Codebase Audit of an Open-Source Python Runtime

Status: Implemented. A real engineering audit I performed on my own public repository, continuity @ 0f83a15. It is not a security audit. Data shown is real, taken from the report.

A team inherits a repository with a green test suite and assumes it ships. At commit 0f83a15, all 525 of continuity's tests pass, yet the service as shipped does not start end to end. The image installs an empty package. The worker scripts have no entry point. Nothing creates the database schema, and the image has no git. The cost is the days a team spends finding this out in staging.

I audited continuity, my public AGPL-licensed Python runtime, at one commit. I measured its size, ran the tests with coverage, ran ruff and mypy, resolved the dependencies fresh and built the Docker image. The report has 16 findings: 6 High, 6 Medium and 4 Low. Each one cites a file and line and says whether I ran it or read it in the source.

I built one fix. The proposed Dockerfile runs as a non-root user, includes git and imports cleanly, and /v1/health returns ok. I built and smoke-tested it in a scratch copy only, and nothing is merged upstream. The report viewer on these screens is a design.

Codebase Rescue, Cleanup & Audits, from $400: a Repository Health Review of one repository, with prioritised findings, an action plan and one small agreed repair. A detailed audit like this one starts at $750.

Report summary: sixteen findings by severity; the first fix is Dockerfile lines 3 to 5.

Findings by area: all six High findings sit in deploy, database and correctness.

Proposed fix: the proposed Dockerfile, built and run: non-root, git present, imports clean.

Dependencies and tests: 525 tests pass at 76% coverage; four runtime dependencies are never imported.