imputnet/cobalt: technical due diligence, read from its repository

In the last 24 months, 180 of 2,430 commits (7.4%) carry any trace of review: a merge, a pull-request reference, a Reviewed-by or Reviewed-on trailer, a Closes/Fixes reference, a maintainer's sign-off on someone else's change, or a change applied by someone other than its author. That is low but not absent. Review may happen in a workflow this history does not record; a buyer should ask how change is approved before it ships.

1 test files against 236 source files (0.4%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

Across 3.7 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.

Of 256 fixes in the last 24 months, 5 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

22 of 439 locked dependencies match 86 published advisories in OSV, 37 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.

None of 402 readable files references an instrumentation, metrics or error-reporting library. If this system is in production, nobody learns that it broke from the system itself — they learn it from a customer. That is a reliability finding before it is an observability one.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.

Nothing in the service carries a request or correlation id, and there is no tracing. When a customer reports a failure, the log lines that belong to their request cannot be picked out from everyone else's.

The service took 443 commits in the last year with no tag, no release commit and no changelog entry. What is running in production cannot be read from the repository, and a bug report cannot be mapped to a version. Ask how the team knows what is deployed.