mailtrain-org/mailtrain: technical due diligence, read from its repository

The median source file here is 66 lines. 8 files exceed 1,000 lines, the largest being 9,227. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

55 places catch an error and do nothing with it, across 7 files (0.7 per thousand lines). Each is a failure the system will not report. They surface later as problems nobody can explain, and they are cheap to fix now.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — none are present. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

The code is pinned to Node.js 10 (end of life 2021-04-30). None of these receives security fixes any more; the first stopped on 2021-04-30. Moving off an unsupported runtime is rarely a one-line change, so a buyer should ask whether the upgrade is planned and what it touches.

34 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

The root licence changed 3 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

The newest was published on 2021-02-19. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 1 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.20210609.0. Answer lives in: the release you run, set against each fixed version.

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

1 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.