hapelee/legado-with-md3: technical due diligence, read from its repository

59% of commit subjects are exact repeats of another subject, and subject length varies by only 21.7 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

The median source file here is 93 lines. 51 files exceed 1,000 lines, the largest being 3,756. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

7 files were marked deprecated over two years ago and still are, the oldest since Jan 2022. A deprecation is a promise to remove. Ask what still depends on these, and whether removing them is scheduled.

Matches for Google API key were committed at some point across 7,593 commits examined. Some are still in the working tree. What matters is whether each was rotated after it was committed. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when. Only Google API keys matched. Those are often public by design, in a browser app's Firebase or Maps configuration; the question is whether each is restricted to the app's domains and APIs.

6 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

9 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.