ccantynz/alecrae.com
CodeIssuesPull RequestsActionsSecurityInsights
✨ AI
Understand
Explain codebaseAsk AIChat with repoClaude sessionsNL searchSemantic searchArchaeologyDebt mapDocs tracking
Build
Spec to PRWorkspaceGenerate testsPropose migrationDev environmentCodebase migrator
Ship
Preview URLsAI release notesAI changelog
More
Repository
CommitsBranchesTagsReleasesPackagesSymbolsStale branches
Planning
MilestonesProjectsDiscussionsWikiContributors
Delivery
GatesMerge queueMerge checksDeploymentsPipelineAgents
Activity
Health reportPulsePush log
Settings
D
45/100
Health score

Insights

4 critical security issues found — immediate action recommended
163 test files but coverage is low (<20%) relative to codebase size
110 dependencies scored for hygiene only — no advisory feed was consulted here, so this score is not a vulnerability check. See Security advisories for the OSV cross-check
No README — new contributors won't know how to get started
No LICENSE file — open source projects need a license to be usable
Very active project — strong development momentum
How to improve this score45 → 86 possible
Gains are computed from the same formula that produced the score — completing everything below is worth 41 points.
+23.6
1. Fix no-hardcoded-secrets: Possible hardcoded API keysecurity
4 occurrences in 4 files (infrastructure/kubernetes/secrets.yml, load-tests/scenarios/auth.js, packages/db/src/seed.ts, …)
Fix it yourself

Change: Fix no-hardcoded-secrets: Possible hardcoded API key (no-hardcoded-secrets)

4 occurrences in 4 files (infrastructure/kubernetes/secrets.yml, load-tests/scenarios/auth.js, packages/db/src/seed.ts, …)

Where — Possible hardcoded API key:

  • infrastructure/kubernetes/secrets.yml:58
  • load-tests/scenarios/auth.js:97
  • packages/db/src/seed.ts:67
  • services/mta/src/relay/relay.ts:325

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+5
2. Add ~489 test files to reach a 20% test-to-source ratiotesting
163 test files today against ~3260 source files (Low (<20%))
Fix it yourself

Change: Add ~489 test files to reach a 20% test-to-source ratio

163 test files today against ~3260 source files (Low (<20%))

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+4
3. Add a READMEdocumentation
The front door of the repo — 40 of documentation's 100 points
Fix it yourself

Change: Add a README

The front door of the repo — 40 of documentation's 100 points

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+2
4. Add a LICENSE filedocumentation
Unlicensed code is legally unusable by anyone else
Fix it yourself

Change: Add a LICENSE file

Unlicensed code is legally unusable by anyone else

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+1.5
5. Split the largest files to bring average size under 5,000 bytescomplexity
Average is 9,939 bytes across 1022 files; start with api.ts, server.ts, messages.ts
Fix it yourself

Change: Split the largest files to bring average size under 5,000 bytes

Average is 9,939 bytes across 1022 files; start with api.ts, server.ts, messages.ts

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+1.5
6. Add CONTRIBUTING.mddocumentation
Tells collaborators how to work on the repo
Fix it yourself

Change: Add CONTRIBUTING.md

Tells collaborators how to work on the repo

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+1.5
7. Add a CHANGELOGdocumentation
Lets users see what changed between versions
Fix it yourself

Change: Add a CHANGELOG

Lets users see what changed between versions

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+0.7
8. Fix no-raw-sql-injection: Raw query with interpolationsecurity
1 occurrence in 1 file (apps/api/src/routes/sentiment-timeline.ts)
Fix it yourself

Change: Fix no-raw-sql-injection: Raw query with interpolation (no-raw-sql-injection)

1 occurrence in 1 file (apps/api/src/routes/sentiment-timeline.ts)

Where — Raw query with interpolation:

  • apps/api/src/routes/sentiment-timeline.ts:385

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+0.7
9. Fix no-weak-crypto: MD5 hash used — cryptographically weaksecurity
1 occurrence in 1 file (services/sentinel/src/fingerprint/generator.ts)
Fix it yourself

Change: Fix no-weak-crypto: MD5 hash used — cryptographically weak (no-weak-crypto)

1 occurrence in 1 file (services/sentinel/src/fingerprint/generator.ts)

Where — MD5 hash used — cryptographically weak:

  • services/sentinel/src/fingerprint/generator.ts:142

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

Security0
0 of 25 possible overall points (weight 25%)
17 findings across 4 rules
4 critical · 0 high · 2 medium
Testing25
5 of 20 possible overall points (weight 20%)
163 test files
Coverage estimate: Low (<20%)
Complexity78
12 of 15 possible overall points (weight 15%)
1022 source files
Avg file size: 9,939 bytes
Largest: api.ts (97,618 bytes)
Dependencies90
14 of 15 possible overall points (weight 15%)
110 dependencies (package.json, apps/api/package.json, apps/changelog/package.json, apps/desktop/package.json, apps/docs/package.json, apps/mobile/package.json, apps/status/package.json, apps/web/package.json, infrastructure/pulumi/package.json, packages/crypto/package.json, packages/db/package.json, packages/email-parser/package.json, packages/sdk/package.json, packages/shared/package.json, packages/ui/package.json, services/ai-engine/package.json, services/analytics/package.json, services/collab/package.json, services/dns/package.json, services/imap/package.json, services/inbound/package.json, services/jmap/package.json, services/mta/package.json, services/reputation/package.json, services/security/package.json, services/sentinel/package.json, services/support/package.json)
Lockfile present
Documentation10
1 of 10 possible overall points (weight 10%)
No README
No license
70 doc files
Activity90
14 of 15 possible overall points (weight 15%)
42 commits (30d)
8 contributors
Last push: 22d ago
Security findings17 findings · 4 distinct rules
critical
Possible hardcoded API key — 4 occurrences in 4 files
no-hardcoded-secrets · secrets.yml (1), auth.js (1), seed.ts (1), +1 more
details
infrastructure/kubernetes/secrets.yml — line 58
load-tests/scenarios/auth.js — line 97
packages/db/src/seed.ts — line 67
services/mta/src/relay/relay.ts — line 325
medium
Raw query with interpolation — 1 occurrence in 1 file
no-raw-sql-injection · sentiment-timeline.ts (1)
details
apps/api/src/routes/sentiment-timeline.ts — line 385
medium
MD5 hash used — cryptographically weak — 1 occurrence in 1 file
no-weak-crypto · generator.ts (1)
details
services/sentinel/src/fingerprint/generator.ts — line 142
low
Security linter rule disabled — 11 occurrences in 4 files
no-security-disable · telemetry.ts (8), QuickReplySheet.tsx (1), page.tsx (1), +1 more
details
services/mta/src/telemetry.ts — lines 15, 242, 244, 246, 248, 250, 252, 254
apps/mobile/components/QuickReplySheet.tsx — line 460
apps/web/app/(legal)/privacy/page.tsx — line 78
apps/web/app/(legal)/terms/page.tsx — line 86
Zero-config CIAuto-detected · Bun project detected · TypeScript detected · Next.js framework
Type check
bun tsc --noEmit
Lint
bun run lint
Test
bun test
Build
bun run build
Type check
bun run typecheck