilities, 4 high or critical

adequate

5 of 633 locked dependencies match 13 published advisories in OSV, 4 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

Evidence
Cargo.lock — rustls-webpki 0.101.7: GHSA-82j2-j2ch-gfr8 (high), fixed in 0.103.13
Cargo.lock — vaultwarden 1.0.0: GHSA-h4hq-rgvh-wh27 (high), fixed in 1.35.4
Cargo.lock — rsa 0.9.10: RUSTSEC-2023-0071 (moderate)
05.60

Relicensed: GPL-3.0 → AGPL-3.0 (2023-02-12)

adequate

The root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.

Evidence
LICENSE.txt — GPL-3.0 from 2018-02-14
LICENSE.txt — AGPL-3.0 from 2023-02-12
05.65

34 advisories against this project in the last 24 months, 13 high or critical

adequate

The newest was published on 2026-10-03. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. None of them affects the surveyed version.

Evidence
2026-10-03: GHSA-wc45-m6pv-rrf9 (moderate), fixed in 1.37.0: Send access limits not enforced on the new Send access endpoints
2026-10-03: GHSA-jq2g-h4xr-4mcr (moderate), fixed in 1.37.0: Cipher Ownership Confusion in Organization Import
2026-10-03: GHSA-96f7-78q5-j345 (moderate), fixed in 1.37.0: Unauthenticated WebSocket connection flooding on /notifications/anonymous-hub (resource-exhaustion DoS)
2026-10-03: GHSA-f3qw-qg77-hmm4 (moderate), fixed in 1.37.0: IDOR in Organization Import Allows Unauthorized Data Injection
2026-10-03: GHSA-vh5m-fc9v-m84g (moderate), fixed in 1.37.0: SSRF filter bypass (regex not applied post-resolution)

Observability & Operations

not assessable

Not rated: only 4 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on dani-garcia/vaultwarden: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.