vriteio/andesine: technical due diligence, read from its repository

In the last 24 months, 0 of 161 commits (0.0%) carry any trace of review: a merge, a pull-request reference, a Reviewed-by or Reviewed-on trailer, a Closes/Fixes reference, a maintainer's sign-off on someone else's change, or a change applied by someone other than its author. Every common review workflow leaves at least one of those, so either review happens somewhere this history cannot see, or it is not happening. A buyer should establish which before relying on the review story they are told.

4 test files against 1,750 source files (0.2%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

40 of 150 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

Of 78 fixes in the last 24 months, 0 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

The last tag, v0.4.4, was cut 851 days before the survey; the typical gap between releases was 19 days, and 130 commits landed in the last 90 days. Users run the last release, not this code.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

40 of 1,977 locked dependencies match 162 published advisories in OSV, 75 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

package.json declares AGPL-3.0. LICENSE contains the text of MIT. Package managers and downstream users read the first; auditors and acquirers read the second. One of them is wrong, and until it is settled the terms this code is offered under are genuinely ambiguous.

None of 1,940 readable files references an instrumentation, metrics or error-reporting library. If this system is in production, nobody learns that it broke from the system itself — they learn it from a customer. That is a reliability finding before it is an observability one.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.