karatelabs/karate: technical due diligence, read from its repository

What Borehole read in karatelabs/karate's code and history at 3fb9260: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

Dimension	Rating
Architecture & Codebase — including AI provenance	strong
Engineering Process & SDLC Maturity	strong
Product & Engineering Maturity	strong
Security & Reliability Posture	strong
Observability & Operations	not assessable
Fit with the Acquirer	not assessable

What the repository says

README.md:10: names OpenSSF

Architecture & Codebase — including AI provenance

strong

01.6

karate-core/src/main/java/io/karatelabs/driver/cdp/CdpDriver.java is 4,393 lines, 41× this codebase's median file

adequate

The median source file here is 105 lines. 24 files exceed 1,050 lines, the largest being 4,393. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence

karate-core/src/main/java/io/karatelabs/driver/cdp/CdpDriver.java:1 — 4,393 lines (41× median)

karate-core/src/main/java/io/karatelabs/core/StepExecutor.java:1 — 3,830 lines (36× median)

karate-js/src/main/java/io/karatelabs/js/Interpreter.java:1 — 3,600 lines (34× median)

karate-js/src/main/java/io/karatelabs/parser/JsParser.java:1 — 3,438 lines (32× median)

karate-core/src/main/java/io/karatelabs/core/ScenarioRuntime.java:1 — 2,978 lines (28× median)