Production-readiness scan · 2026-09-21
sindresorhus/is-plain-obj
Workable, with significant gaps to close.
PARTIAL Dependencies were read from manifests only; transitive packages were not checked.
Fix first
No lockfile committed
Dependency versions are declared as ranges, so two installs can resolve to different code and transitive dependencies could not be checked at all. Commit the lockfile your package manager produces.
No start command is declared anywhere
The repository has a server entrypoint but no start script, Procfile, Docker CMD or platform config saying how to run it. Buildpacks guess, and guess differently from each other, so the first deploy either starts the wrong process or none at all.
index.js
No lockfile committed alongside the manifest
package.json declares devDependency ranges but no package-lock.json ships in the tree, so CI's npm install resolves a fresh tree each run and the package's own build reproducibility depends on npm registry timing.
Nine dimensions
Top findings (AI)
No lockfile committed alongside the manifest
package.json declares devDependency ranges but no package-lock.json ships in the tree, so CI's npm install resolves a fresh tree each run and the package's own build reproducibility depends on npm registry timing.
Test file does not follow a discoverable naming pattern
The header reports zero test files even though test.js exists at repo root. The file lacks the conventional .test.js suffix or __tests__/ directory, meaning downstream tooling, coverage reporters, and CI dashboards that key off standard patterns will silently skip it.
Only 29% of repository files were directly parsed for code review
Of the 14 files in the tree, only 4 JS/TS source files (125 lines) were analysed; the rest were unparsed. No defects were found in what was read, but benchmark.js, the type-test file, and other paths were not measured.
Report sections
Open a section for the evidence that drove the score. If you open one first, start with Code.
What this scan inspected
- every file scanned for secrets — 14 in total, none skipped
- 3 dependencies from manifests only — no lockfile, transitive deps unchecked
- deploy checks read 4 shipping file(s), 0 bind site(s) and 0 environment variable(s)
- code quality parsed 4 source file(s), 125 lines, ESLint over 4
- the AI scored from manifests and the file tree; it did not read source itself
- scoring policy: mode=one_shot, model= MiniMax-M3, rubric=d9ea679b9529
- scores adjusted by deterministic evidence: 1 lowered by deterministic ceilings, 1 raised by deterministic floors
Every section above links to the evidence behind it. Nothing on this page is asserted without a source.