documize/community: technical due diligence, read from its repository

The median source file here is 73 lines. 8 files exceed 1,000 lines, the largest being 15,117. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The code is pinned to Go 1.21 (end of life 2024-08-13); Node.js 16 (end of life 2023-09-11). None of these receives security fixes any more; the first stopped on 2023-09-11. Moving off an unsupported runtime is rarely a one-line change, so a buyer should ask whether the upgrade is planned and what it touches.

17 files were marked deprecated over two years ago and still are, the oldest since Feb 2018. A deprecation is a promise to remove. Ask what still depends on these, and whether removing them is scheduled.

Matches for private key block were committed at some point across 1,693 commits examined. Some are still in the working tree. What matters is whether each was rotated after it was committed. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when. 5 other matchs set aside: expired tokens, licence tokens a vendor verifies with a public key, or placeholder text where a key would go. None grants access to anything.

13 HTTP calls use a client with no timeout (Python `requests` without `timeout=`, or Go's default client). When a dependency slows down, each one holds a worker until the connection gives up, and enough of them take the service down with the dependency.

Third-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

1 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.