mihonapp/mihon: technical due diligence, read from its repository

9 test files against 919 source files (1.0%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

Of 149 fixes in the last 24 months, 2 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Matches for Google API key appear in tracked files outside test and fixture paths. They stay in the history even after they leave the tree, so what matters is whether each was rotated. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when. Only Google API keys matched. Those are often public by design, in a browser app's Firebase or Maps configuration; the question is whether each is restricted to the app's domains and APIs.

The app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.