Borehole · Project · free tier

goharbor/harbor

Free reading: not for reliance

d822d80 · 12,940 commits · 3,310 files
Read 2026-10-28

goharbor/harbor: technical due diligence, read from its repository

What Borehole read in goharbor/harbor's code and history at d822d80: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

Dimension	Rating
Architecture & Codebase — including AI provenance	strong
Engineering Process & SDLC Maturity	strong
Product & Engineering Maturity	adequate
Security & Reliability Posture	adequate
Observability & Operations	strong
Fit with the Acquirer	not assessable

What the repository says

Releases are cut from another branch than the one surveyed
LICENSE: Relicensed: Apache-2.0 → CDDL-1.0 (2016-11-28) → Apache-2.0 (2018-01-22)
CONTRIBUTING.md:14: names CNCF
README.md:11: names OpenSSF
README.md:27: names Cloud Native Computing Foundation

Architecture & Codebase — including AI provenance

strong

01.6

src/portal/src/app/base/project/repository/artifact/artifact-list-page/artifact-list/artifact-list-tab/artifact-list-tab.component.ts is 1,319 lines, 13× this codebase's median file

adequate

The median source file here is 97 lines. 4 files exceed 1,000 lines, the largest being 1,319. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence

src/portal/src/app/base/project/repository/artifact/artifact-list-page/artifact-list/artifact-list-tab/artifact-list-tab.component.ts:1

— 1,319 lines (13× median)

src/controller/scan/base_controller.go:1 — 1,181 lines (12× median)

src/portal/src/app/shared/units/utils.ts:1 — 1,127 lines (11× median)

src/server/v2.0/handler/project.go:1 — 1,077 lines (11× median)

Engineering Process & SDLC Maturity

strong

No finding.

Product & Engineering Maturity

adequate

04.20

Fixes are 51% of recent work, up from 25%

adequate

In the last two quarters 51% of commits were fixes, against 25% in the quarters before. Rising fix work usually means quality debt is coming due, and it takes time that new work would have had.

Evidence

45%, 58%, 43%, 39%, 6%, 11%, 26%, 24%

04.62

Releases are cut from another branch than the one surveyed

adequate

The newest release, v2.15.4, is not on the branch this survey read; the newest release on it is v1.2.0. The shipped product may differ from what this report describes. Survey the release branch too.

Evidence

tag v2.15.4

Security & Reliability Posture

adequate

05.1

3 credential-shaped strings in the tree sit in tests, examples, documentation or local development settings

adequate

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key. 5 other matchs set aside: expired tokens, licence tokens a vendor verifies with a public key, or placeholder text where a key would go. None grants access to anything.

Evidence

3 cited: JWT, where fakes are usual

05.6

4 Dockerfiles run the application as root

adequate

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

Evidence

.oss-scanner/Dockerfile — runs as root

make/photon/common/Dockerfile — runs as root

make/photon/log/Dockerfile — runs as root

make/photon/prepare/Dockerfile — runs as root

05.13

6 outbound calls can wait forever

adequate

6 HTTP calls use a client with no timeout (Python `requests` without `timeout=`, or Go's default client). When a dependency slows down, each one holds a worker until the connection gives up, and enough of them take the service down with the dependency.

Evidence

src/common/utils/uaa/client.go:229 — outbound call without a timeout

src/core/auth/authproxy/auth.go:229 — outbound call without a timeout

src/jobservice/job/impl/notification/http_helper.go:68 — outbound call without a timeout

05.20

1 SQL statement built from strings

adequate

1 places in product code build SQL by formatting or joining strings rather than passing parameters. In each, what the code shows going in is a table or column name, a constant, or something the line does not show, not a request's value. Ask whether any value reaches these strings, rather than a parameter.

Evidence

src/lib/orm/orm.go:301 — SQL built from a string

05.26

12 locked dependencies have published vulnerabilities, 6 high or critical in what ships

adequate

12 of 572 locked dependencies match 23 published advisories in OSV, 9 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

Evidence

src/portal/app-swagger-ui/package-lock.json — dompurify 3.4.16: GHSA-cg2g-xh64-v4q7 (critical), fixed in 3.4.17

src/portal/package-lock.json — @angular/router 21.2.20: GHSA-57xq-rjx2-v5xh (high), fixed in 21.2.25

src/portal/app-swagger-ui/package-lock.json — js-yaml 4.3.1: GHSA-2883-xcg3-v3hh (high), fixed in 4.3.2

05.49

The production build publishes source maps

adequate

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.

Evidence

src/portal/angular.json:63 — source maps in a production build

05.60

Relicensed: Apache-2.0 → CDDL-1.0 (2016-11-28) → Apache-2.0 (2018-01-22)

adequate

The root licence changed 2 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

Evidence

LICENSE — Apache-2.0 from 2016-02-01

LICENSE — CDDL-1.0 from 2016-11-28

LICENSE — Apache-2.0 from 2018-01-22

05.65

22 advisories against this project in the last 24 months, 9 high or critical

adequate

The newest was published on 2026-10-28. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 21 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 1.2.0. Answer lives in: the release you run, set against each fixed version. GHSA-f9vc-vf3r-pqqq (moderate) is fixed in the surveyed commit; which release carries it cannot be told from this history, which does not place the release users run. Answer lives in: the version you run. The record is incomplete: NVD: 3 records name harbor with nothing tying them to this repository (CVE-2017-17697, CVE-2022-46463, CVE-2024-51419).

Evidence

2026-10-28: GHSA-x955-mxjx-g5cj (high), fixed in 2.14.6: Unauthenticated PUT request to /api/v2.0/users crashes Harbor core

2026-10-26: CVE-2026-111590 (unrated): A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of priv

2026-10-06: GHSA-w5fq-xrhj-j7g2 (high), fixed in 2.13.6: A system robot with user:update makes itself a system administrator

2026-10-06: GHSA-xq2m-cj8w-56v5 (high), fixed in 2.13.6: Robot "cover all projects" scope collapses into a global wildcard, conferring the deliberately-ungrantable robot:update — enabling cross-project robot takeover

2026-10-06: GHSA-27f2-qg57-2gwg (moderate), fixed in 2.13.6: Immutable tag rule matcher only evaluates first repository/tag selector, allowing multi-selector rules to be bypassed

Observability & Operations

strong

06.9

No error reporter is wired in

adequate

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

Evidence

no error reporter initialised

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

goharbor/harbor: technical due diligence, read from its repository

What the repository says

Architecture & Codebase — including AI provenance

src/portal/src/app/base/project/repository/artifact/artifact-list-page/artifact-list/artifact-list-tab/artifact-list-tab.component.ts is 1,319 lines, 13× this codebase's median file

Engineering Process & SDLC Maturity

Product & Engineering Maturity

Fixes are 51% of recent work, up from 25%

Releases are cut from another branch than the one surveyed

Security & Reliability Posture

3 credential-shaped strings in the tree sit in tests, examples, documentation or local development settings

4 Dockerfiles run the application as root

6 outbound calls can wait forever

1 SQL statement built from strings

12 locked dependencies have published vulnerabilities, 6 high or critical in what ships

The production build publishes source maps

Relicensed: Apache-2.0 → CDDL-1.0 (2016-11-28) → Apache-2.0 (2018-01-22)

22 advisories against this project in the last 24 months, 9 high or critical

Observability & Operations

No error reporter is wired in

Fit with the Acquirer

Read more, or read your own