sanity-io/sanity: technical due diligence, read from its repository

1 test command in CI ends in `|| true` or an equivalent, so the pipeline passes whatever the tests say. A green build then means the tests ran, not that they passed.

packages/sanity/package.json declares 108 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key. 6 other matchs set aside: expired tokens, licence tokens a vendor verifies with a public key, or placeholder text where a key would go. None grants access to anything.

41 of 2,890 locked dependencies match 132 published advisories in OSV, 64 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.