One audit. What everyone sees. What you receive.

Six axes

Grades out of 10 at commit e391c68, method v1.1.0.

• architecture 8/10
• performance 7/10 weakest axis
• consistency 8/10
• security 8/10
• documentation 8/10
• correctness 8/10

Findings by detectability

Check gaps count quality checks that are missing, not run, failing or too loose; they are not added to the defects above. 18 review notes are not defects and are not counted.

Findings by axis

In this sample, counts link to the detailed findings below. On public evaluations, only the counts are visible. Finding details remain private.

Badge

The badge of this sample evaluation, as the repository README shows it.

Summary

Synthesis

The codebase is uniformly good, and the one movement since review_kwalitai_20261017_2 is real. Commit 9f47c79 made the complexity gate measure what the thresholds say, and the five cyclomatic-11 functions came down to 10 or below, so Consistency rises from 7 to 8.

Performance is the weakest axis at 7. That is not because of a slow path: the directory query is unbounded and production cannot be measured.

The single biggest operational risk is new and cheap to close. make up will start production without TRUSTED_PROXIES, and then every visitor shares one contact-form limit, so one sender can lock the sales contact channel.

The biggest process risk is recurrence: 14 of the 16 defect and gate rows in this review were raised in earlier reviews, and each is a missing detector, not a missing fix.

Confidence limits: branch protection could not be read (there is no origin remote), so every wired CI job is treated as blocking. The production .env was not inspected. The new ingest finding is confirmed by reading the code, not by execution. semgrep and tree-sitter did not run, so the resource-safety and structural checks rest on reading the source.

Recommendations

In priority order.

1. Medium Wire the detectors behind today's 5 tool-detectable defects. (a) Add a TRUSTED_PROXIES check to make preflight (Makefile:106-113): without it, production can start with every visitor sharing one contact limit. (b) Add the shared semgrep pack, at least go.sql-select-no-limit and go.query-in-loop, to the repo's semgrep config, and run it from make audit (Makefile:53). (c) Pin all 19 uses: to commit SHAs and add zizmor .github/workflows to the CI lint job (ci.yml:43). (Security, Performance, Architecture)
2. Medium Reject or warn when an identical report is re-ingested under another repository. In existingEvaluation (internal/ingest/ingest.go:181), compare the found row's repo_id with the requested repository. Today the operator is told "already ingested", and the report stays attached to the wrong repository. (Correctness)
3. Medium Cover the production ingest wiring: TestServeIngestEndToEnd (POST /ingest through poolIngester, serve.go:101, now 0%) and TestRunIngest (main.go:261, now 33.3%). A mistake between serve and ingest.Run passes make ci today. (Correctness)
4. Medium Give the contact limiter a global ceiling, and key IPv6 clients on their /64 (internal/web/contact.go:167). (Security)
5. Medium Log the repo value only after the token check, or truncate it to 200 bytes (internal/web/ingest.go:46, publish.go:35). (Security)
6. Medium Make formatting and error checking failing gates: the gofmt formatter, errcheck and unused in .golangci.yml:13, and drop -U1000 at :43. Expected new findings: 0. (Consistency)
7. Medium Add gitleaks detect --redact to make audit (Makefile:53). Nothing stops a committed credential today. (Security)
8. Medium In storeReport (internal/ingest/report.go:83), fsync before the rename, and verify an existing copy against report_sha256 instead of trusting os.Stat. (Correctness)
9. Medium Add a page size to PGStore.Directory (internal/web/store.go:94) and a request logger in newRouter (cmd/kwalitai/serve.go:33). (Performance)
10. Medium Replace the template text in SECURITY.md:5-6 and CONTRIBUTING.md:3 with the project's actual policy. (Documentation)
11. Low Add FuzzUnpack seeded from TestUnpackRejects (internal/ingest/archive_test.go). (Performance, Security)

Findings

Every finding the report counts as a defect or a check gap; review notes that are not defects are left out. Status at the follow-up review: 15 of 16 findings fixed, 1 still open. 1 security finding still open at the follow-up review is withheld: a Security finding is shown only once fixed.