goauthentik/authentik: technical due diligence, read from its repository

web/package.json declares 106 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Of 998 fixes in the last 24 months, 197 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

63 of 3,449 locked dependencies match 160 published advisories in OSV, 89 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

A directory named for a paid edition carries its own licence. That code is usually not open source even where the rest is; what the buyer may do with each part differs.

The newest was published on 2026-09-09. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. GHSA-cxwx-9x59-28qm (high), GHSA-qgqp-xh8r-v73r (high), GHSA-h6c5-mpvq-j4jc (high) and 11 more are fixed in the surveyed commit; which release carries them cannot be told from this history, which does not place the release users run. Answer lives in: the version you run.