Read 2026-10-28
superglue-ai/superglue: technical due diligence, read from its repository
What Borehole read in superglue-ai/superglue's code and history at 46f30f1: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | strong |
| Fit with the Acquirer | not assessable |
What the repository says
README.md:8: The repository says it is deprecatedLICENSE:1: The licence is FSL-1.1-ALv2: source available, not open sourceLICENSE: Relicensed: GPL-3.0 → FSL-1.1-ALv2 (2025-11-28)packages/core/api/ee/api-key-scopes.ts: 9 files are named as enterprise-edition code
Architecture & Codebase — including AI provenance
strongpackages/shared/templates.ts is 3,606 lines, 31× this codebase's median file
adequateThe median source file here is 116 lines. 7 files exceed 1,160 lines, the largest being 3,606. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
packages/shared/templates.ts:1 — 3,606 lines (31× median) |
packages/web/src/lib/agent/registries/tool-registry.ts:1 — 2,759 lines (23× median) |
packages/core/datastore/postgres.ts:1 — 2,510 lines (21× median) |
packages/web/src/lib/external/anthropic-mcp/types.ts:1 — 1,617 lines (13× median) |
packages/core/deno-runtime/utils/files.ts:1 — 1,378 lines (11× median) |
Engineering Process & SDLC Maturity
adequateTests cover a thin slice of the codebase
adequate33 test files against 420 source files (7.9%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.
| 33 test files / 420 source files |
Tests are retried until they pass
adequateThe suite is configured to retry failing tests (packages/core/utils/webhook.test.ts). A retry turns a flaky test green without saying why it failed, so a green build means the tests passed eventually. Ask how many retries a typical run needs, and which tests need them.
packages/core/utils/webhook.test.ts:43 — test retry |
Product & Engineering Maturity
adequate97 direct dependencies in a single manifest
adequatepackages/web/package.json declares 97 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.
packages/web/package.json — 97 declared |
packages/core/package.json — 65 declared |
packages/shared/package.json — 16 declared |
package.json — 7 declared |
The repository says it is deprecated
adequateIts own README says so on line 8: "This repository is deprecated and no longer maintained.** superglue lives on as a hosted". Everything else in this report describes code its maintainers have said they will not carry forward. A buyer inherits the maintenance.
README.md:8 — This repository is deprecated and no longer maintained.** superglue lives on as a hosted |
Security & Reliability Posture
adequateNone of the standard security guard rails are configured
adequateThere is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.
| checked 5 kinds of guard rail across 621 tracked files; 0 present |
The build runs third-party code it does not pin
adequate5 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 1 step pipes a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.
.github/workflows/docker-publish.server.yml:24 — action pinned by tag |
.github/workflows/docker-publish.server.yml:27 — action pinned by tag |
docker/Dockerfile:99 — download piped into a shell |
17 SQL statements built from strings
adequate17 places in product code build SQL by formatting or joining strings rather than passing parameters, and in 5 of them a value, not a table or column name, goes into the string. Where any of those values comes from a request, it is an injection point. Each site needs a look; the fix, parameters, is small.
packages/core/datastore/ee/postgres.ts:415 — SQL built from a string |
packages/core/datastore/ee/postgres.ts:771 — SQL built from a string |
packages/core/datastore/ee/postgres.ts:1064 — SQL built from a string |
42 locked dependencies have published vulnerabilities, 47 high or critical in what ships
adequate42 of 1,227 locked dependencies match 136 published advisories in OSV, 53 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.
package-lock.json — better-auth 1.6.20: GHSA-965c-763c-88jm (critical), fixed in 1.7.7 |
package-lock.json — next 16.2.9: GHSA-2464-fhr4-w9xw (critical), fixed in 16.4.1 |
package-lock.json — proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h (critical), fixed in 2.0.8 |
The licence is FSL-1.1-ALv2: source available, not open source
adequateLICENSE grants FSL-1.1-ALv2: source available, not open source; a competing commercial product or service is not allowed; each version becomes Apache-2.0 two years after its release. The reading comes from the licence's own title and clauses. Whether the terms fit the buyer's intended use, and whether any paid licence transfers with the code, is a question for counsel and the licensor.
LICENSE:1 — 105 lines, FSL-1.1-ALv2 |
Relicensed: GPL-3.0 → FSL-1.1-ALv2 (2025-11-28)
adequateThe root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.
9 files are named as enterprise-edition code
adequateFiles named `.ee.` are, by the common open-core convention, the paid edition's code, usually under a licence that is not open source even where the rest is. What the buyer may do with each part differs.
packages/core/api/ee/api-key-scopes.ts — enterprise-edition file |
packages/core/api/ee/api-keys.ts — enterprise-edition file |
packages/core/api/ee/index.ts — enterprise-edition file |
Observability & Operations
strongNo error reporter is wired in
adequateNothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.
| no error reporter initialised |
2 of 3 deployed images carry no version, or `latest`
adequate2 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.
docker-compose.yml:37 — image without a version |
docker-compose.yml:58 — image without a version |
The code branches on the environment's name at 16 places
adequate16 places outside configuration test whether they are running in production or staging. Staging then does not exercise production's code, and each deploy is the first run of those branches. Differences belong in configuration the code reads, not in the code.
packages/core/api/systems.ts:23 — branch on the environment name |
packages/core/api/systems.ts:222 — branch on the environment name |
packages/core/api/systems.ts:282 — branch on the environment name |
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on superglue-ai/superglue: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.