Executive summary
alexjustesen/speedtest-tracker scores 62 out of 100 and is rated Adequate, while five of its six lenses score higher still: Architecture at 83, Code Health at 73, Accessibility at 68 and Security and Compliance and Production Readiness at 64, all rated Adequate.
The score is lower than those five because the weakest lens counts most, and here that is Maturity, which scores 56 and is rated Adequate. Its Architecture documentation dimension scores 0 out of 10, and until that reaches 4, Maturity can't be rated higher than Adequate. The first actions are to resolve the 1 No ADRs found finding(s) in ADR Quality and to resolve the 1 Documentation finding(s) in Documentation Quality, and if Maturity rose to 70, the score would rise from 62 to about 66.
24 findings are critical: 14 in Static Analysis (SAST), six in IaC & Container Security, three in Dependency Vulnerabilities and one in Secret Scanning.
Watchdog couldn't measure 17 dimensions in this code, among them Code Coverage, Test Reliability and Navigability, so they are left out of the score. The product code is 15,370 lines, which would take an estimated 0.1 person-years, around €18,000, to rebuild.
Code Health
73
Adequate, capped by Nullable reference types
Architecture
83
Adequate, capped by Project Cohesion
Maturity
56
Adequate, capped by Architecture documentation
Production Readiness
64
Adequate, capped by Security & performance tooling
Security and Compliance
64
Adequate, capped by Supply-chain Provenance & Signing
Accessibility
68
Adequate
How the score is built: what each lens counts for
The lenses don't count equally. The weakest lens counts most, the next weakest a little less, and so on, so a weak area pulls the score down instead of being averaged away. In the bar below, each part's width shows how much that lens counts and its colour shows its rating. Improving the widest part moves the score most, and as that lens improves, it counts for less, because another lens becomes the weakest.
Maturity 56 · counts for 46%Security and Compliance 64 · counts for 25%Production Readiness 64 · counts for 14%Accessibility 68 · counts for 8%Code Health 73 · counts for 4%Architecture 83 · counts for 2%
If Maturity rose from 56 to 70, the lowest score rated Strong, the score would rise from 62 to about 66.
Code composition: what the lines of code are
Product code 92%Tests 8%
New since the last survey: 8 findings
- Secret Scanning · REDACTED
- Dependency Vulnerabilities · REDACTED
- Dependency Vulnerabilities · REDACTED
- Dependency Vulnerabilities · REDACTED
- Dependency Vulnerabilities · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
Fixed since the last survey: 2 findings
- Supply-chain Provenance & Signing REDACTED
- Supply-chain Provenance & Signing REDACTED
Rebuild cost: about €18,000 · Estimate
| Cost to rebuild | €6,100 to €31,000, for 102 to 324 hours of work, about 0.1 person-years for one engineer |
|---|---|
| Difficulty of the problem | Standard, judged from the kind of software and how it is built. Code that solves a harder problem, such as payments or medical bookings, costs more per line to write. |
| Quality factor | ×0.8 at a score of 62. Better code takes more work to write, so the factor is ×1.0 at a score of 70, lower below it and higher above it. |
| Size | Small: 15,370 lines of product code |
Top priorities
1
Resolve the 1 No ADRs found finding(s) in ADR Quality.
2
Resolve the 1 Documentation finding(s) in Documentation Quality — start with README.md.
3
Record your significant design decisions.
Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
Diagnosis: what the measurements show together
Where the investment is most exposed
This code would cost about €18,000 to build again, about 0.1 person-years of work. Its weakest lens is Maturity, at 56 (Adequate). Maturity is about how well the project explains and looks after itself, which decides whether a new developer, or a new supplier, can take over. Because the weakest lens counts most in the score, work on Maturity also moves the score most.
If you do one thing first
Resolve the 1 No ADRs found finding(s) in ADR Quality. Of all the actions in this report, it raises the score most for the work it takes: about 5 points for low effort, because it clears the 1 ADR Quality findings. The next survey will show the change in the score.
Architecture: which parts of the code depend on which
| uses → | 1 (global) | 2 App.Actions | 3 App.Actions.Ookla | 4 App.Console.Commands | 5 App.Enums | 6 App.Filament.Exports | 7 App.Filament.Pages | 8 App.Filament.Pages.Settings | 9 App.Filament.Pages.Tools | 10 App.Filament.Resources.ApiTokens | 11 App.Filament.Resources.ApiTokens.Pages | 12 App.Filament.Resources.ApiTokens.Schemas | 13 App.Filament.Resources.ApiTokens.Tables | 14 App.Filament.Resources.Results | 15 App.Filament.Resources.Results.Pages | 16 App.Filament.Resources.Results.Schemas | 17 App.Filament.Resources.Results.Tables | 18 App.Models | 19 App.Settings | 20 App.Actions.Influxdb.v2 | 21 App.Actions.Notifications | 22 App.Events | 23 App.Http.Middleware | 24 App.Jobs | 25 App.Jobs.Influxdb.v2 | 26 App.Jobs.Ookla | 27 App.Livewire | 28 App.Mail | 29 App.Policies | 30 App.Services | 31 App.Http.Controllers | 32 App.Listeners | 33 App.Listeners.Discord | 34 App.Listeners.Gotify | 35 App.Listeners.HealthCheck | 36 App.Listeners.Ntfy | 37 App.Listeners.Pushover | 38 App.Listeners.Slack | 39 App.Listeners.Telegram | 40 App.Http.Controllers.Api.V0 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 (global) | ||||||||||||||||||||||||||||||||||||||||
| 2 App.Actions | ||||||||||||||||||||||||||||||||||||||||
| 3 App.Actions.Ookla | ||||||||||||||||||||||||||||||||||||||||
| 4 App.Console.Commands | ||||||||||||||||||||||||||||||||||||||||
| 5 App.Enums | ||||||||||||||||||||||||||||||||||||||||
| 6 App.Filament.Exports | ||||||||||||||||||||||||||||||||||||||||
| 7 App.Filament.Pages | ||||||||||||||||||||||||||||||||||||||||
| 8 App.Filament.Pages.Settings | ||||||||||||||||||||||||||||||||||||||||
| 9 App.Filament.Pages.Tools | ||||||||||||||||||||||||||||||||||||||||
| 10 App.Filament.Resources.ApiTokens | ||||||||||||||||||||||||||||||||||||||||
| 11 App.Filament.Resources.ApiTokens.Pages | ||||||||||||||||||||||||||||||||||||||||
| 12 App.Filament.Resources.ApiTokens.Schemas | ||||||||||||||||||||||||||||||||||||||||
| 13 App.Filament.Resources.ApiTokens.Tables | ||||||||||||||||||||||||||||||||||||||||
| 14 App.Filament.Resources.Results | ||||||||||||||||||||||||||||||||||||||||
| 15 App.Filament.Resources.Results.Pages | ||||||||||||||||||||||||||||||||||||||||
| 16 App.Filament.Resources.Results.Schemas | ||||||||||||||||||||||||||||||||||||||||
| 17 App.Filament.Resources.Results.Tables | ||||||||||||||||||||||||||||||||||||||||
| 18 App.Models | ||||||||||||||||||||||||||||||||||||||||
| 19 App.Settings | ||||||||||||||||||||||||||||||||||||||||
| 20 App.Actions.Influxdb.v2 | 1 | |||||||||||||||||||||||||||||||||||||||
| 21 App.Actions.Notifications | 1 | |||||||||||||||||||||||||||||||||||||||
| 22 App.Events | 10 | |||||||||||||||||||||||||||||||||||||||
| 23 App.Http.Middleware | 1 | |||||||||||||||||||||||||||||||||||||||
| 24 App.Jobs | 1 | |||||||||||||||||||||||||||||||||||||||
| 25 App.Jobs.Influxdb.v2 | 3 | |||||||||||||||||||||||||||||||||||||||
| 26 App.Jobs.Ookla | 6 | 1 | ||||||||||||||||||||||||||||||||||||||
| 27 App.Livewire | 1 | |||||||||||||||||||||||||||||||||||||||
| 28 App.Mail | 2 | |||||||||||||||||||||||||||||||||||||||
| 29 App.Policies | 3 | |||||||||||||||||||||||||||||||||||||||
| 30 App.Services | 2 | 1 | ||||||||||||||||||||||||||||||||||||||
| 31 App.Http.Controllers | 1 | 1 | ||||||||||||||||||||||||||||||||||||||
| 32 App.Listeners | 3 | 3 | 6 | |||||||||||||||||||||||||||||||||||||
| 33 App.Listeners.Discord | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 34 App.Listeners.Gotify | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 35 App.Listeners.HealthCheck | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 36 App.Listeners.Ntfy | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 37 App.Listeners.Pushover | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 38 App.Listeners.Slack | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 39 App.Listeners.Telegram | 1 | 2 | ||||||||||||||||||||||||||||||||||||||
| 40 App.Http.Controllers.Api.V0 | 1 |
Uses a module listed above itPart of a loopThe module itself
20→18 App.Actions.Influxdb.v2 uses App.Models✕
- Connections
- 1 pair of types, where a type in App.Actions.Influxdb.v2 uses a type in App.Models.
- The types involved
App.Actions.Influxdb.v2.BuildPointData→App.Models.Result
- Direction
- App.Actions.Influxdb.v2 uses App.Models, so a change to App.Models can break App.Actions.Influxdb.v2, while a change to App.Actions.Influxdb.v2 can't break App.Models.
- Position
- Below the diagonal: App.Actions.Influxdb.v2 uses a module listed above it, which is the healthy direction.
21→18 App.Actions.Notifications uses App.Models✕
- Connections
- 1 pair of types, where a type in App.Actions.Notifications uses a type in App.Models.
- The types involved
App.Actions.Notifications.SendDatabaseTestNotification→App.Models.User
- Direction
- App.Actions.Notifications uses App.Models, so a change to App.Models can break App.Actions.Notifications, while a change to App.Actions.Notifications can't break App.Models.
- Position
- Below the diagonal: App.Actions.Notifications uses a module listed above it, which is the healthy direction.
22→18 App.Events uses App.Models✕
- Connections
- 10 pairs of types, where a type in App.Events uses a type in App.Models.
- The types involved
App.Events.SpeedtestBenchmarkHealthy→App.Models.ResultApp.Events.SpeedtestBenchmarkUnhealthy→App.Models.ResultApp.Events.SpeedtestBenchmarking→App.Models.ResultApp.Events.SpeedtestChecking→App.Models.ResultApp.Events.SpeedtestCompleted→App.Models.ResultApp.Events.SpeedtestFailed→App.Models.ResultApp.Events.SpeedtestRunning→App.Models.ResultApp.Events.SpeedtestSkipped→App.Models.ResultApp.Events.SpeedtestStarted→App.Models.ResultApp.Events.SpeedtestWaiting→App.Models.Result
- Direction
- App.Events uses App.Models, so a change to App.Models can break App.Events, while a change to App.Events can't break App.Models.
- Position
- Below the diagonal: App.Events uses a module listed above it, which is the healthy direction.
23→19 App.Http.Middleware uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Http.Middleware uses a type in App.Settings.
- The types involved
App.Http.Middleware.PrometheusAllowedIpMiddleware→App.Settings.DataIntegrationSettings
- Direction
- App.Http.Middleware uses App.Settings, so a change to App.Settings can break App.Http.Middleware, while a change to App.Http.Middleware can't break App.Settings.
- Position
- Below the diagonal: App.Http.Middleware uses a module listed above it, which is the healthy direction.
24→18 App.Jobs uses App.Models✕
- Connections
- 1 pair of types, where a type in App.Jobs uses a type in App.Models.
- The types involved
App.Jobs.CheckForInternetConnectionJob→App.Models.Result
- Direction
- App.Jobs uses App.Models, so a change to App.Models can break App.Jobs, while a change to App.Jobs can't break App.Models.
- Position
- Below the diagonal: App.Jobs uses a module listed above it, which is the healthy direction.
25→18 App.Jobs.Influxdb.v2 uses App.Models✕
- Connections
- 3 pairs of types, where a type in App.Jobs.Influxdb.v2 uses a type in App.Models.
- The types involved
App.Jobs.Influxdb.v2.BulkWriteResults→App.Models.UserApp.Jobs.Influxdb.v2.TestConnectionJob→App.Models.UserApp.Jobs.Influxdb.v2.WriteResult→App.Models.Result
- Direction
- App.Jobs.Influxdb.v2 uses App.Models, so a change to App.Models can break App.Jobs.Influxdb.v2, while a change to App.Jobs.Influxdb.v2 can't break App.Models.
- Position
- Below the diagonal: App.Jobs.Influxdb.v2 uses a module listed above it, which is the healthy direction.
26→18 App.Jobs.Ookla uses App.Models✕
- Connections
- 6 pairs of types, where a type in App.Jobs.Ookla uses a type in App.Models.
- The types involved
App.Jobs.Ookla.BenchmarkSpeedtestJob→App.Models.ResultApp.Jobs.Ookla.CompleteSpeedtestJob→App.Models.ResultApp.Jobs.Ookla.RunSpeedtestJob→App.Models.ResultApp.Jobs.Ookla.SelectSpeedtestServerJob→App.Models.ResultApp.Jobs.Ookla.SkipSpeedtestJob→App.Models.ResultApp.Jobs.Ookla.StartSpeedtestJob→App.Models.Result
- Direction
- App.Jobs.Ookla uses App.Models, so a change to App.Models can break App.Jobs.Ookla, while a change to App.Jobs.Ookla can't break App.Models.
- Position
- Below the diagonal: App.Jobs.Ookla uses a module listed above it, which is the healthy direction.
26→19 App.Jobs.Ookla uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Jobs.Ookla uses a type in App.Settings.
- The types involved
App.Jobs.Ookla.BenchmarkSpeedtestJob→App.Settings.ThresholdSettings
- Direction
- App.Jobs.Ookla uses App.Settings, so a change to App.Settings can break App.Jobs.Ookla, while a change to App.Jobs.Ookla can't break App.Settings.
- Position
- Below the diagonal: App.Jobs.Ookla uses a module listed above it, which is the healthy direction.
27→18 App.Livewire uses App.Models✕
- Connections
- 1 pair of types, where a type in App.Livewire uses a type in App.Models.
- The types involved
App.Livewire.LatestResultStats→App.Models.Result
- Direction
- App.Livewire uses App.Models, so a change to App.Models can break App.Livewire, while a change to App.Livewire can't break App.Models.
- Position
- Below the diagonal: App.Livewire uses a module listed above it, which is the healthy direction.
28→18 App.Mail uses App.Models✕
- Connections
- 2 pairs of types, where a type in App.Mail uses a type in App.Models.
- The types involved
App.Mail.CompletedSpeedtestMail→App.Models.ResultApp.Mail.UnhealthySpeedtestMail→App.Models.Result
- Direction
- App.Mail uses App.Models, so a change to App.Models can break App.Mail, while a change to App.Mail can't break App.Models.
- Position
- Below the diagonal: App.Mail uses a module listed above it, which is the healthy direction.
29→18 App.Policies uses App.Models✕
- Connections
- 3 pairs of types, where a type in App.Policies uses a type in App.Models.
- The types involved
App.Policies.ResultPolicy→App.Models.ResultApp.Policies.ResultPolicy→App.Models.UserApp.Policies.UserPolicy→App.Models.User
- Direction
- App.Policies uses App.Models, so a change to App.Models can break App.Policies, while a change to App.Policies can't break App.Models.
- Position
- Below the diagonal: App.Policies uses a module listed above it, which is the healthy direction.
30→18 App.Services uses App.Models✕
- Connections
- 2 pairs of types, where a type in App.Services uses a type in App.Models.
- The types involved
App.Services.PrometheusMetricsService→App.Models.ResultApp.Services.SpeedtestFakeResultGenerator→App.Models.Result
- Direction
- App.Services uses App.Models, so a change to App.Models can break App.Services, while a change to App.Services can't break App.Models.
- Position
- Below the diagonal: App.Services uses a module listed above it, which is the healthy direction.
30→19 App.Services uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Services uses a type in App.Settings.
- The types involved
App.Services.PrometheusMetricsService→App.Settings.DataIntegrationSettings
- Direction
- App.Services uses App.Settings, so a change to App.Settings can break App.Services, while a change to App.Services can't break App.Settings.
- Position
- Below the diagonal: App.Services uses a module listed above it, which is the healthy direction.
31→19 App.Http.Controllers uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Http.Controllers uses a type in App.Settings.
- The types involved
App.Http.Controllers.MetricsController→App.Settings.DataIntegrationSettings
- Direction
- App.Http.Controllers uses App.Settings, so a change to App.Settings can break App.Http.Controllers, while a change to App.Http.Controllers can't break App.Settings.
- Position
- Below the diagonal: App.Http.Controllers uses a module listed above it, which is the healthy direction.
31→30 App.Http.Controllers uses App.Services✕
- Connections
- 1 pair of types, where a type in App.Http.Controllers uses a type in App.Services.
- The types involved
App.Http.Controllers.MetricsController→App.Services.PrometheusMetricsService
- Direction
- App.Http.Controllers uses App.Services, so a change to App.Services can break App.Http.Controllers, while a change to App.Http.Controllers can't break App.Services.
- Position
- Below the diagonal: App.Http.Controllers uses a module listed above it, which is the healthy direction.
32→18 App.Listeners uses App.Models✕
- Connections
- 3 pairs of types, where a type in App.Listeners uses a type in App.Models.
- The types involved
App.Listeners.ProcessCompletedSpeedtest→App.Models.ResultApp.Listeners.ProcessFailedSpeedtest→App.Models.ResultApp.Listeners.ProcessUnhealthySpeedtest→App.Models.Result
- Direction
- App.Listeners uses App.Models, so a change to App.Models can break App.Listeners, while a change to App.Listeners can't break App.Models.
- Position
- Below the diagonal: App.Listeners uses a module listed above it, which is the healthy direction.
32→19 App.Listeners uses App.Settings✕
- Connections
- 3 pairs of types, where a type in App.Listeners uses a type in App.Settings.
- The types involved
App.Listeners.ProcessCompletedSpeedtest→App.Settings.NotificationSettingsApp.Listeners.ProcessSpeedtestDataIntegrations→App.Settings.DataIntegrationSettingsApp.Listeners.ProcessUnhealthySpeedtest→App.Settings.NotificationSettings
- Direction
- App.Listeners uses App.Settings, so a change to App.Settings can break App.Listeners, while a change to App.Listeners can't break App.Settings.
- Position
- Below the diagonal: App.Listeners uses a module listed above it, which is the healthy direction.
32→22 App.Listeners uses App.Events✕
- Connections
- 6 pairs of types, where a type in App.Listeners uses a type in App.Events.
- The types involved
App.Listeners.ProcessCompletedSpeedtest→App.Events.SpeedtestCompletedApp.Listeners.ProcessFailedSpeedtest→App.Events.SpeedtestFailedApp.Listeners.ProcessUnhealthySpeedtest→App.Events.SpeedtestBenchmarkUnhealthyApp.Listeners.UserNotificationSubscriber→App.Events.SpeedtestBenchmarkUnhealthyApp.Listeners.UserNotificationSubscriber→App.Events.SpeedtestCompletedApp.Listeners.UserNotificationSubscriber→App.Events.SpeedtestFailed
- Direction
- App.Listeners uses App.Events, so a change to App.Events can break App.Listeners, while a change to App.Listeners can't break App.Events.
- Position
- Below the diagonal: App.Listeners uses a module listed above it, which is the healthy direction.
33→19 App.Listeners.Discord uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Discord uses a type in App.Settings.
- The types involved
App.Listeners.Discord.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Discord uses App.Settings, so a change to App.Settings can break App.Listeners.Discord, while a change to App.Listeners.Discord can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Discord uses a module listed above it, which is the healthy direction.
33→22 App.Listeners.Discord uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Discord uses a type in App.Events.
- The types involved
App.Listeners.Discord.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Discord.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Discord uses App.Events, so a change to App.Events can break App.Listeners.Discord, while a change to App.Listeners.Discord can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Discord uses a module listed above it, which is the healthy direction.
34→19 App.Listeners.Gotify uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Gotify uses a type in App.Settings.
- The types involved
App.Listeners.Gotify.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Gotify uses App.Settings, so a change to App.Settings can break App.Listeners.Gotify, while a change to App.Listeners.Gotify can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Gotify uses a module listed above it, which is the healthy direction.
34→22 App.Listeners.Gotify uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Gotify uses a type in App.Events.
- The types involved
App.Listeners.Gotify.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Gotify.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Gotify uses App.Events, so a change to App.Events can break App.Listeners.Gotify, while a change to App.Listeners.Gotify can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Gotify uses a module listed above it, which is the healthy direction.
35→19 App.Listeners.HealthCheck uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.HealthCheck uses a type in App.Settings.
- The types involved
App.Listeners.HealthCheck.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.HealthCheck uses App.Settings, so a change to App.Settings can break App.Listeners.HealthCheck, while a change to App.Listeners.HealthCheck can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.HealthCheck uses a module listed above it, which is the healthy direction.
35→22 App.Listeners.HealthCheck uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.HealthCheck uses a type in App.Events.
- The types involved
App.Listeners.HealthCheck.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.HealthCheck.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.HealthCheck uses App.Events, so a change to App.Events can break App.Listeners.HealthCheck, while a change to App.Listeners.HealthCheck can't break App.Events.
- Position
- Below the diagonal: App.Listeners.HealthCheck uses a module listed above it, which is the healthy direction.
36→19 App.Listeners.Ntfy uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Ntfy uses a type in App.Settings.
- The types involved
App.Listeners.Ntfy.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Ntfy uses App.Settings, so a change to App.Settings can break App.Listeners.Ntfy, while a change to App.Listeners.Ntfy can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Ntfy uses a module listed above it, which is the healthy direction.
36→22 App.Listeners.Ntfy uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Ntfy uses a type in App.Events.
- The types involved
App.Listeners.Ntfy.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Ntfy.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Ntfy uses App.Events, so a change to App.Events can break App.Listeners.Ntfy, while a change to App.Listeners.Ntfy can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Ntfy uses a module listed above it, which is the healthy direction.
37→19 App.Listeners.Pushover uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Pushover uses a type in App.Settings.
- The types involved
App.Listeners.Pushover.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Pushover uses App.Settings, so a change to App.Settings can break App.Listeners.Pushover, while a change to App.Listeners.Pushover can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Pushover uses a module listed above it, which is the healthy direction.
37→22 App.Listeners.Pushover uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Pushover uses a type in App.Events.
- The types involved
App.Listeners.Pushover.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Pushover.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Pushover uses App.Events, so a change to App.Events can break App.Listeners.Pushover, while a change to App.Listeners.Pushover can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Pushover uses a module listed above it, which is the healthy direction.
38→19 App.Listeners.Slack uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Slack uses a type in App.Settings.
- The types involved
App.Listeners.Slack.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Slack uses App.Settings, so a change to App.Settings can break App.Listeners.Slack, while a change to App.Listeners.Slack can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Slack uses a module listed above it, which is the healthy direction.
38→22 App.Listeners.Slack uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Slack uses a type in App.Events.
- The types involved
App.Listeners.Slack.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Slack.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Slack uses App.Events, so a change to App.Events can break App.Listeners.Slack, while a change to App.Listeners.Slack can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Slack uses a module listed above it, which is the healthy direction.
39→19 App.Listeners.Telegram uses App.Settings✕
- Connections
- 1 pair of types, where a type in App.Listeners.Telegram uses a type in App.Settings.
- The types involved
App.Listeners.Telegram.SendSpeedtestThresholdNotification→App.Settings.ThresholdSettings
- Direction
- App.Listeners.Telegram uses App.Settings, so a change to App.Settings can break App.Listeners.Telegram, while a change to App.Listeners.Telegram can't break App.Settings.
- Position
- Below the diagonal: App.Listeners.Telegram uses a module listed above it, which is the healthy direction.
39→22 App.Listeners.Telegram uses App.Events✕
- Connections
- 2 pairs of types, where a type in App.Listeners.Telegram uses a type in App.Events.
- The types involved
App.Listeners.Telegram.SendSpeedtestCompletedNotification→App.Events.SpeedtestCompletedApp.Listeners.Telegram.SendSpeedtestThresholdNotification→App.Events.SpeedtestCompleted
- Direction
- App.Listeners.Telegram uses App.Events, so a change to App.Events can break App.Listeners.Telegram, while a change to App.Listeners.Telegram can't break App.Events.
- Position
- Below the diagonal: App.Listeners.Telegram uses a module listed above it, which is the healthy direction.
40→31 App.Http.Controllers.Api.V0 uses App.Http.Controllers✕
- Connections
- 1 pair of types, where a type in App.Http.Controllers.Api.V0 uses a type in App.Http.Controllers.
- The types involved
App.Http.Controllers.Api.V0.GetLatestController→App.Http.Controllers.Controller
- Direction
- App.Http.Controllers.Api.V0 uses App.Http.Controllers, so a change to App.Http.Controllers can break App.Http.Controllers.Api.V0, while a change to App.Http.Controllers.Api.V0 can't break App.Http.Controllers.
- Position
- Below the diagonal: App.Http.Controllers.Api.V0 uses a module listed above it, which is the healthy direction.
At a glance — Code Health
The Good
D1 · PHP
Cyclomatic Complexity
10.0
D2 · PHP
Cognitive Complexity
10.0
D3 · PHP
God Classes
9.4
D4 · PHP
Code Duplication
9.7
D17 · PHP
Explicit Debt
10.0
X16 · Repo
Unfloored truncation loop
10.0
X18 · Repo
Disposal-pattern correctness
10.0
X19 · Repo
Unrestored process-global state
10.0
X21 · Repo
Side-effecting pattern guard
10.0
X22 · Repo
Contradicted release guard
10.0
X23 · Repo
Unguarded diagnostic materialisation
10.0
X25 · Repo
Inert configuration knob
10.0
X28 · Repo
Index access outside its own emptiness guard
10.0
X3 · Repo
Exception handling
10.0
X30 · Repo
Support guard that admits what it rejects
10.0
X4 · Repo
Structured logging
10.0
At a glance — Architecture
The Good
The Ugly
At a glance — Maturity
The Good
At a glance — Readiness
The Good
At a glance — Security
The Good
D28 · PHP
Secrets (history)
10.0
D29 · PHP
Static Analysis (SAST)
8.4
D30 · PHP
Dependency Vulnerabilities
7.7
D31 · PHP
IaC & Container Security
7.7
D37 · PHP
Vulnerability-disclosure Policy
10.0
D43 · PHP
Malicious Dependencies
10.0
D44 · PHP
Platform End-of-Life
10.0
C2 · Repo
Access Controls
10.0
X14 · Repo
Bypassable address classification
10.0
X15 · Repo
Unvalidated length from an untrusted reader
10.0
The Bad
At a glance — Accessibility
The Bad
The Ugly
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A05:2025 — Injection | 14 | High / Critical |
| A03:2025 — Software Supply Chain Failures | 14 | High / Critical |
| A02:2025 — Security Misconfiguration | 10 | High / Critical |
| A07:2025 — Authentication Failures | 1 | High / Critical |
Roadmap
Begin by documenting significant design decisions in the docs/adr folder to establish a clear architectural record and resolve the missing ADR findings. Next, update the root README with a high-level 'Architecture' or 'How it works' section to improve overall documentation quality. Finally, immediately address the leaked secret in REDACTED to secure the codebase.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Resolve the 1 No ADRs found finding(s) in ADR Quality. | +5.3 pts | Low | ADR Quality |
| Resolve the 1 Documentation finding(s) in Documentation Quality — start with README.md. | +3.1 pts | Low | Documentation Quality |
| Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them. | +5.3 pts | Medium | Architecture documentation |
| Add an 'Architecture' / 'How it works' section to the root README — the high-level shape. | +3.4 pts | Medium | Documentation (README) |
| Resolve the 1 Leaked secret finding(s) in Secret Scanning — start with REDACTED. | +1.5 pts | Low | Secret Scanning |
| Strengthen data-at-rest protection: vault your keys (AWS KMS / Secrets Manager, GCP KMS / Secret Manager, HashiCorp Vault — not only APP_KEY in .env) and encrypt the most sensitive columns (Eloquent 'encrypted' casts, CipherSweet) — partial coverage still leaves gaps. | +1.3 pts | Medium | Data Protection |
| Add a SAST step to CI running what this repository's stack ships: phpstan or psalm — or `semgrep --config=auto`, which runs on any language — so a security regression fails the build instead of landing. | +1.1 pts | Medium | Security & performance tooling |
| Resolve the 2 REDACTED finding(s) in Supply-chain Provenance & Signing — start with REDACTED, REDACTED. | +0.5 pts | Low | Supply-chain Provenance & Signing |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 0.9 | Slop | IaC & Container Security: High IaC: REDACTED |
| REDACTED | 2.3 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.7 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.7 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.7 | Slop | Dependency Vulnerabilities: High CVE: REDACTED |
| REDACTED | 3.7 | Slop | IaC & Container Security: High IaC: REDACTED |
| REDACTED | 4.1 | Mixed | Dependency Vulnerabilities: High CVE: REDACTED |
| REDACTED | 5.8 | Mixed | Static Analysis (SAST): High: REDACTED |
| app/Filament/Widgets/RecentDownloadChartWidget.php | 6.3 | Mixed | Code Duplication: Near-duplicate member family (6 members, 16 shared lines) |
| REDACTED | 7.2 | Mixed | Secret Scanning: Leaked secret: REDACTED |
| REDACTED | 7.2 | Mixed | Static Analysis (SAST): High: REDACTED |
| app/Filament/Pages/Settings/Notification.php | 7.4 | Mixed | God Classes: MethodTooLong: Notification.form |
| app/Actions/Notifications/SendDiscordTestNotification.php | 7.8 | Mixed | Code Duplication: Members sharing a duplicated core (4 members, 50+ identical tokens) |
| config/app.php | 8.2 | Near-clean | Explicit Debt: TodoComment |
| app/Filament/Resources/Results/Tables/ResultTable.php | 8.5 | Near-clean | God Classes: MethodTooLong: ResultTable.table |
| app/Listeners/Discord/SendSpeedtestThresholdNotification.php | 8.5 | Near-clean | Code Duplication: Duplicated block (32 lines × 7) |
| app/Listeners/Ntfy/SendSpeedtestCompletedNotification.php | 8.5 | Near-clean | Code Duplication: Duplicated block (28–31 lines × 2) |
| app/Http/Controllers/Api/V1/ResultsController.php | 8.5 | Near-clean | Code Duplication: Duplicated block (21–23 lines × 2) |
| app/Listeners/Telegram/SendSpeedtestCompletedNotification.php | 8.5 | Near-clean | Code Duplication: Duplicated block (20 lines × 2) |
| app/Actions/Notifications/SendNtfyTestNotification.php | 8.5 | Near-clean | Code Duplication: Duplicated block (17–18 lines × 3) |
How the grades work
Critical — 24
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 28
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 29
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 20
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 55 of 59 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 4 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.9 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 59 dimensions across the health lenses
D1D2D3D4D6D12D13D14D15D17D19D20D21D26D28D29D30D31D34D35D36D37D43D44AC2AC3AC5AC7AX10AX3AX4C1C2C4M1M2M3M4P1P2P3P4P6P7P8X14X15X16X18X19X21X22X23X25X28X3X30X4X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 57 of 81 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 · 3.2.533 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D8 Code Coverage — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Coverage NOT MEASURED: test source is present (.php) but the built-in coverage collector has no runner for this repository's ecosystem — so this suite was never executed by it. Not scored — this is a gap in the analyzer's language coverage, not a defect in the repo. To have real coverage read, produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures. You can widen what we reach: optional: produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures — then the real number is read on the next scan.
- D11 Test Reliability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Test source is present (.php) but the built-in reliability runner does not support this repository's ecosystem, so flakiness couldn't be assessed. Not scored — this is a gap in the analyzer's language coverage, not a finding about this repository.
- D14 License Compliance — measured, with a gap in what it reached — Watchdog measured this, but not all of it. What it did not reach is a gap on our side — a collector, parser or image we have not built yet — so the numbers on that dimension cover less than the repository, and the part left out is not evidence that it would have passed. This repository declares package.json, but the licence verdict published here was taken over its Composer package dependencies. Nothing was read about its npm dependencies' licensing in either direction, and a clean score on this card must not be read as covering them.
- D16 Bus Factor — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Single-maintainer repository — bus factor is not applicable (44 contributor(s) across 891 commit(s) sampled, automation and bot accounts excluded). One of them holds 81% of the history; the other 43 hold 0.4% each on average, below the 5% at which there is somebody to hand the work to. That is a single maintainer with drive-by contributors, not a team whose knowledge has concentrated — so the bus factor is not applicable and there is nothing here for the owner to act on.
- D22 Internal API Consistency — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. This repository's source is written only in languages whose packages are published through a manifest, and no manifest in the tree makes a publication act: either there is no package manifest of any ecosystem (no package.json, pyproject.toml, setup.py, gemspec, Cargo.toml, pom.xml, build.gradle, composer.json, pubspec.yaml or mix.exs), or every one present declares in its package manager's own terms that it is not published (an npm package marked "private": true, a Cargo package with publish = false, a pubspec with publish_to: none, a Composer "project", a Poetry project with package-mode = false, or the "Private :: Do Not Upload" classifier). With no publication act there is no intentionally-exposed surface for API consistency to be judged over.
- D27 Navigability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Navigability is taken over call sites whose callee resolved. For C# that population includes calls into referenced assemblies; for this language only calls declared inside the repository count, so the abstention threshold reads the repository's use of its standard library as a resolution failure. That is a limit of this analyzer, not a build problem in this repository.
- D32 Data Compliance (PII/GDPR) — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. `app/Filament/Resources/ApiTokens/Tables/ApiTokenTable.php`, `app/Filament/Resources/Results/Tables/ResultTable.php`, `public/js/filament/forms/components/code-editor.js`, `public/js/filament/forms/components/color-picker.js`, `public/js/filament/forms/components/markdown-editor.js`, … (+2 more) produced a parse error, so every rule in this engine's `gdpr.yml` was absent there. That absence is NOT a clean result: these rules detect personal data crossing a boundary into a log sink, a URL or browser storage, and a file that was never parsed cannot report any of the three. The rest of the tree analysed normally and its rows above stand; only these files are unaccounted for. You can widen what we reach: fix the syntax error (or exclude the file deliberately) and re-scan to cover it.
- AC6 Visual & motion safety — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Visual & motion safety could not be assessed in this run — the check did not complete, so it is not scored. This is a gap in the analyzer, not a finding about this repository. Engine failure: ArgumentOutOfRangeException: startIndex cannot be larger than length of string. (Parameter 'startIndex').
- AX1 Captive dependencies — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads Microsoft.Extensions.DependencyInjection registrations in C# and Spring beans in Java/Kotlin only, and this repository's container is Laravel's service container, whose lifetimes are not modelled yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- AXR1 Runtime accessibility — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Render strategy: boot via DockerCompose (REDACTED). compose up failed (exit 18 — an image could not be pulled) — apprise Pulling mailpit Pulling laravel.test Pulling pgsql Pulling apprise Error Get "https://registry-1.docker.io/v2/": Forbidden mailpit Error Get "https://registry-1.docker.io/v2/": Forbidden pgsql Error context canceled laravel.test Warning context canceled Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the earlier `compose pull` step reported: mailpit Error Get "https://registry-1.docker.io/v2/": Forbidden apprise Error Get "https://registry-1.docker.io/v2/": Forbidden laravel.test Warning context canceled WARNING: Some service image(s) must be built from source by running: docker compose build laravel.test Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the runtime sandbox reaches registries only through the in-fence pull-through mirror, so an image the mirror does not carry cannot be fetched — this is a limit of our sandbox, not of your stack; runtime evidence skipped.
- GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, F#, JavaScript/TypeScript, Dart, Ruby and Scala source only, and no C#, F#, JavaScript/TypeScript, Dart, Ruby or Scala was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, JavaScript/TypeScript, Java, Dart, Ruby and Scala source only, and no C#, JavaScript/TypeScript, Java, Dart, Ruby or Scala was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
- X1 Async correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X12 Unreachable branch — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X13 Undrained process stream — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X17 Uncapped recursion over a caller-supplied document — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X24 Document value interpolated into markup unescaped — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Scala, Ruby and Python source only, and no C# was loaded and no JavaScript/TypeScript, Java, Scala, Ruby or Python was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X27 Collection changed while being enumerated — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded, no Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala or Kotlin was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X29 Per-element action decided by a fixed element — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned requirements.txt, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
- D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
- D34 Knowledge Freshness: Freshness is decayed commit RECENCY, not comprehension — code read often but rarely committed reads as orphaned, and stable code that genuinely needs no changes is penalised the same as forgotten code; bot/squash commits distort it like the bus factor.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
- D44 Platform End-of-Life: The support table is FROZEN, so it goes out of date by losing RECALL: a release that ended support after the table was written is missed until the table is refreshed, and this dimension reading 10 is not evidence that a platform is current. Only platforms the repository DECLARES in a place this pass reads are seen — a runtime named only in a REDACTED (D31's subject), in a CI workflow (D29's), or in a file this pass does not parse (go.mod, a Gemfile ruby directive) is invisible here, which is why a repository declaring none of them abstains rather than scoring. Only frameworks with a PUBLISHED support policy are tracked: React, Flask and Express publish none, so their age cannot be judged and their absence from a report is not a statement that they are supported.
- AC2 Forms & labels: Label association is read from static markup — a label wired up at runtime (JS-set aria-labelledby, framework-injected ids) reads as missing, a present label says nothing about whether its text is correct. A known UI-library field component (e.g. a JSX <TextField>) is now checked conservatively — flagged only when it carries NO label/aria-label/aria-labelledby/id/name — but wrapper/context-labelled libraries (Chakra/Radix FormControl+FormLabel) aren't statically visible (possible false positive) and non-JSX lowercased components are still skipped. A click handler on a plain element is now asked for a name too (it is a control the author declared), but the subtree test that answers it is deliberately generous: any DYNAMIC text expression in the subtree counts as a name, so an icon chosen by a ternary ({cond ? <IconA/> : <IconB/>}) reads as named, and a glyph component from a library the icon-import list does not know still names its parent. A clean result is "no unlabelled control found", not a labelling proof.
- AC3 Page structure: Page structure is read from the static markup tree — landmarks, headings and lang injected at runtime aren't seen, heading ORDER is checked structurally (not against the rendered visual hierarchy), and lang/title/main fire only on full documents, never partials, and the data-table check sees header-cell presence (a <th> exists), not whether each header correctly associates with its cells. Static readiness, not conformance.
- AC5 ARIA correctness: ARIA correctness is checked against the static role/attribute shape — roles/attributes set dynamically aren't seen, a valid role says nothing about whether it matches the element's real behaviour, and required-state checks are suppressed when a JSX spread could supply them. The two-branch toggle check (a control whose state is conveyed only by which of two mutually exclusive branches renders) reads CONDITIONALS THAT ARE ATTRIBUTES — Vue v-if/v-else/v-show and Alpine x-if/x-show — so the same toggle written as a Svelte {#if} block or a JSX ternary is control flow the markup model never projects as a branch and is not seen at all.
- AC7 A11y enforcement: Enforcement is scored from in-repo config/CI evidence only — an a11y gate enforced in external tooling with no in-repo trace can't be credited, and a configured linter is presence, not proof the rules actually run or block a merge.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- C4 Data Retention: This control is scored from in-repo evidence only — its real-world effectiveness, exercised only at runtime, is outside a static scan.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
- P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
0 method(s) exceeded the cognitive complexity threshold of 15.
Do you agree with this assessment?
D3 · God Classes
4 god class(es) detected.
MethodTooLong: Notification.form app/Filament/Pages/Settings/Notification.php:67
ClassTooLong: Notificationapp/Filament/Pages/Settings/Notification.php:37
FileTooLong: Settings/Notification.phpapp/Filament/Pages/Settings/Notification.php
What to do
- Resolve the 2 MethodTooLong finding(s) in God Classes — start with Notification.php, ResultTable.php. — One of this dimension's main actionable groups (2 warning-level).
- Resolve the 1 ClassTooLong finding(s) in God Classes — start with Notification.php. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 FileTooLong finding(s) in God Classes — start with Notification.php. — One of this dimension's main actionable groups (1 warning-level).
- Enforce God Classes in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D4 · Code Duplication
9 duplicated block group(s) detected. A further 2 rows report members as variants of one another; they aggregate block groups already counted above and are not themselves counted. 2 of the 11 are in trees this repository does not ship — vendored, example/demo, fixture and benchmark code — and are ranked below the shipped groups rather than excluded from them: the duplication there is real and is still counted in this dimension's score. The dimensions that publish a production-file census leave those trees out of theirs, so this count is deliberately drawn over the wider population.
Near-duplicate member family (6 members, 16 shared lines)app/Filament/Widgets/RecentDownloadChartWidget.php:38
Duplicated block (32 lines × 7)app/Listeners/Discord/SendSpeedtestThresholdNotification.php:31
Duplicated block (28–31 lines × 2)app/Listeners/Ntfy/SendSpeedtestCompletedNotification.php:30
Duplicated block (21–23 lines × 2)app/Http/Controllers/Api/V1/ResultsController.php:23
Duplicated block (20 lines × 2)app/Listeners/Telegram/SendSpeedtestCompletedNotification.php:31
What to do
- Resolve the 1 Near-duplicate member family (6 members, 16 shared lines) finding(s) in Code Duplication — start with RecentDownloadChartWidget.php. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Duplicated block (32 lines × 7) finding(s) in Code Duplication — start with SendSpeedtestThresholdNotification.php. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Duplicated block (28–31 lines × 2) finding(s) in Code Duplication — start with SendSpeedtestCompletedNotification.php. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Code Duplication in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 16 classes have LCOM4 above 3.
Do you agree with this assessment?
D12 · Dependency Hygiene
11 outdated, 0 abandoned direct Composer dependencies. PLATFORM requirements (php, ext-*, lib-*) are deliberately not graded here: they name the runtime rather than a Packagist package, so there is no release for them to be behind — whether that runtime is still supported is a separate question with a separate remedy. Development requirements are excluded, because a consumer never installs them. A newer release is reported only where this repository's OWN constraint already admits it, so the remedy is `composer update` and never a manifest edit. Known CVEs in this dependency graph are D30's question.
Outdated: dragonmantank/cron-expression
Do you agree with this assessment?
D13 · Secret Scanning
1 secret(s) detected.
REDACTED
What to do
- Resolve the 1 Leaked secret finding(s) in Secret Scanning — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- Enforce Secret Scanning in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D14 · License Compliance
0 of 138 locked Composer package(s) use a banned license. Licences were read from this repository's REDACTED, which records the `license` each package declares, over every package in its production `packages` list, direct and transitive, at the locked version; the 59 package(s) under `packages-dev` are not installed for a consumer and are excluded. ★ COVERAGE OF THIS VERDICT: it grades this repository's Composer package dependencies and nothing else. The repository also declares package.json, and the licences of those dependencies were NOT read by this pass — a gap in this engine's coverage, not a statement about them. So this result says the graded closure carries no banned licence; it does NOT say this repository's licensing is clear.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D17 · Explicit Debt
1 deducted task-comment markers across 15370 LoC (0.0/KLoC) → score 10.0. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
TodoCommentconfig/app.php:128
What to do
- Resolve the 1 TodoComment finding(s) in Explicit Debt — start with app.php. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Explicit Debt in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's root README is clear and complete for a self-hosted application tracker: it names the project (Speedtest Tracker), states its purpose, lists five features with links to Crowdin translations, gives installation guidance pointing to LinuxServer.io, configurations, notifications, and FAQs docs, and ends with translation instructions. The document is single-file and under the scanner's clip boundary before any architecture or design documentation appears; no clipped section is flagged as missing.
Documentation: no architecture or design documentationREADME.md
What to do
- Resolve the 1 Documentation finding(s) in Documentation Quality — start with README.md. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D26 · Project Cohesion
1 of 1 build units (npm) flagged as possibly oversized/incoherent.
Projects may be oversized for their cohesion
What to do
- Resolve the 1 Projects may be oversized for their cohesion finding(s) in Project Cohesion. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
14 finding(s): 0 critical, 14 high, 0 medium, 0 low. 13 unpinned-GitHub-Actions row(s) are reported here but scored by D36 (supply-chain provenance), which measures that posture as `pinned_actions` — one pinning decision is charged once, not once per lens. semgrep hit a parse error in 11 file(s) — `app/Filament/Resources/ApiTokens/Tables/ApiTokenTable.php` (line 60, line 63), `app/Filament/Resources/Results/Tables/ResultTable.php` (line 219, line 220, line 236, …), `app/Jobs/Ookla/SelectSpeedtestServerJob.php` (line 157), `public/js/filament/forms/components/code-editor.js`, `public/js/filament/forms/components/color-picker.js` (line 1), … (+6 more) — so no absence of findings in the named regions is evidence of anything; rows reported elsewhere in those files are real. Fix the syntax error (or exclude the file deliberately) and re-scan to cover them.
REDACTED
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- No action in Static Analysis (SAST) — all 13 REDACTED finding(s) are reported here at file:line but scored by D36 (supply-chain provenance), so none is charged to this dimension. — One of this dimension's main actionable groups (13 issue-level, 0 of them charged here).
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
7 finding(s): 0 critical, 3 high, 2 medium, 2 low.
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 3 High CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (2), REDACTED. — One of this dimension's main actionable groups (3 issue-level).
- Resolve the 2 Medium CVE finding(s) in Dependency Vulnerabilities — start with REDACTED, REDACTED. — One of this dimension's main actionable groups (2 warning-level).
- Resolve the 2 Low CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (2). — One of this dimension's main actionable groups (2 recommendation-level).
Do you agree with this assessment?
D31 · IaC & Container Security
10 finding(s): 0 critical, 6 high, 3 medium, 1 low.
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 6 High IaC finding(s) in IaC & Container Security — start with REDACTED (4), REDACTED (2). — One of this dimension's main actionable groups (6 issue-level).
- Resolve the 3 Medium IaC finding(s) in IaC & Container Security — start with REDACTED (2), REDACTED. — One of this dimension's main actionable groups (3 warning-level).
- Resolve the 1 Low IaC finding(s) in IaC & Container Security — start with REDACTED. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D34 · Knowledge Freshness
Every significant source file has living knowledge — recently and meaningfully worked. Counted over 54 of the 240 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Do you agree with this assessment?
D35 · Change Coupling
Strongest change-coupling: RecentDownloadChartWidget.php↔RecentJitterChartWidget.php 92%; RecentDownloadChartWidget.php↔RecentPingChartWidget.php 92%; RecentJitterChartWidget.php↔RecentPingChartWidget.php 92%
Change coupling clique: RecentDownloadChartWidget.php, RecentJitterChartWidget.php, RecentPingChartWidget.phpapp/Filament/Widgets/RecentDownloadChartWidget.php
What to do
- Resolve the 1 Change coupling clique finding(s) in Change Coupling — start with RecentDownloadChartWidget.php. — One of this dimension's main actionable groups (1 warning-level).
Do you agree with this assessment?
D36 · Supply-chain Provenance & Signing
0/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).
REDACTED
REDACTED
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 2 REDACTED finding(s) in Supply-chain Provenance & Signing — start with REDACTED, REDACTED. — One of this dimension's main actionable groups (2 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing — start with REDACTED. — One of this dimension's main actionable groups (1 warning-level).
Do you agree with this assessment?
D37 · Vulnerability-disclosure Policy
A vulnerability-disclosure policy (SECURITY.md) is published with a reporting contact.
Do you agree with this assessment?
D43 · Malicious Dependencies
No dependency in any ecosystem this repository declares is published as malicious.
Do you agree with this assessment?
D44 · Platform End-of-Life
0 end-of-life runtime(s) and 0 end-of-life framework(s), read from 0 platform declaration(s) and 21 dependency declaration(s). This dimension reads what the repository says about ITSELF — a pinned target framework, a version file, a capped requires-python, a Rust toolchain pin, a framework major a constraint cannot move off. A FLOOR is deliberately never charged: `requires-python = ">=3.8"` states what the package SUPPORTS, not what it runs on, and a well-maintained library declares exactly that while running its own CI on a current release. The end-of-life facts are FROZEN and dated, so this dimension needs no network and answers identically inside a closed scan fence; as the table ages it loses recall and never precision, because a statement about support that ended in the past cannot become false. The OS layer of a container image is D31's question and the toolchain a CI workflow installs is D29's; this row is neither.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AC2 · Forms & labels
Do you agree with this assessment?
AC3 · Page structure
- No <main> (or role="main") means no "skip to content" target and a weaker landmark map. Wrap the primary content in <main>. — resources/views/layouts/guest.blade.php:2
What to do
- Declare <html lang>, a document <title> and a <main> landmark, keep headings in order, leave zoom enabled, title iframes and drop meta-refresh.
Do you agree with this assessment?
AC5 · ARIA correctness
Do you agree with this assessment?
AC7 · A11y enforcement
- No accessibility enforcement found — no a11y linter (an accessibility check that can read your UI — no component framework was detected and your pages are rendered by server-side templates, which neither the JSX/Vue ESLint plugins nor the HTML-template linters can parse; run axe/pa11y over the rendered pages, or assert the accessibility invariants over that rendered HTML in the test suite you already have) and no axe/pa11y/Lighthouse in tests or CI. Start by running that check over your rendered pages in CI. What was searched, so you can tell an absence from a miss: the 18 markup file(s) this pass actually assessed, the linter configuration checked in beside them, and this repository's test and CI files — matched by name against the accessibility checkers this dimension carries. An audit run outside the repository, a hosted scanner, or a check whose name is not one of those, is not seen here.
What to do
- Enforce accessibility in the toolchain: add an accessibility check that can read your UI — no component framework was detected and your pages are rendered by server-side templates, which neither the JSX/Vue ESLint plugins nor the HTML-template linters can parse; run axe/pa11y over the rendered pages, or assert the accessibility invariants over that rendered HTML in the test suite you already have, then assert with your test runner's axe binding (jest-axe, vitest-axe, cypress-axe or @axe-core/playwright) in tests, then gate axe/pa11y/Lighthouse in CI.
Do you agree with this assessment?
AX10 · Code composition
What to do
- The domain core is a small share of production code, but most of the rest matched no layer vocabulary at all — so this is not yet an anemic-domain finding. The namespace/path convention could not place that code, which makes the composition above a statement about the naming, not about the design. Name the layers (or check that the repository's conventions differ from the ones this check knows) before reading a thin domain into it.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
C1 · Data Protection
What to do
- Strengthen data-at-rest protection: vault your keys (AWS KMS / Secrets Manager, GCP KMS / Secret Manager, HashiCorp Vault — not only APP_KEY in .env) and encrypt the most sensitive columns (Eloquent 'encrypted' casts, CipherSweet) — partial coverage still leaves gaps.
Do you agree with this assessment?
C2 · Access Controls
Do you agree with this assessment?
C4 · Data Retention
- A retention mechanism is present, but the data-lifecycle is not yet complete — missing: an expiry limit — a declared maximum age / TTL after which the data is no longer kept, a documented retention period / data-expiry.
What to do
- Complete the data-lifecycle story: an expiry limit (a declared maximum age for the stored data — a retention-age setting, or a store-level TTL where your storage offers one), a scheduled purge/cleanup job that enforces it, and a documented retention period covering the personal data.
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
- No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named `architecture` or `design` in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape — no `## Architecture` heading, no "architecture overview"/"high-level design" phrasing, no "the architecture is …" introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document — not evidence that nobody wrote the shape down.
What to do
- Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
- Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
- README claims multi-language support but only de_DE/en/es_ES/fr_FR/nl_NL/pt_BR are present and the README links to Crowdin for community translations — reported by the model that read the README against this repository; no term search was run for this one, so nothing here has been checked against the tree. Treat it as a reading to confirm, not as a measured contradiction: verify it against the code before acting on it, and if the footprint it describes does exist, this row is wrong. — README.md:1
What to do
- Reconcile the README with reality: README claims multi-language support but only de_DE/en/es_ES/fr_FR/nl_NL/pt_BR are present and the README links to Crowdin for community translations.
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P2 · Observability
Do you agree with this assessment?
P3 · Security & performance tooling
- No static application security testing detected. For this repository's stack, add phpstan or psalm (or `semgrep --config=auto`, which runs on any language) as a CI step. What was searched, so you can tell an absence from a miss: the 6256 CI workflow file(s) in this repository, and the scanner and linter configuration checked in beside them. A scan that runs outside CI, one configured in your forge's web UI rather than in a committed file, or a tool whose name is none of those this check carries, is not seen — if that is your case the row is wrong, and saying so is more useful than adding a second scanner.
What to do
- Add a SAST step to CI running what this repository's stack ships: phpstan or psalm — or `semgrep --config=auto`, which runs on any language — so a security regression fails the build instead of landing.
- Dependabot is configured but does not watch `npm`, `composer` — add those `package-ecosystem` entries to REDACTED so those dependencies get the same automatic update and advisory pressure as the ones it already covers.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P4 · Deployment & Rollback
What to do
- Add an approval/environment gate (required reviewers / protection rules) before production promotion.
Do you agree with this assessment?
P6 · Release Hygiene
- No CHANGELOG/HISTORY/RELEASES file — what shipped when isn't easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)
What to do
- Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release.
Do you agree with this assessment?
P7 · Outbound HTTP resilience
Do you agree with this assessment?
P8 · Schema migrations
Do you agree with this assessment?
X14 · Bypassable address classification
Do you agree with this assessment?
X15 · Unvalidated length from an untrusted reader
Do you agree with this assessment?
X16 · Unfloored truncation loop
Do you agree with this assessment?
X18 · Disposal-pattern correctness
Do you agree with this assessment?
X19 · Unrestored process-global state
Do you agree with this assessment?
X21 · Side-effecting pattern guard
Do you agree with this assessment?
X22 · Contradicted release guard
Do you agree with this assessment?
X23 · Unguarded diagnostic materialisation
Do you agree with this assessment?
X25 · Inert configuration knob
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X30 · Support guard that admits what it rejects
Do you agree with this assessment?
X4 · Structured logging
Do you agree with this assessment?
X5 · Nullable reference types
- This repository commits no PHPStan or Psalm configuration (`phpstan.neon[.dist]`, `phpstan.dist.neon`, `psalm.xml[.dist]`, or one a composer.json script names with `--configuration`), so nothing checks null: a `?Customer` reaches `->name()` silently and throws `Error: Call to a member function name() on null` the first time it is null. If the build passes a level on a command line instead, put it in a committed configuration — this check reads configuration, and configuration is all it can read.
What to do
- Raise PHPStan to level 8 (`level: 8` in `phpstan.neon.dist`, or `max`) or Psalm to `errorLevel="3"` or stricter, so `?Type` is a type the checker holds you to; generate a baseline for what that surfaces only to pay it down, not to keep it. Then resolve the baselined nullness errors rather than adding to them: each is a call on a value the checker showed could be null — narrow it (`if ($x === null) { … }`, `?->`, an early return), make the property non-nullable and initialise it in the constructor, or change the return type so the null cannot arrive.
Do you agree with this assessment?
WCAG coverage — what static analysis assessed
| Dimension | WCAG 2.2 A/AA criteria | Coverage |
|---|---|---|
| AC2 · Forms & labels | 1.3.1, 3.3.2, 4.1.2 | Partial signal |
| AC3 · Page structure | 1.4.4, 2.2.1, 2.4.1, 2.4.2, 3.1.1, 4.1.2 | Partial signal |
| AC5 · ARIA correctness | 4.1.2 | Partial signal |
| AC7 · A11y enforcement | enforcement — no page criterion | Enforcement posture (process) |
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 73% | Adequate — gated by X5 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Architecture | 83% | Adequate — gated by D26 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Maturity | 56% | Adequate — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 64% | Adequate — gated by P3 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 64% | Adequate — gated by D36 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Accessibility | 68% | Adequate | Strongest area. |
Unscored — 1 check(s) recorded observations but carry no score
- X10 Duplicated predicate — 2 observation(s) recorded · Advisory — this card reports evidence and never carries a score.
Not evidenced — 3 control(s) we could not find positive evidence for
- C3 Audit Trail — Repo shows no audit-logging mechanism (an audit-log table or model, a change-history library on the models — spatie/laravel-activitylog's LogsActivity, owen-it/laravel-auditing's Auditable, venturecraft/revisionable, Gedmo Loggable — or an Eloquent model event, observer or Doctrine listener that records each change) for sensitive changes — absence of evidence is not evidence of a working control. Record an audit trail in code (or document where it lives) so this dimension can be scored.
- C5 Data-Subject Rights — Repo shows no corroborated data-subject-rights mechanism (erasure / export-portability / consent) tied to a subject id or GDPR vocabulary — absence of evidence is not evidence of a working control. Implement erasure, data export/portability and consent tracking over the subject's records.
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
Not included — 57 check(s) not relevant to this codebase
- AC1 Text alternatives — No image/media element found in the parsed markup — AC1 not applicable here.
- AC4 Keyboard semantics — No interactive element found in the parsed markup — AC4 not applicable here.
- AC6 Visual & motion safety — Visual & motion safety could not be assessed in this run — the check did not complete, so it is not scored. This is a gap in the analyzer, not a finding about this repository.
- AX1 Captive dependencies — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX2 Stateful singletons — Not applicable: PHP builds its object graph per request and shares none of it between requests.
- AX5 Architecture & structure — not assessed — architecture style/structure is computed from a project graph (projects, types, module namespaces) that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- AXR1 Runtime accessibility — compose up failed (exit 18 — an image could not be pulled) — apprise Pulling mailpit Pulling laravel.test Pulling pgsql Pulling apprise Error Get "https://registry-1.docker.io/v2/": Forbidden mailpit Error Get "https://registry-1.docker.io/v2/": Forbidden pgsql Error context canceled laravel.test Warning context canceled Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the earlier `compose pull` step reported: mailpit Error Get "https://registry-1.docker.io/v2/": Forbidden apprise Error Get "https://registry-1.docker.io/v2/": Forbidden laravel.test Warning context canceled WARNING: Some service image(s) must be built from source by running: docker compose build laravel.test Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the runtime sandbox reaches registries only through the in-fence pull-through mirror, so an image the mirror does not carry cannot be fetched — this is a limit of our sandbox, not of your stack; runtime evidence skipped This is a statement about this run, not a statement about your application: nothing here says the surface is inaccessible, only that it was never rendered.
- D10 Test Quality — ~1339 lines of test source are present (.php) but no test cases reached the test census for this repository — no test root we could resolve declared them, or the files we read declare no cases in a test framework we recognise — so skipped/assertion-free tests couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
- D11 Test Reliability — Test reliability not included — no .php test runner
- D16 Bus Factor — single-maintainer repository — bus factor is not applicable
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D22 Internal API Consistency — No intentionally-exposed public API to evaluate for consistency.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout nor 2+ sibling source directories each declaring an aggregate root. Aggregate roots were found in only one source directory (Models), which is a layered codebase, not two contexts. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D27 Navigability — D27 counts a call into the standard library or a dependency as unresolved for this repository's language (.php), so too few call sites counted as resolved to assess navigability. Not scored: this is a gap in the analyzer, not a verdict about this repository.
- D32 Data Compliance (PII/GDPR) — 7 file(s) were not parsed by semgrep — the PII/GDPR ruleset never ran over them
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D5 Coupling — Not applicable — this Composer build ships 1 production module(s), so there is no coupling BETWEEN modules to measure. (Its test and non-production modules are not part of the shipped graph.)
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- D8 Code Coverage — Coverage not included — suite not readable by the collector
- D9 Test Distribution — Test source is present (.php) but no test cases reached the test census for this repository — no test root we could resolve declared them, or the files we read declare no cases in a test framework we recognise — so its unit/integration/BDD/E2E split couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
- DM1 Domain Modelling — applicable but not scored (2 of 3 signals for this style — below the bar we score at): 1 aggregate root(s) (types guarding their own state behind command methods — this language has no AggregateRoot base to inherit); 2 value object(s); its 1 aggregate(s) are ORM models only — persistence, not behaviour: a CRUD model, measured, not claimed as DDD
- ED1 Event-Driven — not scored — this repository shows none of the 3 signals this lens looks for
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- GD1 Unfinished & placeholder code — no source files were read — this check reads C#, F#, JavaScript/TypeScript, Dart, Ruby and Scala, and none was read for this repository's product. That is a limit of the analyzer, not a finding about your code.
- IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P12 CI test-gate honesty — Reported, not scored — and nothing was matched here. The coverage check applies to any stack, and the automatic-re-run check to any GitHub-Actions workflow, but the checks for excluded tests, skipped tests and sleep-based synchronisation currently recognise only some ecosystems' test-runner idioms, so on a repository built with another stack the zeros below mean 'not checked', not 'clean'.
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures, or wire coverage collection into CI, to enable this cross-layer check
- PF1 Benchmark discipline — Not applicable: no benchmark suite was found. This check searched for tinybench, mitata, benchmark.js, benny or vitest `bench(...)` calls in files that import them (or `*.bench.*` files), or one of those in a package.json, and for a `*benchmark*` script that this repository's CI runs. Benchmarks are credited as a bonus, so their absence is neither scored nor deducted.
- PF2 Allocation hygiene — Not applicable: TypeScript/JavaScript and PHP runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- PF3 Async & latency hygiene — Not applicable: PHP has no async/await function colour, so there is no asynchronous code for a blocking call to stall.
- S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- SC1 Supply-chain hygiene — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X1 Async correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X12 Unreachable branch — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X13 Undrained process stream — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X17 Uncapped recursion over a caller-supplied document — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X2 Cancellation propagation — no C# was loaded; this repository's PHP was read and makes no request a caller can cancel (amphp's HttpClient or connect) — synchronous PHP offers its callers no cancellation to take
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X24 Document value interpolated into markup unescaped — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X26 Unsynchronised callback handoff — Not applicable: this check looks for a collection written by a callback on one thread while the body waiting on it touches it on another, and in this repository's languages no collection is reachable from two threads at once. PHP gives a request one thread of its own; the event-loop libraries (ReactPHP, Amp) run callbacks one at a time, and ext-parallel copies every value across its channels, so no array or collection is reachable from two threads at once. TypeScript/JavaScript runs every callback on the one thread that owns its objects: a callback runs only when the body waiting on it has yielded, never alongside it, and a worker thread receives a COPY of what it is sent. A SharedArrayBuffer carries raw bytes, never an Array, Map or Set, so no collection is reachable from two threads at once. Not a gap in the analyzer and not a finding about your code.
- X27 Collection changed while being enumerated — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X29 Per-element action decided by a fixed element — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X6 Hand-rolled structured-format parsing — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X7 Silent fallback defaults — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 24 finding(s)
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D31 · IaC & Container Security
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
- REDACTED
D13 · Secret Scanning
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
Serious — 28 finding(s)
D31 · IaC & Container Security
- REDACTED
- REDACTED
- REDACTED
D3 · God Classes
- MethodTooLong: Notification.form app/Filament/Pages/Settings/Notification.php:67
- MethodTooLong: ResultTable.table app/Filament/Resources/Results/Tables/ResultTable.php:31
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
- REDACTED
AC3 · Page structure
- Page without a main landmark resources/views/layouts/guest.blade.php:2
AC7 · A11y enforcement
- Accessibility enforcement below the top rung
D17 · Explicit Debt
- TodoComment config/app.php:128
D3 · God Classes
- ClassTooLong: Notification app/Filament/Pages/Settings/Notification.php:37
D3 · God Classes
- FileTooLong: Settings/Notification.php app/Filament/Pages/Settings/Notification.php
D35 · Change Coupling
- Change coupling clique: RecentDownloadChartWidget.php, RecentJitterChartWidget.php, RecentPingChartWidget.php app/Filament/Widgets/RecentDownloadChartWidget.php
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D4 · Code Duplication
- Near-duplicate member family (6 members, 16 shared lines) app/Filament/Widgets/RecentDownloadChartWidget.php:38
D4 · Code Duplication
- Duplicated block (32 lines × 7) app/Listeners/Discord/SendSpeedtestThresholdNotification.php:31
D4 · Code Duplication
- Duplicated block (28–31 lines × 2) app/Listeners/Ntfy/SendSpeedtestCompletedNotification.php:30
D4 · Code Duplication
- Duplicated block (21–23 lines × 2) app/Http/Controllers/Api/V1/ResultsController.php:23
D4 · Code Duplication
- Duplicated block (20 lines × 2) app/Listeners/Telegram/SendSpeedtestCompletedNotification.php:31
D4 · Code Duplication
- Duplicated block (17–18 lines × 3) app/Actions/Notifications/SendNtfyTestNotification.php:25
D4 · Code Duplication
- Duplicated block (16 lines × 6) app/Filament/Widgets/RecentDownloadChartWidget.php:38
D4 · Code Duplication
- Duplicated block (11 lines × 2) app/Helpers/Number.php:50
D4 · Code Duplication
- Duplicated block (87 lines × 3) app/Filament/Pages/Settings/DataIntegration.php:34
D4 · Code Duplication
- Members sharing a duplicated core (4 members, 50+ identical tokens) app/Actions/Notifications/SendDiscordTestNotification.php:15
D4 · Code Duplication
- Duplicated block (21 lines × 4) app/Actions/Notifications/SendDiscordTestNotification.php:15
Minor — 18 finding(s)
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
X10 · Duplicated predicate
- Duplicated predicate app/Listeners/Ntfy/SendSpeedtestCompletedNotification.php:60
- Duplicated predicate resources/views/getting-started.blade.php:20
C4 · Data Retention
- Partial data-retention evidence
D19 · Documentation Quality
- Documentation: no architecture or design documentation README.md
D20 · ADR Quality
- No ADRs found
D26 · Project Cohesion
- Projects may be oversized for their cohesion
D31 · IaC & Container Security
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
M2 · Architecture documentation
- No ADRs
M2 · Architecture documentation
- No architecture diagram/doc
M4 · Documentation accuracy
- README/code drift README.md:1
P3 · Security & performance tooling
- No SAST
P6 · Release Hygiene
- No changelog
X5 · Nullable reference types
- PHP static analysis does not check null everywhere
Minor — 11 finding(s)
D12 · Dependency Hygiene
- Outdated: dragonmantank/cron-expression
- Outdated: filament/filament
- Outdated: filament/spatie-laravel-settings-plugin
- Outdated: influxdata/influxdb-client-php
- Outdated: laravel/framework
- Outdated: laravel/prompts
- Outdated: livewire/livewire
- Outdated: lorisleiva/laravel-actions
- Outdated: secondnetwork/blade-tabler-icons
- Outdated: spatie/laravel-settings
- Outdated: spatie/ping
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-244016f87c894678bf508197c98aa674/history.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-244016f87c894678bf508197c98aa674/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 14 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | trivy | — | trivy fs --scanners vuln --format json --quiet --severity CRITICAL,HIGH,MEDIUM,LOW --skip-dirs **/bin/** --skip-dirs **/obj/** . --skip-db-update | 7 | artifacts/raw/trivy-fs.json |
| D31 · IaC & Container Security | trivy | — | trivy config --format json --quiet . | 10 | artifacts/raw/trivy-config.json |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. semgrep could not parse 7 file(s) — `app/Filament/Resources/ApiTokens/Tables/ApiTokenTable.php`, `app/Filament/Resources/Results/Tables/ResultTable.php`, `public/js/filament/forms/components/code-editor.js`, `public/js/filament/forms/components/color-picker.js`, `public/js/filament/forms/components/markdown-editor.js`, … (+2 more) — so the PII/GDPR sweep did not cover the unparsed regions of them; rows reported elsewhere in those files are real. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | trivy | — | trivy fs --scanners vuln --format json --quiet --severity CRITICAL,HIGH,MEDIUM,LOW --skip-dirs **/bin/** --skip-dirs **/obj/** . --skip-db-update | 0 | artifacts/raw/trivy-fs.json |