makeplane/plane: technical due diligence, read from its repository

1 of 9 `FROM` lines in product Dockerfiles name an image without a version, or with `latest`. Each build pulls whatever the registry serves that day, so the image that ships can change without a commit, and last month's build cannot be reproduced. Pin a version, or a digest.

124 test files against 3,730 source files (3.3%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

Of 1152 fixes in the last 24 months, 77 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

24 schema migrations (19%) have no working way back: an empty `downgrade`, a `down` that does nothing, or a data migration with no reverse. A bad deploy that includes one is recovered from a backup, not reverted. Ask when a restore was last rehearsed.

7 of 1,418 locked dependencies match 29 published advisories in OSV, 12 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

The newest was published on 2026-09-28. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. The record is incomplete: NVD: 108 records name plane with nothing tying them to this repository (CVE-2022-28199, CVE-2023-50913, CVE-2023-53864, …).

apps/api/plane/utils/otlp_endpoints.py sends to telemetry.plane.so, and apps/admin/components/instance/setup-form.tsx leaves reporting on as shipped. Every installation reports to the vendor unless its operator turns this off. For a buyer running it inside their own product, that is an outbound data flow to a third party: ask what is sent, how often, and whether the buyer's customers were told.