lizardbyte/sunshine: technical due diligence, read from its repository

The median source file here is 107 lines. 29 files exceed 1,070 lines, the largest being 3,767. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

The newest release, v0.23.1, is not on the branch this survey read; the newest release on it is v0.14.1. The shipped product may differ from what this report describes. Survey the release branch too.

20 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 1 step pipes a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

5 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

The newest was published on 2026-09-15. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 7 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 0.14.1. Answer lives in: the release you run, set against each fixed version. GHSA-6p7j-5v8v-w45h (moderate), GHSA-x97g-h2vp-g2c5 (moderate), GHSA-39hj-fxvw-758m (critical) and 1 more are fixed in the surveyed commit; which release carries them cannot be told from this history, which does not place the release users run. Answer lives in: the version you run. The record is incomplete: NVD: 32 records name sunshine with nothing tying them to this repository (CVE-2021-4415, CVE-2022-40692, CVE-2022-4301, …).

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.