Read 2026-10-04
mattermost/mattermost-mobile: technical due diligence, read from its repository
What Borehole read in mattermost/mattermost-mobile's code and history at bc03c18: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | not assessable |
| Fit with the Acquirer | not assessable |
What the repository says
.gitmodules:1: 1 submodule(s) this survey does not read: libraries/@mattermost/intune
Architecture & Codebase — including AI provenance
strongapp/components/autocomplete/slash_suggestion/app_command_parser/app_command_parser.ts is 2,021 lines, 23× this codebase's median file
adequateThe median source file here is 85 lines. 5 files exceed 1,000 lines, the largest being 2,021. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
app/components/autocomplete/slash_suggestion/app_command_parser/app_command_parser.ts:1 — 2,021 lines (23× median) |
app/actions/remote/channel.ts:1 — 1,593 lines (18× median) |
app/actions/remote/post.ts:1 — 1,258 lines (14× median) |
app/products/calls/state/actions.ts:1 — 1,238 lines (14× median) |
app/managers/security_manager/index.ts:1 — 1,013 lines (11× median) |
Engineering Process & SDLC Maturity
adequate7% of recent commits change more than 2,000 lines
adequate61 of 866 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.
| 61 commits over 2,000 lines |
Product & Engineering Maturity
adequate98 direct dependencies in a single manifest
adequatepackage.json declares 98 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.
package.json — 98 declared |
Ruby 3.2 is past end of life
adequateThe code is pinned to Ruby 3.2 (end of life 2026-03-31). None of these receives security fixes any more; the first stopped on 2026-03-31. Moving off an unsupported runtime is rarely a one-line change, so a buyer should ask whether the upgrade is planned and what it touches.
.ruby-version — Ruby 3.2, end of life 2026-03-31 |
Security & Reliability Posture
adequate2 credential-shaped strings committed to the tree
adequateMatches for Google API key appear in tracked files outside test and fixture paths. They stay in the history even after they leave the tree, so what matters is whether each was rotated. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when. Only Google API keys matched. Those are often public by design, in a browser app's Firebase or Maps configuration; the question is whether each is restricted to the app's domains and APIs.
| 2 cited: Google API key pattern matched |
7 environment files are committed
adequatefastlane/.env.android.beta, fastlane/.env.android.pr, fastlane/.env.android.release and more are tracked in git. Environment files are where credentials usually live, and committing one usually means nobody decided how secrets reach the running application. Whatever is in it is in the history for good. Check 05.1 says whether it holds anything credential-shaped.
fastlane/.env.android.beta — committed environment file |
fastlane/.env.android.pr — committed environment file |
fastlane/.env.android.release — committed environment file |
The build runs third-party code it does not pin
adequate2 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 2 steps pipe a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.
.github/workflows/pr-test-analysis-override.yml:25 — action pinned by tag |
.github/workflows/pr-test-analysis.yml:40 — action pinned by tag |
.github/workflows/e2e-maestro-template.yml:174 — download piped into a shell |
36 locked dependencies have published vulnerabilities, 53 high or critical in what ships
adequate36 of 1,211 locked dependencies match 107 published advisories in OSV, 59 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.
package-lock.json — shell-quote 1.8.3: GHSA-w7jw-789q-3m8p (critical), fixed in 1.8.4 |
package-lock.json — @xmldom/xmldom 0.8.13: GHSA-27p8-2357-5qqv (high), fixed in 0.8.15 |
package-lock.json — @xmldom/xmldom 0.9.10: GHSA-27p8-2357-5qqv (high), fixed in 0.9.12 |
The app allows plain HTTP to any server
adequateThe app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.
android/app/src/main/AndroidManifest.xml:57 — cleartext allowed app-wide |
android/app/src/main/res/xml/network_security_config.xml:3 — cleartext allowed app-wide |
ios/Mattermost/Info.plist:47 — cleartext allowed app-wide |
9 advisories against this project in the last 24 months
adequateThe newest was published on 2026-05-21. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 9 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.44.0. Answer lives in: the release you run, set against each fixed version.
| 2026-05-21: CVE-2026-22880 (moderate): Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows |
| 2025-11-13: CVE-2025-59480 (moderate): Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance |
| 2025-04-14: CVE-2025-30516 (low): Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized user |
| 2025-03-24: CVE-2025-1558 (moderate): Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application |
| 2025-01-16: CVE-2025-0476 (moderate): Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any us |
Observability & Operations
not assessableNot rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on mattermost/mattermost-mobile: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.