Borehole · Project · free tier

heyputer/everything

Free reading: not for reliance

31d418c · 221 commits · 34,206 files
Read 2026-10-23

heyputer/everything: technical due diligence, read from its repository

What Borehole read in heyputer/everything's code and history at 31d418c: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

Dimension	Rating
Architecture & Codebase — including AI provenance	adequate
Engineering Process & SDLC Maturity	adequate
Product & Engineering Maturity	not assessable
Security & Reliability Posture	adequate
Observability & Operations	not assessable
Fit with the Acquirer	not assessable

Architecture & Codebase — including AI provenance

adequate

01.2

The repository begins with most of itself already written

adequate

The first commit carries 11,015,022 lines — 89% of every line ever added. Whatever happened before that commit happened somewhere this repository cannot show you, so the early history is not available as evidence of how the system was designed.

Evidence

2026-10-13T16:12:00+00:00; +11,015,022 across 29865 files; subject: 'Add MIT license'

01.6

src/presentation/src/main.js is 17,172 lines, 107× this codebase's median file

adequate

The median source file here is 160 lines. 76 files exceed 1,600 lines, the largest being 17,172. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence

src/presentation/src/main.js:1 — 17,172 lines (107× median)

src/spreadsheet/src/core/workbook.js:1 — 14,571 lines (91× median)

src/presentation/lib/pptx-preview/src/render-slide.ts:1 — 13,066 lines (81× median)

src/pdf/src/editor.js:1 — 12,370 lines (77× median)

src/spreadsheet/src/core/formula/functions.js:1 — 9,426 lines (58× median)

01.42

3 model weight files committed directly to git

adequate

3 model weight files are stored in git itself, not in LFS, DVC or a model hub. Every clone carries them, the history keeps every version for good, and nothing records which run or data produced them.

Evidence

src/meetings/public/models/selfie_segmenter_landscape.tflite — weights in git

src/video-studio/src/media/models/hair-segmenter.tflite — weights in git

src/video-studio/src/media/models/person-segmenter.tflite — weights in git

Engineering Process & SDLC Maturity

adequate

02.6

Almost no process scaffolding exists in the repository

adequate

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

Evidence

1 of 5 markers present across 34,206 tracked files

02.24

19% of recent commits change more than 2,000 lines

adequate

38 of 197 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

Evidence

38 commits over 2,000 lines

Product & Engineering Maturity

not assessable

Not rated: only 4 of 19 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Security & Reliability Posture

adequate

05.2

None of the standard security guard rails are configured

adequate

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

Evidence

checked 5 kinds of guard rail across 34,206 tracked files; 0 present

05.26

1 locked dependency has published vulnerabilities, 1 high or critical in what ships

adequate

1 of 267 locked dependencies match 1 published advisories in OSV, 1 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

Evidence

src/signatures/package-lock.json — pdfjs-dist 5.7.284: GHSA-hq66-cqwq-w95j (high), fixed in 6.2.108

Observability & Operations

not assessable

Not rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

heyputer/everything: technical due diligence, read from its repository

Architecture & Codebase — including AI provenance

The repository begins with most of itself already written

src/presentation/src/main.js is 17,172 lines, 107× this codebase's median file

3 model weight files committed directly to git

Engineering Process & SDLC Maturity

Almost no process scaffolding exists in the repository

19% of recent commits change more than 2,000 lines

Product & Engineering Maturity

Security & Reliability Posture

None of the standard security guard rails are configured

1 locked dependency has published vulnerabilities, 1 high or critical in what ships

Observability & Operations

Fit with the Acquirer

Read more, or read your own