gyf-dev/immersionbar: technical due diligence, read from its repository

In the last 24 months, 0 of 44 commits (0.0%) carry any trace of review: a merge, a pull-request reference, a Reviewed-by or Reviewed-on trailer, a Closes/Fixes reference, a maintainer's sign-off on someone else's change, or a change applied by someone other than its author. Every common review workflow leaves at least one of those, so either review happens somewhere this history cannot see, or it is not happening. A buyer should establish which before relying on the review story they are told.

2 test files against 46 source files (4.3%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

65 of 213 subjects are either under twelve characters or one of the standard placeholders — wip, fix, update. The history is therefore not usable for reconstructing why a decision was taken, which is the main thing an inheriting engineer needs it for. It says nothing about code quality and a great deal about how much context transfers with the asset.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

The app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.