supertokens/supertokens-core: technical due diligence, read from its repository

38% of commit subjects are exact repeats of another subject, and subject length varies by only 21.8 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

The median source file here is 167 lines. 4 files exceed 1,670 lines, the largest being 4,788. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

13 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

The root licence changed 1 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

The newest was published on 2026-10-16. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 2 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 12.4.0. Answer lives in: the release you run, set against each fixed version.