Read 2026-11-03
projectcapsule/capsule: technical due diligence, read from its repository
What Borehole read in projectcapsule/capsule's code and history at e46e9a4: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | strong |
| Observability & Operations | strong |
| Fit with the Acquirer | not assessable |
What the repository says
CONTRIBUTING.md:35: names Linux FoundationGOVERNANCE.md:9: names CNCFsecurity-insights.yml:201: names OpenSSF
Architecture & Codebase — including AI provenance
stronginternal/webhook/customquota/calculation.go is 1,352 lines, 11× this codebase's median file
adequateThe median source file here is 114 lines. 1 file exceed 1,140 lines, the largest being 1,352. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
internal/webhook/customquota/calculation.go:1 — 1,352 lines (11× median) |
Engineering Process & SDLC Maturity
adequate18% of recent commits change more than 2,000 lines
adequate40 of 223 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.
| 40 commits over 2,000 lines |
Product & Engineering Maturity
adequate799 unresolved debt markers, 3.1 per thousand lines
adequateThe codebase carries 799 TODO, FIXME, HACK or XXX markers across 261,440 lines. These are the team's own notes about work they knew was unfinished. A high density is not automatically bad — it can mean an honest team — but every one of them is a decision deferred, and after an acquisition they are deferred onto someone who was not in the room.
e2e/additional_role_bindings_test.go:56 — return k8sClient.Create(context.TODO(), tnt) |
e2e/additional_role_bindings_test.go:78 — Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: tnt.GetName()}, t)).Should |
e2e/additional_role_bindings_test.go:149 — return k8sClient.Create(context.TODO(), tnt) |
e2e/config_administrators_test.go:75 — return k8sClient.Create(context.TODO(), tnt) |
e2e/config_administrators_test.go:89 — ctx := context.TODO() |
Security & Reliability Posture
strong2 of 2 Kubernetes workloads declare no resource limits
adequate2 workload manifests set no CPU or memory limits. One pod that leaks memory or spins can starve everything else on its node, and the scheduler cannot plan capacity for what it cannot see.
charts/capsule/templates/daemonset.yaml — workload with no limits |
charts/capsule/templates/deployment.yaml — workload with no limits |
15 advisories against this project in the last 24 months, 4 high or critical
adequateThe newest was published on 2026-10-21. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. None of them affects the surveyed version. The record is incomplete: NVD: 20 records name capsule with nothing tying them to this repository (CVE-2009-2189, CVE-2010-0039, CVE-2010-0962, …).
| 2026-10-21: GHSA-wpv2-mpqq-vv52 (moderate), fixed in 0.15.0: Forgeable `projectcapsule.dev/managed-by` skip label lets a tenant owner bypass all Capsule `enforce` rules (e.g. `enforce.metadata`) on namespaced and cluster- |
| 2026-10-21: GHSA-4qv9-xv9f-w5xh (high), fixed in 0.15.0: DRA DeviceClass allow-list bypass: only first device request validated, enabling cross-tenant hardware access |
| 2026-10-21: GHSA-jc72-9675-pcmv (moderate), fixed in 0.15.0: Capsule: uncompiled serviceOptions forbidden deniedRegex panics the Service admission webhook (tenant DoS) |
| 2026-10-21: GHSA-793w-c9f9-m6f8 (moderate), fixed in 0.15.0: Unvalidated Tenant class allowedRegex fields cause regexp.MustCompile panic and persistent tenant admission denial |
| 2026-10-21: GHSA-p8j8-x28r-3c9v (critical), fixed in 0.15.0: Authorization bypass via `namespaces/status` and `namespaces/finalize`, whose ownership gate lives only in the mutating webhook, enabling system-namespace hijac |
Observability & Operations
strongNo error reporter is wired in
adequateNothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.
| no error reporter initialised |
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on projectcapsule/capsule: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.