Executive summary
lcobucci/jwt scores 63 out of 100 and is rated Adequate, while five of its six lenses score higher still: Code Health and Performance at 100 and Architecture at 96, all rated Exemplary, Production Readiness at 79, rated Strong, and Security and Compliance at 67, rated Adequate.
The score is lower than those five because the weakest lens counts most, and here that is Maturity, which scores 46 and is rated Weak. Its Architecture documentation dimension scores 0 out of 10, and until that reaches 4, Maturity can't be rated higher than Adequate. The first actions are to record your significant design decisions and to resolve the 3 Orphaned file finding(s) in Knowledge Freshness, and if Maturity rose to 70, the score would rise from 63 to about 74.
50 findings are critical, all in Static Analysis (SAST).
Watchdog couldn't measure 15 dimensions in this code, among them Code Coverage, Test Reliability and Documentation Quality, so they are left out of the score. The product code is 2,763 lines, which would take an estimated 0.1 person-years, around €9,800, to rebuild.
Code Health
100 ★
Exemplary
Architecture
96 ★
Exemplary
Maturity
46
Weak, capped by Architecture documentation
Production Readiness
79
Strong
Security and Compliance
67
Adequate, capped by Static Analysis (SAST) and Supply-chain Provenance & Signing
Performance
100 ★
Exemplary
How the score is built: what each lens counts for
The lenses don't count equally. The weakest lens counts most, the next weakest a little less, and so on, so a weak area pulls the score down instead of being averaged away. In the bar below, each part's width shows how much that lens counts and its colour shows its rating. Improving the widest part moves the score most, and as that lens improves, it counts for less, because another lens becomes the weakest.
Maturity 46 · counts for 46%Security and Compliance 67 · counts for 25%Production Readiness 79 · counts for 14%Architecture 96 · counts for 8%Code Health 100 · counts for 4%Performance 100 · counts for 2%
If Maturity rose from 46 to 70, the lowest score rated Strong, the score would rise from 63 to about 74.
Code composition: what the lines of code are
Product code 32%Tests 68%
New since the last survey: 8 findings
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
- Supply-chain Provenance & Signing · REDACTED
Fixed since the last survey: 2 findings
- Dependency Vulnerabilities · High CVE: [GHSA redacted] composer.lock
- Supply-chain Provenance & Signing REDACTED
Rebuild cost: about €9,800 · Estimate
| Cost to rebuild | €3,200 to €16,000, for 54 to 172 hours of work, about 0.1 person-years for one engineer |
|---|---|
| Difficulty of the problem | Standard, judged from the kind of software and how it is built. Code that solves a harder problem, such as payments or medical bookings, costs more per line to write. |
| Quality factor | ×0.9 at a score of 63. Better code takes more work to write, so the factor is ×1.0 at a score of 70, lower below it and higher above it. |
| Size | Small: 2,763 lines of product code |
Top priorities
1
Record your significant design decisions.
Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
2
Resolve the 3 Orphaned file finding(s) in Knowledge Freshness — start with Builder.php (2), MultibyteStringConverter.php.
3
Expand the README with getting-started, architecture overview and a project map.
Diagnosis: what the measurements show together
Where the investment is most exposed
This code would cost about €9,800 to build again, about 0.1 person-years of work. Its weakest lens is Maturity, at 46 (Weak). Maturity is about how well the project explains and looks after itself, which decides whether a new developer, or a new supplier, can take over. Because the weakest lens counts most in the score, work on Maturity also moves the score most.
If you do one thing first
Record your significant design decisions. Of all the actions in this report, it raises the score most for the work it takes: about 12 points for medium effort. The next survey will show the change in the score.
Architecture: which parts of the code depend on which
| uses → | 1 Signer.Ecdsa | 2 Validation | 3 Signer | 4 Signer.Hmac | 5 Signer.Rsa | 6 Token | 7 Lcobucci.JWT | 8 Encoding | 9 Signer.Key | 10 Validation.Constraint |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 Signer.Ecdsa | 4 | 1 | ||||||||
| 2 Validation | 6 | |||||||||
| 3 Signer | 1 | 6 | ||||||||
| 4 Signer.Hmac | 3 | |||||||||
| 5 Signer.Rsa | 3 | |||||||||
| 6 Token | 1 | 12 | ||||||||
| 7 Lcobucci.JWT | 5 | 4 | 3 | |||||||
| 8 Encoding | 8 | |||||||||
| 9 Signer.Key | 1 | 1 | ||||||||
| 10 Validation.Constraint | 11 | 2 | 16 |
Uses a module listed above itPart of a loopThe module itself
1→3 Signer.Ecdsa uses Signer part of a loop✕
- Connections
- 4 pairs of types, where a type in Signer.Ecdsa uses a type in Signer.
- The types involved
Lcobucci.JWT.Signer.Ecdsa.Sha256→Lcobucci.JWT.Signer.EcdsaLcobucci.JWT.Signer.Ecdsa.Sha256K→Lcobucci.JWT.Signer.EcdsaLcobucci.JWT.Signer.Ecdsa.Sha384→Lcobucci.JWT.Signer.EcdsaLcobucci.JWT.Signer.Ecdsa.Sha512→Lcobucci.JWT.Signer.Ecdsa
- Direction
- Signer.Ecdsa uses Signer, so a change to Signer can break Signer.Ecdsa, while a change to Signer.Ecdsa can't break Signer.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
1→7 Signer.Ecdsa uses Lcobucci.JWT part of a loop✕
- Connections
- 1 pair of types, where a type in Signer.Ecdsa uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Signer.Ecdsa.ConversionFailed→Lcobucci.JWT.Exception
- Direction
- Signer.Ecdsa uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Signer.Ecdsa, while a change to Signer.Ecdsa can't break Lcobucci.JWT.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
2→7 Validation uses Lcobucci.JWT part of a loop✕
- Connections
- 6 pairs of types, where a type in Validation uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Validation.Constraint→Lcobucci.JWT.TokenLcobucci.JWT.Validation.ConstraintViolation→Lcobucci.JWT.ExceptionLcobucci.JWT.Validation.NoConstraintsGiven→Lcobucci.JWT.ExceptionLcobucci.JWT.Validation.RequiredConstraintsViolated→Lcobucci.JWT.ExceptionLcobucci.JWT.Validation.Validator→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Validator→Lcobucci.JWT.Validator
- Direction
- Validation uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Validation, while a change to Validation can't break Lcobucci.JWT.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
3→1 Signer uses Signer.Ecdsa✕
- Connections
- 1 pair of types, where a type in Signer uses a type in Signer.Ecdsa.
- The types involved
Lcobucci.JWT.Signer.Ecdsa→Lcobucci.JWT.Signer.Ecdsa.SignatureConverter
- Direction
- Signer uses Signer.Ecdsa, so a change to Signer.Ecdsa can break Signer, while a change to Signer can't break Signer.Ecdsa.
- Position
- Below the diagonal: Signer uses a module listed above it, which is the healthy direction.
3→7 Signer uses Lcobucci.JWT part of a loop✕
- Connections
- 6 pairs of types, where a type in Signer uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Signer.Blake2b→Lcobucci.JWT.SignerLcobucci.JWT.Signer.CannotSignPayload→Lcobucci.JWT.ExceptionLcobucci.JWT.Signer.Eddsa→Lcobucci.JWT.SignerLcobucci.JWT.Signer.Hmac→Lcobucci.JWT.SignerLcobucci.JWT.Signer.InvalidKeyProvided→Lcobucci.JWT.ExceptionLcobucci.JWT.Signer.OpenSSL→Lcobucci.JWT.Signer
- Direction
- Signer uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Signer, while a change to Signer can't break Lcobucci.JWT.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
4→3 Signer.Hmac uses Signer✕
- Connections
- 3 pairs of types, where a type in Signer.Hmac uses a type in Signer.
- The types involved
Lcobucci.JWT.Signer.Hmac.Sha256→Lcobucci.JWT.Signer.HmacLcobucci.JWT.Signer.Hmac.Sha384→Lcobucci.JWT.Signer.HmacLcobucci.JWT.Signer.Hmac.Sha512→Lcobucci.JWT.Signer.Hmac
- Direction
- Signer.Hmac uses Signer, so a change to Signer can break Signer.Hmac, while a change to Signer.Hmac can't break Signer.
- Position
- Below the diagonal: Signer.Hmac uses a module listed above it, which is the healthy direction.
5→3 Signer.Rsa uses Signer✕
- Connections
- 3 pairs of types, where a type in Signer.Rsa uses a type in Signer.
- The types involved
Lcobucci.JWT.Signer.Rsa.Sha256→Lcobucci.JWT.Signer.RsaLcobucci.JWT.Signer.Rsa.Sha384→Lcobucci.JWT.Signer.RsaLcobucci.JWT.Signer.Rsa.Sha512→Lcobucci.JWT.Signer.Rsa
- Direction
- Signer.Rsa uses Signer, so a change to Signer can break Signer.Rsa, while a change to Signer.Rsa can't break Signer.
- Position
- Below the diagonal: Signer.Rsa uses a module listed above it, which is the healthy direction.
6→3 Token uses Signer✕
- Connections
- 1 pair of types, where a type in Token uses a type in Signer.
- The types involved
Lcobucci.JWT.Token.Builder→Lcobucci.JWT.Signer.Key
- Direction
- Token uses Signer, so a change to Signer can break Token, while a change to Token can't break Signer.
- Position
- Below the diagonal: Token uses a module listed above it, which is the healthy direction.
6→7 Token uses Lcobucci.JWT part of a loop✕
- Connections
- 12 pairs of types, where a type in Token uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Token.Builder→Lcobucci.JWT.BuilderLcobucci.JWT.Token.Builder→Lcobucci.JWT.ClaimsFormatterLcobucci.JWT.Token.Builder→Lcobucci.JWT.EncoderLcobucci.JWT.Token.Builder→Lcobucci.JWT.SignerLcobucci.JWT.Token.Builder→Lcobucci.JWT.UnencryptedTokenLcobucci.JWT.Token.InvalidTokenStructure→Lcobucci.JWT.ExceptionLcobucci.JWT.Token.Parser→Lcobucci.JWT.DecoderLcobucci.JWT.Token.Parser→Lcobucci.JWT.ParserLcobucci.JWT.Token.Parser→Lcobucci.JWT.TokenLcobucci.JWT.Token.Plain→Lcobucci.JWT.UnencryptedTokenLcobucci.JWT.Token.RegisteredClaimGiven→Lcobucci.JWT.ExceptionLcobucci.JWT.Token.UnsupportedHeaderFound→Lcobucci.JWT.Exception
- Direction
- Token uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Token, while a change to Token can't break Lcobucci.JWT.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
7→2 Lcobucci.JWT uses Validation✕
- Connections
- 5 pairs of types, where a type in Lcobucci.JWT uses a type in Validation.
- The types involved
Lcobucci.JWT.Configuration→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.JwtFacade→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.JwtFacade→Lcobucci.JWT.Validation.SignedWithLcobucci.JWT.JwtFacade→Lcobucci.JWT.Validation.ValidAtLcobucci.JWT.Validator→Lcobucci.JWT.Validation.Constraint
- Direction
- Lcobucci.JWT uses Validation, so a change to Validation can break Lcobucci.JWT, while a change to Lcobucci.JWT can't break Validation.
- Position
- Below the diagonal: Lcobucci.JWT uses a module listed above it, which is the healthy direction.
7→3 Lcobucci.JWT uses Signer✕
- Connections
- 4 pairs of types, where a type in Lcobucci.JWT uses a type in Signer.
- The types involved
Lcobucci.JWT.Builder→Lcobucci.JWT.Signer.KeyLcobucci.JWT.Configuration→Lcobucci.JWT.Signer.KeyLcobucci.JWT.JwtFacade→Lcobucci.JWT.Signer.KeyLcobucci.JWT.Signer→Lcobucci.JWT.Signer.Key
- Direction
- Lcobucci.JWT uses Signer, so a change to Signer can break Lcobucci.JWT, while a change to Lcobucci.JWT can't break Signer.
- Position
- Below the diagonal: Lcobucci.JWT uses a module listed above it, which is the healthy direction.
7→6 Lcobucci.JWT uses Token✕
- Connections
- 3 pairs of types, where a type in Lcobucci.JWT uses a type in Token.
- The types involved
Lcobucci.JWT.Token→Lcobucci.JWT.Token.DataSetLcobucci.JWT.UnencryptedToken→Lcobucci.JWT.Token.DataSetLcobucci.JWT.UnencryptedToken→Lcobucci.JWT.Token.Signature
- Direction
- Lcobucci.JWT uses Token, so a change to Token can break Lcobucci.JWT, while a change to Lcobucci.JWT can't break Token.
- Position
- Below the diagonal: Lcobucci.JWT uses a module listed above it, which is the healthy direction.
8→7 Encoding uses Lcobucci.JWT✕
- Connections
- 8 pairs of types, where a type in Encoding uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Encoding.CannotDecodeContent→Lcobucci.JWT.ExceptionLcobucci.JWT.Encoding.CannotEncodeContent→Lcobucci.JWT.ExceptionLcobucci.JWT.Encoding.ChainedFormatter→Lcobucci.JWT.ClaimsFormatterLcobucci.JWT.Encoding.JoseEncoder→Lcobucci.JWT.DecoderLcobucci.JWT.Encoding.JoseEncoder→Lcobucci.JWT.EncoderLcobucci.JWT.Encoding.MicrosecondBasedDateConversion→Lcobucci.JWT.ClaimsFormatterLcobucci.JWT.Encoding.UnifyAudience→Lcobucci.JWT.ClaimsFormatterLcobucci.JWT.Encoding.UnixTimestampDates→Lcobucci.JWT.ClaimsFormatter
- Direction
- Encoding uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Encoding, while a change to Encoding can't break Lcobucci.JWT.
- Position
- Below the diagonal: Encoding uses a module listed above it, which is the healthy direction.
9→3 Signer.Key uses Signer✕
- Connections
- 1 pair of types, where a type in Signer.Key uses a type in Signer.
- The types involved
Lcobucci.JWT.Signer.Key.InMemory→Lcobucci.JWT.Signer.Key
- Direction
- Signer.Key uses Signer, so a change to Signer can break Signer.Key, while a change to Signer.Key can't break Signer.
- Position
- Below the diagonal: Signer.Key uses a module listed above it, which is the healthy direction.
9→7 Signer.Key uses Lcobucci.JWT✕
- Connections
- 1 pair of types, where a type in Signer.Key uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Signer.Key.FileCouldNotBeRead→Lcobucci.JWT.Exception
- Direction
- Signer.Key uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Signer.Key, while a change to Signer.Key can't break Lcobucci.JWT.
- Position
- Below the diagonal: Signer.Key uses a module listed above it, which is the healthy direction.
10→2 Validation.Constraint uses Validation✕
- Connections
- 11 pairs of types, where a type in Validation.Constraint uses a type in Validation.
- The types involved
Lcobucci.JWT.Validation.Constraint.HasClaim→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.HasClaimWithValue→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.IdentifiedBy→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.IssuedBy→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.LooseValidAt→Lcobucci.JWT.Validation.ValidAtLcobucci.JWT.Validation.Constraint.PermittedFor→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.RelatedTo→Lcobucci.JWT.Validation.ConstraintLcobucci.JWT.Validation.Constraint.SignedWith→Lcobucci.JWT.Validation.SignedWithLcobucci.JWT.Validation.Constraint.SignedWithOneInSet→Lcobucci.JWT.Validation.SignedWithLcobucci.JWT.Validation.Constraint.SignedWithUntilDate→Lcobucci.JWT.Validation.SignedWithLcobucci.JWT.Validation.Constraint.StrictValidAt→Lcobucci.JWT.Validation.ValidAt
- Direction
- Validation.Constraint uses Validation, so a change to Validation can break Validation.Constraint, while a change to Validation.Constraint can't break Validation.
- Position
- Below the diagonal: Validation.Constraint uses a module listed above it, which is the healthy direction.
10→3 Validation.Constraint uses Signer✕
- Connections
- 2 pairs of types, where a type in Validation.Constraint uses a type in Signer.
- The types involved
Lcobucci.JWT.Validation.Constraint.SignedWith→Lcobucci.JWT.Signer.KeyLcobucci.JWT.Validation.Constraint.SignedWithUntilDate→Lcobucci.JWT.Signer.Key
- Direction
- Validation.Constraint uses Signer, so a change to Signer can break Validation.Constraint, while a change to Validation.Constraint can't break Signer.
- Position
- Below the diagonal: Validation.Constraint uses a module listed above it, which is the healthy direction.
10→7 Validation.Constraint uses Lcobucci.JWT✕
- Connections
- 16 pairs of types, where a type in Validation.Constraint uses a type in Lcobucci.JWT.
- The types involved
Lcobucci.JWT.Validation.Constraint.CannotValidateARegisteredClaim→Lcobucci.JWT.ExceptionLcobucci.JWT.Validation.Constraint.HasClaim→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.HasClaimWithValue→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.IdentifiedBy→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.IssuedBy→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.LeewayCannotBeNegative→Lcobucci.JWT.ExceptionLcobucci.JWT.Validation.Constraint.LooseValidAt→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.PermittedFor→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.RelatedTo→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.SignedWith→Lcobucci.JWT.SignerLcobucci.JWT.Validation.Constraint.SignedWith→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.SignedWithOneInSet→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.SignedWithUntilDate→Lcobucci.JWT.SignerLcobucci.JWT.Validation.Constraint.SignedWithUntilDate→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.StrictValidAt→Lcobucci.JWT.TokenLcobucci.JWT.Validation.Constraint.StrictValidAt→Lcobucci.JWT.UnencryptedToken
- Direction
- Validation.Constraint uses Lcobucci.JWT, so a change to Lcobucci.JWT can break Validation.Constraint, while a change to Validation.Constraint can't break Lcobucci.JWT.
- Position
- Below the diagonal: Validation.Constraint uses a module listed above it, which is the healthy direction.
At a glance — Code Health
The Good
D1 · PHP
Cyclomatic Complexity
10.0
D2 · PHP
Cognitive Complexity
10.0
D3 · PHP
God Classes
10.0
D4 · PHP
Code Duplication
9.8
D17 · PHP
Explicit Debt
10.0
X16 · Repo
Unfloored truncation loop
10.0
X18 · Repo
Disposal-pattern correctness
10.0
X19 · Repo
Unrestored process-global state
10.0
X21 · Repo
Side-effecting pattern guard
10.0
X22 · Repo
Contradicted release guard
10.0
X23 · Repo
Unguarded diagnostic materialisation
10.0
X25 · Repo
Inert configuration knob
10.0
X28 · Repo
Index access outside its own emptiness guard
10.0
X3 · Repo
Exception handling
10.0
X30 · Repo
Support guard that admits what it rejects
10.0
X5 · Repo
Nullable reference types
10.0
At a glance — Architecture
The Good
At a glance — Maturity
The Good
At a glance — Readiness
The Good
The Bad
At a glance — Security
The Good
The Ugly
At a glance — Performance
The Good
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A05:2025 — Injection | 50 | High / Critical |
| A03:2025 — Software Supply Chain Failures | 11 | Medium |
| A02:2025 — Security Misconfiguration | 1 | Medium |
Roadmap
Begin by documenting significant design decisions in a dedicated folder and expanding the README with clear getting-started and architecture guidance. Next, address the three orphaned files to ensure code knowledge remains current and secure. Then, resolve the twenty-two security findings related to unpinned actions in your workflow files to strengthen static analysis. Finally, update the vulnerability disclosure policy to ensure reports are directed to a private, secure channel rather than a public one.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them. | +12.1 pts | Medium | Architecture documentation |
| Resolve the 3 Orphaned file finding(s) in Knowledge Freshness — start with Builder.php (2), MultibyteStringConverter.php. | +3.6 pts | Low | Knowledge Freshness |
| Expand the README with getting-started, architecture overview and a project map. | +6.3 pts | Medium | Documentation (README) |
| Resolve the 1 REDACTED finding(s) in Vulnerability-disclosure Policy. | +2.2 pts | Low | Vulnerability-disclosure Policy |
| Resolve the 8 REDACTED finding(s) in Supply-chain Provenance & Signing — start with REDACTED, REDACTED, REDACTED. | +2.0 pts | Low | Supply-chain Provenance & Signing |
| Resolve the 22 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED (20), REDACTED, REDACTED. | +3.4 pts | Medium | Static Analysis (SAST) |
| Resolve the 1 Off-boarding risk finding(s) in Bus Factor. | +1.6 pts | Low | Bus Factor |
| Resolve the 1 Orphaned files with no living knowledge finding(s) in Knowledge Freshness. | +1.2 pts | Low | Knowledge Freshness |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 2.3 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 2.5 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 2.7 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.0 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.0 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.0 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.0 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 3.0 | Slop | Static Analysis (SAST): High: REDACTED |
| src/Encoding/MicrosecondBasedDateConversion.php | 8.5 | Near-clean | Code Duplication: Duplicated block (9 lines × 2) |
| src/Validation/Constraint/LooseValidAt.php | 8.5 | Near-clean | Code Duplication: Duplicated block (9 lines × 2) |
How the grades work
Critical — 50
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 15
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 12
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 17
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 48 of 51 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.9 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 51 dimensions across the health lenses
D1D2D3D4D6D9D10D12D13D14D15D16D17D21D22D26D27D28D29D30D34D35D36D37D43D44AX10AX3AX4M1M2M3M4P1P10P3P6PF1X14X15X16X18X19X21X22X23X25X28X3X30X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 63 of 77 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D8 Code Coverage — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Coverage NOT READ here — but this repository measures it: a coverage step in CI (`PHPUNIT_FLAGS=--coverage`) shows that coverage is collected and tracked in your own CI. The built-in collector has no runner for this ecosystem (.php), so the analyzer could not read the number — a gap in the analyzer's language coverage, not an unmeasured repo. Not scored. To have the real number read, produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures. You can widen what we reach: optional: produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures — then the real number is read on the next scan.
- D11 Test Reliability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Test source is present (.php) but the built-in reliability runner does not support this repository's ecosystem, so flakiness couldn't be assessed. Not scored — this is a gap in the analyzer's language coverage, not a finding about this repository.
- D19 Documentation Quality — LLM provider failed — The model provider returned an unusable result, so this LLM-assisted dimension fell back to a measurement gap (confidence 0) rather than a penalty. Re-run with a reachable provider to score it.
- D32 Data Compliance (PII/GDPR) — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. `src/Configuration.php`, `src/Encoding/ChainedFormatter.php`, `src/Encoding/JoseEncoder.php`, `src/Encoding/MicrosecondBasedDateConversion.php`, `src/Encoding/UnifyAudience.php`, … (+40 more) produced a parse error, so every rule in this engine's `gdpr.yml` was absent there. That absence is NOT a clean result: these rules detect personal data crossing a boundary into a log sink, a URL or browser storage, and a file that was never parsed cannot report any of the three. The rest of the tree analysed normally and its rows above stand; only these files are unaccounted for. You can widen what we reach: fix the syntax error (or exclude the file deliberately) and re-scan to cover it.
- AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, F#, JavaScript/TypeScript, Dart, Ruby and Scala source only, and no C#, F#, JavaScript/TypeScript, Dart, Ruby or Scala was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, JavaScript/TypeScript, Java, Dart, Ruby and Scala source only, and no C#, JavaScript/TypeScript, Java, Dart, Ruby or Scala was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- P5 DR & Backup — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. No backup/snapshot/replication config, RTO/RPO or restore-procedure documentation was found — and no production persistence was detected either (no data-access packages, no data-store services, no database resources), so there is nothing in this repository whose loss a DR control would recover. If this system's data lives in a platform or ops repo we can't see, that's where the DR evidence belongs.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
- X1 Async correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X12 Unreachable branch — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X13 Undrained process stream — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X17 Uncapped recursion over a caller-supplied document — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X24 Document value interpolated into markup unescaped — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Scala, Ruby and Python source only, and no C# was loaded and no JavaScript/TypeScript, Java, Scala, Ruby or Python was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X27 Collection changed while being enumerated — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded, no Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala or Kotlin was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X29 Per-element action decided by a fixed element — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X4 Structured logging — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Python, PHP, Dart, Ruby, Scala and Rust source only, and no C# was loaded, and this repository's JavaScript/TypeScript, Python and PHP make no call through a named logger, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D10 Test Quality: Assertion density is structural — it cannot tell a meaningful behavioural assertion from a trivial one, only that an assertion is present.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D16 Bus Factor: Bus-factor is a time-decayed model of commit attribution (who has recently, repeatedly worked a file), not comprehension — pairing, review and reading-without-committing spread knowledge it can't see; bot commits and shared accounts still distort it.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D22 Internal API Consistency: API-surface coherence is an LLM judgement over a sample of the public surface — consistency of intent across the whole API is approximated, not exhaustively verified.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D27 Navigability: Indirection/navigability is structural — it measures hops to follow a call, not whether that indirection buys real flexibility or just ceremony.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned requirements.txt, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
- D34 Knowledge Freshness: Freshness is decayed commit RECENCY, not comprehension — code read often but rarely committed reads as orphaned, and stable code that genuinely needs no changes is penalised the same as forgotten code; bot/squash commits distort it like the bus factor.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
- D44 Platform End-of-Life: The support table is FROZEN, so it goes out of date by losing RECALL: a release that ended support after the table was written is missed until the table is refreshed, and this dimension reading 10 is not evidence that a platform is current. Only platforms the repository DECLARES in a place this pass reads are seen — a runtime named only in a Dockerfile (D31's subject), in a CI workflow (D29's), or in a file this pass does not parse (go.mod, a Gemfile ruby directive) is invisible here, which is why a repository declaring none of them abstains rather than scoring. Only frameworks with a PUBLISHED support policy are tracked: React, Flask and Express publish none, so their age cannot be judged and their absence from a report is not a statement that they are supported.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
0 method(s) exceeded the cognitive complexity threshold of 15.
Do you agree with this assessment?
D3 · God Classes
0 god class(es) detected.
Do you agree with this assessment?
D4 · Code Duplication
2 duplicated block group(s) detected.
Duplicated block (9 lines × 2) src/Encoding/MicrosecondBasedDateConversion.php:17
What to do
- Resolve the 2 Duplicated block (9 lines × 2) finding(s) in Code Duplication — start with MicrosecondBasedDateConversion.php, LooseValidAt.php. — One of this dimension's main actionable groups (2 warning-level).
- Enforce Code Duplication in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 7 classes have LCOM4 above 3.
Do you agree with this assessment?
D9 · Test Distribution
280 test methods: 280 unit, 0 integration, 0 BDD, 0 e2e.
Do you agree with this assessment?
D10 · Test Quality
0 skipped, 0 zero-assertion, no mocking-framework packages referenced (hand-written doubles or no mocking) across 280 tests.
Do you agree with this assessment?
D12 · Dependency Hygiene
0 outdated, 0 abandoned direct Composer dependencies. PLATFORM requirements (php, ext-*, lib-*) are deliberately not graded here: they name the runtime rather than a Packagist package, so there is no release for them to be behind — whether that runtime is still supported is a separate question with a separate remedy. Development requirements are excluded, because a consumer never installs them. A newer release is reported only where this repository's OWN constraint already admits it, so the remedy is `composer update` and never a manifest edit. Known CVEs in this dependency graph are D30's question.
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D14 · License Compliance
0 of 1 locked Composer package(s) use a banned license. Licences were read from this repository's composer.lock, which records the `license` each package declares, over every package in its production `packages` list, direct and transitive, at the locked version; the 79 package(s) under `packages-dev` are not installed for a consumer and are excluded.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D16 · Bus Factor
1 source file(s) have their living knowledge concentrated in one author (≥90% of recent, decayed contribution). The largest is src/Token/Parser.php. Counted over 10 of the 73 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Off-boarding risk: anonymized user #1
What to do
- Resolve the 1 Off-boarding risk finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D17 · Explicit Debt
0 deducted task-comment markers across 2763 LoC (0.0/KLoC) → score 10.0. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D22 · Internal API Consistency
4 API inconsistencies across 73 exposed types.
Duplicate Builder creation paths with inconsistent signatures. The API exposes two distinct ways to instantiate a Builder: one via `Configuration.builder()` which takes an optional `ClaimsFormatter`, and another via `Token.Builder.new()` which requires an `Encoder` and a `ClaimsFormatter`. This creates confusion about which entry point to use and why the parameters differ.
Redundant Parser types and inconsistent return types for parsing. There are two distinct `Parser` types (`Lcobucci.JWT.Parser` and `Lcobucci.JWT.Token.Parser`) with identical signatures. Furthermore, `Parser.parse()` returns `Token`, while `JwtFacade.parse()` returns `UnencryptedToken`. Since `UnencryptedToken` appears to be a specific subtype or wrapper, this inconsistency in return types for 'parsing' operations is confusing.
Duplicate Validator types. `Lcobucci.JWT.Validation.Validator` and `Lcobucci.JWT.Validator` have identical method signatures (`assert` and `validate`). This suggests a namespace duplication or a copy-paste error in the API design, exposing the same functionality under two different fully qualified names.
Inconsistent parameter naming and type in `SignedWithOneInSet`. The constructor expects `SignedWithUntilDate` objects, but the name `SignedWithOneInSet` implies a set of `SignedWith` constraints. The parameter name `constraints` (plural) suggests an array or iterable, but the type is a single object `SignedWithUntilDate`. This is misleading.
What to do
- Resolve the 1 Duplicate Builder creation paths with inconsistent signatures. The API… finding(s) in Internal API Consistency. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Redundant Parser types and inconsistent return types for parsing. There… finding(s) in Internal API Consistency. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Duplicate Validator types. `Lcobucci.JWT.Validation.Validator` and… finding(s) in Internal API Consistency. — One of this dimension's main actionable groups (1 warning-level).
Do you agree with this assessment?
D26 · Project Cohesion
0 of 1 build units (Composer) flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D27 · Navigability
35 % of calls cross a namespace and 23 % go through an interface, but 100 % of collaborators are co-located — so following a call takes several hops. Baseline: small — navigation cost is tolerated.
What to do
- Improve Navigability — currently 8.8/10. — 35 % of calls cross a namespace and 23 % go through an interface, but 100 % of collaborators are co-located — so following a call takes several hops. Baseline: small — navigation cost is tolerated.
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
50 finding(s): 0 critical, 50 high, 0 medium, 0 low. 28 unpinned-GitHub-Actions row(s) are reported here but scored by D36 (supply-chain provenance), which measures that posture as `pinned_actions` — one pinning decision is charged once, not once per lens. semgrep hit a parse error in 45 file(s) — `src/Configuration.php` (line 19, line 104), `src/Encoding/ChainedFormatter.php` (line 8), `src/Encoding/JoseEncoder.php` (line 21), `src/Encoding/MicrosecondBasedDateConversion.php` (line 12), `src/Encoding/UnifyAudience.php` (line 13), … (+40 more) — so no absence of findings in the named regions is evidence of anything; rows reported elsewhere in those files are real. Fix the syntax error (or exclude the file deliberately) and re-scan to cover them. Separately, one or more rules could not re-parse an embedded snippet in 1 file(s) (e.g. a workflow `run:` block read as shell). Those files WERE scanned and their other rows are unaffected; only those rules' view of those snippets is missing.
REDACTED
REDACTED
What to do
- Resolve the 22 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED (20), REDACTED, REDACTED. — One of this dimension's main actionable groups (22 issue-level).
- No action in Static Analysis (SAST) — all 28 REDACTED finding(s) are reported here at file:line but scored by D36 (supply-chain provenance), so none is charged to this dimension. — One of this dimension's main actionable groups (28 issue-level, 0 of them charged here).
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
No known-vulnerable dependencies in any ecosystem this repository declares.
Do you agree with this assessment?
D34 · Knowledge Freshness
3 of 10 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is src/Signer/Ecdsa/MultibyteStringConverter.php. Counted over 10 of the 73 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Orphaned file src/Signer/Ecdsa/MultibyteStringConverter.php:1
Orphaned files with no living knowledge
What to do
- Resolve the 3 Orphaned file finding(s) in Knowledge Freshness — start with Builder.php (2), MultibyteStringConverter.php. — One of this dimension's main actionable groups (3 recommendation-level).
- Resolve the 1 Orphaned files with no living knowledge finding(s) in Knowledge Freshness. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
Do you agree with this assessment?
D36 · Supply-chain Provenance & Signing
1/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).
REDACTED
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 8 REDACTED finding(s) in Supply-chain Provenance & Signing — start with REDACTED, REDACTED, REDACTED. — One of this dimension's main actionable groups (8 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D37 · Vulnerability-disclosure Policy
A vulnerability-disclosure policy (.github/SECURITY.md) is present but only routes reports to a public channel (no private reporting contact).
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Vulnerability-disclosure Policy. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D43 · Malicious Dependencies
No dependency in any ecosystem this repository declares is published as malicious.
Do you agree with this assessment?
D44 · Platform End-of-Life
0 end-of-life runtime(s) and 0 end-of-life framework(s), read from 0 platform declaration(s) and 1 dependency declaration(s). This dimension reads what the repository says about ITSELF — a pinned target framework, a version file, a capped requires-python, a Rust toolchain pin, a framework major a constraint cannot move off. A FLOOR is deliberately never charged: `requires-python = ">=3.8"` states what the package SUPPORTS, not what it runs on, and a well-maintained library declares exactly that while running its own CI on a current release. The end-of-life facts are FROZEN and dated, so this dimension needs no network and answers identically inside a closed scan fence; as the table ages it loses recall and never precision, because a statement about support that ended in the past cannot become false. The OS layer of a container image is D31's question and the toolchain a CI workflow installs is D29's; this row is neither.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX10 · Code composition
What to do
- The domain core is a small share of production code, but most of the rest matched no layer vocabulary at all — so this is not yet an anemic-domain finding. The namespace/path convention could not place that code, which makes the composition above a statement about the naming, not about the design. Name the layers (or check that the repository's conventions differ from the ones this check knows) before reading a thin domain into it.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
M1 · Documentation (README)
- The root README is 76 words, against a bar of 120. Of the three newcomer-critical sections this check looks for by heading, it found no a testing section, no an architecture or project-map section. Sections are matched on HEADING text only, so material written under a heading this check does not recognise — or with no heading at all — is not seen and this row may understate what the document covers.
What to do
- Expand the README with getting-started, architecture overview and a project map.
- Explain in the README how to run the tests. Add a section called Testing to the README in the repository's top folder, saying how to run the test suite.
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
- No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named `architecture` or `design` in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape — no `## Architecture` heading, no "architecture overview"/"high-level design" phrasing, no "the architecture is …" introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document — not evidence that nobody wrote the shape down.
What to do
- Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
- Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P10 · Library API & versioning
Do you agree with this assessment?
P3 · Security & performance tooling
What to do
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P6 · Release Hygiene
- No CHANGELOG/HISTORY/RELEASES file — what shipped when isn't easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)
What to do
- Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release.
Do you agree with this assessment?
PF1 · Benchmark discipline
Do you agree with this assessment?
X14 · Bypassable address classification
Do you agree with this assessment?
X15 · Unvalidated length from an untrusted reader
Do you agree with this assessment?
X16 · Unfloored truncation loop
Do you agree with this assessment?
X18 · Disposal-pattern correctness
Do you agree with this assessment?
X19 · Unrestored process-global state
Do you agree with this assessment?
X21 · Side-effecting pattern guard
Do you agree with this assessment?
X22 · Contradicted release guard
Do you agree with this assessment?
X23 · Unguarded diagnostic materialisation
Do you agree with this assessment?
X25 · Inert configuration knob
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X30 · Support guard that admits what it rejects
Do you agree with this assessment?
X5 · Nullable reference types
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 100% | Exemplary | Solid. |
| Architecture | 96% | Exemplary | Solid. |
| Maturity | 46% | Weak — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 79% | Strong | Solid. |
| Security | 67% | Adequate — gated by D29, D36 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Performance | 100% | Exemplary | Strongest area. |
Not evidenced — 2 control(s) we could not find positive evidence for
- P4 Deployment & Rollback — not evidenced — no deploy/rollback/approval signal in the repo; absence of evidence is not evidence of a manual release
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
Not included — 67 check(s) not relevant to this codebase
- AC1 Text alternatives — No web markup found — accessibility is not applicable to this repository.
- AC2 Forms & labels — No web markup found — accessibility is not applicable to this repository.
- AC3 Page structure — No web markup found — accessibility is not applicable to this repository.
- AC4 Keyboard semantics — No web markup found — accessibility is not applicable to this repository.
- AC5 ARIA correctness — No web markup found — accessibility is not applicable to this repository.
- AC6 Visual & motion safety — No web markup found — accessibility is not applicable to this repository.
- AC7 A11y enforcement — No web markup found — accessibility is not applicable to this repository.
- AX1 Captive dependencies — Not applicable: this repository's PHP imports no dependency-injection container and defines no container of its own — nothing that both registers and resolves bindings, and nothing that names two lifetimes — so nothing holds one lifetime's instance while handing out another's.
- AX2 Stateful singletons — Not applicable: PHP builds its object graph per request and shares none of it between requests.
- AX5 Architecture & structure — not assessed — architecture style/structure is computed from a project graph (projects, types, module namespaces) that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- AXB1 Runtime evidence locked — no reproducible boot — This repository has nothing the runtime tiers could boot or serve — no markup, no UI framework or web-server dependency, no UI component source, no native UI project and no API definition — nothing here is a surface to boot — so runtime a11y/egress/header evidence has no subject here. Not applicable: this is neither a gap in the scan nor a finding about your code.
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- C1 Data Protection — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no data at rest for these controls to protect.
- C2 Access Controls — No access-control surface detected in the analyzed source — this repository registers no route (no Laravel Route::…, no Symfony #[Route], no Filament panel, no WordPress REST route or AJAX action). Access control is therefore N/A here — a Composer library is authorized by the application that mounts it, not by itself. If this codebase grows request handlers, the dimension reactivates and a default-deny posture is expected then.
- C3 Audit Trail — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone_number, …) or stored credential in a Laravel migration, an Eloquent model's $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no sensitive data whose changes an audit trail would record. If it does (through a hosted backend configured outside this repository, for instance), the trail belongs to wherever that data is stored.
- C4 Data Retention — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no personal data whose lifetime a retention limit would bound.
- C5 Data-Subject Rights — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no personal data for a data subject to erase, export or consent over.
- D11 Test Reliability — Test reliability not included — no .php test runner
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D19 Documentation Quality — LLM evaluation failed
- D20 ADR Quality — N/A — ADRs are expected on deployable products with a user-facing host, not consumed libraries; no ADR log is required here.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout, nor 2+ sibling source directories each declaring an aggregate root, nor 2+ projects each declaring an entity of their own. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D31 IaC & Container Security — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan.
- D32 Data Compliance (PII/GDPR) — 45 file(s) were not parsed by semgrep — the PII/GDPR ruleset never ran over them
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D5 Coupling — Not applicable — this Composer build ships 1 production module(s), so there is no coupling BETWEEN modules to measure. (Its test and non-production modules are not part of the shipped graph.)
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- D8 Code Coverage — Coverage not included — suite not readable by the collector
- DM1 Domain Modelling — not scored — this repository shows only 1 of the 3 signals this lens looks for (37 value object(s))
- ED1 Event-Driven — not scored — this repository shows none of the 3 signals this lens looks for
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- GD1 Unfinished & placeholder code — no source files were read — this check reads C#, F#, JavaScript/TypeScript, Dart, Ruby and Scala, and none was read for this repository's product. That is a limit of the analyzer, not a finding about your code.
- IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P12 CI test-gate honesty — Reported, not scored — this card publishes what the CI gate does with the test inventory rather than grading it. The findings above are its output.
- P2 Observability — This repository's PHP source (1 module(s), 73 file(s) read) declares no entry point and bootstraps no server, and nothing here deploys a service — it is a library, run inside whatever hosts it, so production observability (structured logging, tracing/metrics, health checks) is N/A. If it grows a binary or a service, the dimension reactivates.
- P7 Outbound HTTP resilience — not applicable — no HTTP server, API framework or worker entry point was found in the PHP source, so there is no service whose uptime a failing dependency could take down
- P8 Schema migrations — no ORM, schema-migration tool or schema auto-create was found in this repository's dependency manifests or source, so there is no database schema for this check to judge
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures, or wire coverage collection into CI, to enable this cross-layer check
- PF2 Allocation hygiene — Not applicable: PHP runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- PF3 Async & latency hygiene — Not applicable: PHP has no async/await function colour, so there is no asynchronous code for a blocking call to stall.
- S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- X1 Async correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X10 Duplicated predicate — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X12 Unreachable branch — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X13 Undrained process stream — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X17 Uncapped recursion over a caller-supplied document — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X2 Cancellation propagation — no C# was loaded; this repository's PHP was read and makes no request a caller can cancel (amphp's HttpClient or connect) — synchronous PHP offers its callers no cancellation to take
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X24 Document value interpolated into markup unescaped — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X26 Unsynchronised callback handoff — Not applicable: this check looks for a collection written by a callback on one thread while the body waiting on it touches it on another, and in this repository's languages no collection is reachable from two threads at once. PHP gives a request one thread of its own; the event-loop libraries (ReactPHP, Amp) run callbacks one at a time, and ext-parallel copies every value across its channels, so no array or collection is reachable from two threads at once. Not a gap in the analyzer and not a finding about your code.
- X27 Collection changed while being enumerated — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X29 Per-element action decided by a fixed element — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X4 Structured logging — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X6 Hand-rolled structured-format parsing — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X7 Silent fallback defaults — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 50 finding(s)
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
Serious — 15 finding(s)
D36 · Supply-chain Provenance & Signing
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D4 · Code Duplication
- Duplicated block (9 lines × 2) src/Encoding/MicrosecondBasedDateConversion.php:17
- Duplicated block (9 lines × 2) src/Validation/Constraint/LooseValidAt.php:24
D22 · Internal API Consistency
- Duplicate Builder creation paths with inconsistent signatures. The API exposes two distinct ways to instantiate a Builder: one via `Configuration.builder()` which takes an optional `ClaimsFormatter`, and another via `Token.Builder.new()` which requires an `Encoder` and a `ClaimsFormatter`. This creates confusion about which entry point to use and why the parameters differ.
D22 · Internal API Consistency
- Redundant Parser types and inconsistent return types for parsing. There are two distinct `Parser` types (`Lcobucci.JWT.Parser` and `Lcobucci.JWT.Token.Parser`) with identical signatures. Furthermore, `Parser.parse()` returns `Token`, while `JwtFacade.parse()` returns `UnencryptedToken`. Since `UnencryptedToken` appears to be a specific subtype or wrapper, this inconsistency in return types for 'parsing' operations is confusing.
D22 · Internal API Consistency
- Duplicate Validator types. `Lcobucci.JWT.Validation.Validator` and `Lcobucci.JWT.Validator` have identical method signatures (`assert` and `validate`). This suggests a namespace duplication or a copy-paste error in the API design, exposing the same functionality under two different fully qualified names.
D22 · Internal API Consistency
- Inconsistent parameter naming and type in `SignedWithOneInSet`. The constructor expects `SignedWithUntilDate` objects, but the name `SignedWithOneInSet` implies a set of `SignedWith` constraints. The parameter name `constraints` (plural) suggests an array or iterable, but the type is a single object `SignedWithUntilDate`. This is misleading.
D36 · Supply-chain Provenance & Signing
- REDACTED
Minor — 12 finding(s)
D34 · Knowledge Freshness
- Orphaned file src/Signer/Ecdsa/MultibyteStringConverter.php:1
- Orphaned file src/Token/Builder.php:1
- Orphaned file src/Builder.php:1
D16 · Bus Factor
- Off-boarding risk: anonymized user #1
D34 · Knowledge Freshness
- Orphaned files with no living knowledge
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D37 · Vulnerability-disclosure Policy
- REDACTED
M1 · Documentation (README)
- Thin README
M2 · Architecture documentation
- No ADRs
M2 · Architecture documentation
- No architecture diagram/doc
P6 · Release Hygiene
- No changelog
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-4d4bc2665f0b43b78fc30733d8d7f29d/history.json --exit-code 0 --source . | 1 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-4d4bc2665f0b43b78fc30733d8d7f29d/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 50 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | osv-scanner | — | osv-scanner --format json --recursive --experimental-disable-plugins transitivedependency/requirements --experimental-disable-plugins dotnet/csproj --experimental-disable-plugins dotnet/nugetcpm . | 0 | artifacts/raw/osv-scanner.json |
| D31 · IaC & Container Security | trivy | — | trivy: not applicable — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan. | 0 | — |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. semgrep could not parse 45 file(s) — `src/Configuration.php`, `src/Encoding/ChainedFormatter.php`, `src/Encoding/JoseEncoder.php`, `src/Encoding/MicrosecondBasedDateConversion.php`, `src/Encoding/UnifyAudience.php`, … (+40 more) — so the PII/GDPR sweep did not cover the unparsed regions of them; rows reported elsewhere in those files are real. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | osv-scanner | — | osv-scanner --format json --recursive --experimental-disable-plugins transitivedependency/requirements --experimental-disable-plugins dotnet/csproj --experimental-disable-plugins dotnet/nugetcpm . | 0 | artifacts/raw/osv-scanner.json |