Read 2026-10-04
rubygems/rubygems.org: technical due diligence, read from its repository
What Borehole read in rubygems/rubygems.org's code and history at e9b5a3e: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | strong |
| Fit with the Acquirer | not assessable |
Architecture & Codebase — including AI provenance
strongNo finding.
Engineering Process & SDLC Maturity
adequateNothing in the history is tagged as a release
adequateAcross 17.4 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.
| 0 tags across 12,673 commits and 6348 days |
Product & Engineering Maturity
adequateAPI v1 and v2 have been served together for 136 months
adequatev2 first appeared in Jul 2015, and v1 is still in the code 136 months later. Two versions mean two surfaces to secure, document and support. Ask who still calls the old one, and whether retiring it is planned.
config/routes.rb — v1 since Nov 2009 |
config/routes.rb — v2 since Jul 2015 |
Security & Reliability Posture
adequate1 Dockerfile runs the application as root
adequateNo USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.
Dockerfile — runs as root |
1 vendored component with no licence
adequateThird-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.
vendor/assets — 10 tracked files, no licence file |
5 advisories against this project in the last 24 months, 2 high or critical
adequateThe newest was published on 2026-09-30. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 5 of them are fixed in the code you ship could not be told from this history. Answer lives in: the release you run, set against each fixed version.
| 2026-09-30: GHSA-4v88-44mv-8c5r (moderate), fixed in a881d8d: Expired organization invitations could still be accepted |
| 2026-09-30: GHSA-wpx5-r587-w6j2 (moderate), fixed in fdd3a19: Email-change confirmation mails could be sent far more often than intended |
| 2026-09-22: GHSA-p37h-pvp2-fh88 (moderate), fixed in c08c02b: Unbounded number of regex evaluations per request in OIDC access policies |
| 2026-09-15: GHSA-wj84-52wx-4c26 (high), fixed in f6f674e: Organization admins can escalate to owner through gem transfers |
| 2026-07-22: GHSA-9j48-x3c3-mrp2 (high), fixed in d3d11c0: Possible leak of legacy API keys via improper cache configuration |
Observability & Operations
strongNo finding.
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on rubygems/rubygems.org: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.