Production-readiness scan · 2026-10-22
sindresorhus/is-plain-obj
Workable, with significant gaps to close.
PARTIAL Dependencies were read from manifests only; transitive packages were not checked.
Fix first
No lockfile committed
Dependency versions are declared as ranges, so two installs can resolve to different code and transitive dependencies could not be checked at all. Commit the lockfile your package manager produces.
No start command is declared anywhere
The repository has a server entrypoint but no start script, Procfile, Docker CMD or platform config saying how to run it. Buildpacks guess, and guess differently from each other, so the first deploy either starts the wrong process or none at all.
index.js
CI uses npm install without a committed lockfile
.github/workflows/main.yml runs npm install and no package-lock.json is present, so builds are non-reproducible and dependency drift can affect every CI run.
Nine dimensions
npm install without a committed lockfile and lacks release or provenance automation.sideEffects:false, files allowlist, and Node engine constraint keep the package boundary clean and predictable.sideEffects:false aid maintenance, however dependency ranges are unpinned and 71% of files were unanalyzed.Top findings (AI)
CI uses npm install without a committed lockfile
.github/workflows/main.yml runs npm install and no package-lock.json is present, so builds are non-reproducible and dependency drift can affect every CI run.
No automated dependency or code scanning configured
Only .github/security.md is present; no Dependabot, Renovate, CodeQL, Snyk or equivalent scanner is visible to detect vulnerable or malicious dependencies.
No release, publish or provenance automation
No publish workflow, signed release, or npm provenance configuration is visible, leaving the published artifact dependent on manual steps and unsigned.
Audit coverage is incomplete
Only 4 of 14 files (~29% of lines) were parsed for this assessment; the remaining 10 files, including tests and config, were not analyzed.
Report sections
Open a section for the evidence that drove the score. If you open one first, start with Code.
What this scan inspected
- every file scanned for secrets — 14 in total, none skipped
- 3 dependencies from manifests only — no lockfile, transitive deps unchecked
- deploy checks read 4 shipping file(s), 0 bind site(s) and 0 environment variable(s)
- code quality parsed 4 source file(s), 125 lines, ESLint over 4
- the AI scored from manifests and the file tree; it did not read source itself
- scoring policy: mode=one_shot, model= MiniMax-M3, rubric=d9ea679b9529
- scores adjusted by deterministic evidence: 1 lowered by deterministic ceilings, 1 raised by deterministic floors
Every section above links to the evidence behind it. Nothing on this page is asserted without a source.