Borehole · Project · free tier
mljar/mercury
Free reading: not for reliance
a092e9e · 1,196 commits · 432 files
Read 2026-11-03

mljar/mercury: technical due diligence, read from its repository

What Borehole read in mljar/mercury's code and history at a092e9e: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturitystrong
Product & Engineering Maturitystrong
Security & Reliability Postureadequate
Observability & Operationsadequate
Fit with the Acquirernot assessable

What the repository says

  • LICENSE.txt: Relicensed: AGPL-3.0 → Apache-2.0 (2025-11-20)

Architecture & Codebase — including AI provenance

strong
01.6

packages/lab/src/mercury/app/widget.ts is 2,135 lines, 11× this codebase's median file

adequate

The median source file here is 188 lines. 1 file exceed 1,880 lines, the largest being 2,135. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
packages/lab/src/mercury/app/widget.ts:1 — 2,135 lines (11× median)
01.15

34 errors caught and discarded in product code

adequate

34 places catch an error and do nothing with it, across 10 files (0.7 per thousand lines). Each is a failure the system will not report. They surface later as problems nobody can explain, and they are cheap to fix now.

Evidence
mercury/chat/message.py:314 — error caught and discarded
mercury/table.py:47 — error caught and discarded
mercury/table.py:54 — error caught and discarded

Engineering Process & SDLC Maturity

strong

No finding.

Product & Engineering Maturity

strong

No finding.

Security & Reliability Posture

adequate
05.2

None of the standard security guard rails are configured

adequate

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

Evidence
checked 5 kinds of guard rail across 432 tracked files; 0 present
05.6

1 Dockerfile runs the application as root

adequate

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

Evidence
Dockerfile — runs as root
05.26

34 locked dependencies have published vulnerabilities, 75 high or critical

adequate

34 of 1,632 locked dependencies match 122 published advisories in OSV, 75 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

Evidence
yarn.lock — handlebars 4.7.8: GHSA-2w6w-674q-4c4q (critical), fixed in 4.7.9
yarn.lock — proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h (critical), fixed in 2.0.8
yarn.lock — shell-quote 1.8.3: GHSA-w7jw-789q-3m8p (critical), fixed in 1.8.4
05.60

Relicensed: AGPL-3.0 → Apache-2.0 (2025-11-20)

adequate

The root licence changed 1 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

Evidence
LICENSE.txt — AGPL-3.0 from 2023-07-13
LICENSE — Apache-2.0 from 2025-11-20
05.65

6 advisories against this project in the last 24 months, 4 high or critical

adequate

The newest was published on 2026-10-26. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. None of them affects the surveyed version. The record is incomplete: NVD: 39 records name mercury with nothing tying them to this repository (CVE-2001-0442, CVE-2004-1211, CVE-2005-4406, …).

Evidence
2026-10-26: GHSA-w823-3v59-v22p (high), fixed in 3.2.12: Unauthenticated notebook source and saved-output disclosure on token- or password-protected Mercury servers
2026-10-26: GHSA-jgh7-p4h3-836h (critical), fixed in 3.2.12: Exposed Jupyter configuration, conversion, settings, and terminal WebSocket routes in Mercury standalone
2026-10-26: GHSA-8hq5-94w5-f4ff (moderate), fixed in 3.2.12: Unauthenticated notebook enumeration outside the configured directory via ?dir= (NotebooksAPIHandler)
2026-09-11: GHSA-2658-85cv-9wwq (moderate), fixed in 3.2.11: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
2026-08-31: GHSA-rv4m-xm3f-3ccq (critical), fixed in 3.2.6: Mercury: Unauthenticated Remote Code Execution via /api/kernels

Observability & Operations

adequate
06.1

No telemetry or error reporting is wired in anywhere

adequate

None of 262 readable files references an instrumentation, metrics or error-reporting library. If this system is in production, nobody learns that it broke from the system itself — they learn it from a customer. That is a reliability finding before it is an observability one.

Evidence
searched 262 tracked text files for 16 known instrumentation libraries; manifests for metrics, tracing and error-reporting families; locked dependencies for the packages that emit; 0 matched
06.2

No structured logging library is in use

adequate

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.

Evidence
searched 262 files for 10 structured logging libraries; 0 matched
06.9

No error reporter is wired in

adequate

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

Evidence
no error reporter initialised

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on mljar/mercury: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.