plasmicapp/plasmic: technical due diligence, read from its repository

126 of 2179 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

platform/wab/package.json declares 242 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Within a single package: HTTP clients: axios, node-fetch; dates: date-fns, dayjs, moment. Each duplicate is bundle size, two ways of doing the same thing in one codebase, and two upgrade paths to maintain. It is usually the residue of a migration that stopped halfway.

The last tag, create-plasmic-app@0.0.80, was cut 1118 days before the survey; the typical gap between releases was 0 days, and 411 commits landed in the last 90 days. Users run the last release, not this code.

Matches for JWT appear in tracked files outside test and fixture paths. They stay in the history even after they leave the tree, so what matters is whether each was rotated. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

107 of 5,472 locked dependencies match 218 published advisories in OSV, 116 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.