vantage-sh/ec2instances.info: technical due diligence, read from its repository

Across 15.0 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.

Of 219 fixes in the last 24 months, 37 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

In the last two quarters 56% of commits were fixes, against 26% in the quarters before. Rising fix work usually means quality debt is coming due, and it takes time that new work would have had.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

32 of 599 locked dependencies match 114 published advisories in OSV, 56 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.