uvdesk/community-skeleton: technical due diligence, read from its repository

42% of commit subjects are exact repeats of another subject, and subject length varies by only 16.8 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: contribution guidance. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

.env is tracked in git. Environment files are where credentials usually live, and committing one usually means nobody decided how secrets reach the running application. Whatever is in it is in the history for good. Check 05.1 says whether it holds anything credential-shaped.

The newest was published on 2026-09-16. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 1 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 1.1.8. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 1 record names community-skeleton with nothing tying it to this repository (CVE-2023-37635).