Read 2026-10-23
talivia-group/talivia: technical due diligence, read from its repository
What Borehole read in talivia-group/talivia's code and history at a9bdc51: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | adequate |
| Engineering Process & SDLC Maturity | strong |
| Product & Engineering Maturity | not assessable |
| Security & Reliability Posture | adequate |
| Observability & Operations | adequate |
| Fit with the Acquirer | not assessable |
Architecture & Codebase — including AI provenance
adequateThe repository begins with most of itself already written
adequateThe first commit carries 118,654 lines — 98% of every line ever added. Whatever happened before that commit happened somewhere this repository cannot show you, so the early history is not available as evidence of how the system was designed.
| 2026-07-29T07:56:50+00:00; +118,654 across 1312 files; subject: 'feat(app): init' |
src/queries/prisma/payment.ts is 1,919 lines, 39× this codebase's median file
adequateThe median source file here is 48 lines. 5 files exceed 1,000 lines, the largest being 1,919. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
src/queries/prisma/payment.ts:1 — 1,919 lines (39× median) |
prisma/migrations/0001_oss_baseline/migration.sql:1 — 1,361 lines (28× median) |
src/components/metrics/OverviewChart.tsx:1 — 1,137 lines (23× median) |
src/components/charts/Chart.tsx:1 — 1,131 lines (23× median) |
src/app/(main)/websites/[websiteId]/settings/WebsiteRevenueSettings.tsx:1 — 1,035 lines (21× median) |
Engineering Process & SDLC Maturity
strongNo finding.
Product & Engineering Maturity
not assessableNot rated: only 8 of 19 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.
Security & Reliability Posture
adequate44 locked dependencies have published vulnerabilities, 38 high or critical in what ships
adequate44 of 1,093 locked dependencies match 144 published advisories in OSV, 67 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.
pnpm-lock.yaml — next 16.2.6: GHSA-2464-fhr4-w9xw (critical), fixed in 16.4.1 |
pnpm-lock.yaml — brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp (high), fixed in 1.1.16 |
pnpm-lock.yaml — brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp (high), fixed in 2.1.2 |
Observability & Operations
adequateNo structured logging library is in use
adequateNothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.
| searched 939 files for 10 structured logging libraries; 0 matched |
One request cannot be followed through the logs
adequateNothing in the service carries a request or correlation id, and there is no tracing. When a customer reports a failure, the log lines that belong to their request cannot be picked out from everyone else's.
| no request id, correlation id or tracing found |
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on talivia-group/talivia: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.