Read 2026-11-03
wpscanteam/wpscan: technical due diligence, read from its repository
What Borehole read in wpscanteam/wpscan's code and history at b7b012f: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | strong |
| Security & Reliability Posture | adequate |
| Observability & Operations | not assessable |
| Fit with the Acquirer | not assessable |
Architecture & Codebase — including AI provenance
strongNo finding.
Engineering Process & SDLC Maturity
adequatePinned dependencies have not moved in 43 months
adequateThe lockfile last changed 1317 days before the newest commit, and 191 commits have landed since. Every security fix published upstream in that time is absent until someone updates it, and the longer the gap the larger and riskier that update becomes.
| spec/fixtures/dynamic_finders/plugin_version/acf-content-analysis-for-yoast-seo/composer_file/package-lock.json last changed 2023-03-19 |
Product & Engineering Maturity
strongNo finding.
Security & Reliability Posture
adequate1 credential-shaped string in the tree sit in tests, examples, documentation or local development settings
adequateStrings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.
| Google API key, where fakes are usual |
Licence text does not match a standard licence
adequateLICENSE exists but its text does not match any standard licence. A bespoke or hand-edited licence is not wrong, but it cannot be cleared by recognising its name: counsel has to read it, and until they do neither side knows precisely what rights transfer with the code.
LICENSE:1 — 72 lines, unrecognised |
Observability & Operations
not assessableNot rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on wpscanteam/wpscan: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.