DSpace/DSpace · audit

Loading report…

DSpace/DSpace · audit — nittim

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

A finite, ranked list — highest-severity, lowest-effort blockers first. Clear these and the verdict lifts.A short, ranked list — the most serious, easiest-to-fix problems first. Clear these and the verdict improves.Ranked by severity and effort. Clear these and the verdict lifts.

Hardcoded database credentials in committed docker-compose.yml

MediumInfrastructure & DevOpsdocker-compose.ymlSmall (hours)Quick (a few hours)Small (hours)

EvidenceWhat we foundEvidence: docker-compose.ymlsets POSTGRES_USER: dspace / POSTGRES_PASSWORD: dspace and db__P__url pointing at dspacedb; ports 5432 and 8080/8000 published.
Business impactWhy it mattersImpact: If this compose file is copied into a production or internet-exposed deployment unchanged, the well-known dspace/dspace database credentials and exposed ports become a trivial compromise vector.
Root causeWhy it happensCause: Development-oriented compose file with static credentials committed to the repository without a clear production separation.
Recommended fixHow to fix itFix: Parameterize credentials via required environment variables/secrets with no defaults, clearly label the compose file as development-only, and provide a hardened production example that does not publish DB ports.

RemediationHow to fix itRemediationSmall (hours)Quick (a few hours)Small (hours)

Useful?

SSRF surface in bulk/item import via remote URL and FTP fetch, only conditionally mitigated

MediumSecuritydspace-api/src/main/java/org/dspace/app/bulkimport/util/ImportFileUtil.javaMedium (1–3d)Medium (1–3 days)Medium (1–3d)

EvidenceWhat we foundEvidence: dspace-api/src/main/java/org/dspace/app/bulkimport/util/ImportFileUtil.java(getInputStreamOfRemoteFile/getInputStreamOfFtpFile call url.openStream(); isHostAllowed returns true when allowed.ips.import is unset/empty) and dspace-api/src/main/java/org/dspace/app/itemimport/ItemImport.java readZip() uses `new URL(zipfilename).openStream()` for remote imports.
Business impactWhy it mattersImpact: An authorized importer could cause the server to fetch attacker-chosen internal URLs (cloud metadata endpoints, internal services), enabling internal reconnaissance or data exfiltration if the allow-list is not configured (the default is no restriction).

Entire CSV upload held in memory and stored in HTTP session

MediumPerformance & Scalabilitydspace-api/src/main/java/org/dspace/app/bulkedit/DSpaceCSV.javaLarge (1–2wk)Big (1–2 weeks)Large (1–2wk)

EvidenceWhat we foundEvidence: dspace-api/src/main/java/org/dspace/app/bulkedit/DSpaceCSV.javaclass comment explicitly questions putting the full CSV into a user's session and holding the whole upload in memory; DSpaceCSV implements Serializable and buffers all lines in a List.
Business impactWhy it mattersImpact: Large bulk-edit CSV imports can exhaust heap and bloat session storage, degrading availability under concurrent or large imports.
Root causeWhy it happensCause: Design choice to buffer the full CSV in memory and make it session-serializable rather than streaming.

Everything else we foundEverything else we noticedEverything else

6 more findings across 5 dimensions — none blocking, all worth a look.6 more problems across 5 categories — none blocking, all worth a look.6 more findings — none blocking.

9Findings in allTotal problems foundAll findings

4Medium

5Low

Security
Priority: Core2 findings

Test Docker image enables remote JDWP debugging on a wildcard address · pull_request_target workflows perform unsafe checkout of forked PR code

How we scored it

Five component scores roll up into the one number — and the verdict is held to the evidence, not to how the write-up reads.Five scores combine into the one overall number — and the verdict is checked against the actual evidence, not just how the write-up sounds.Five scores roll into one number. The verdict is held to the evidence, not the write-up.

Production ReadinessReady for real usersProduction Readiness78

Security71

Privacy70

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

We read the highest-priority 4% of your repository. This verdict covers only that — here is the record of which files, which modules, and what the snapshot was.We checked the highest-priority 4% of your project's code. This verdict covers only that — here is the record of which files, which checks, and what copy of the code was used.Read the highest-priority 4% of your repo. Record of files, modules, and snapshot below.

Audit CoverageHow Much We CheckedCoverage

4%220/4781 files audited220/4781 files checked220/4781 files

220 of 4781 files were audited. This audit's size or file-count limit was reached, so some source and configuration files were left unread. The denominator counts every file in the repository — images, generated output, vendored and build directories included.

This audit's size limit was reached before it read the whole repository. The verdict and every score on this report were computed from what it did read — read them as evidence about that sample, not a clean bill of health for the rest.

The AI-generated likelihood estimate is based on 4% of repository files (220/4781) — read it cautiously. The audited files were selected by priority, but a large portion of the repository was not seen.

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

The executive summary, as Claude wrote it. Evidence, scores and the verdict are computed by nittim.The summary, as Claude wrote it. The evidence, scores and verdict are computed by nittim, not by Claude.Claude wrote this summary. nittim computes the evidence, scores, and verdict.

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Claude says

Evidence, scores, and the verdict above are computed by nittim. The written read below — this summary and every finding’s narrative — is Claude’s.The evidence, scores, and the verdict above are computed by nittim. The written explanation below — this summary and every finding’s write-up — is Claude’s, the AI assistant that reviewed your code.nittim computes the evidence, scores, and verdict. Claude writes the summary below.

DSpace is a large, mature, widely-deployed open-source Java digital asset management / institutional repository platform. The audited snapshot (220 of 4781 files) shows a well-structured, service-oriented codebase with clear factory/service abstractions, a robust GitHub Actions CI/CD pipeline (unit + integration tests, CodeQL scanning, multi-arch Docker builds), and consistent licensing headers and authorship attribution typical of a long-lived, human-authored project. Deterministic scanners found no hardcoded secrets and no known-vulnerable declared dependencies. The codebase is clearly production-grade in intent and maturity; findings center on operational hygiene (dev-oriented Docker defaults committed to the repo), a server-side request forgery (SSRF) surface in the bulk/item import URL/FTP fetch paths that is only conditionally mitigated by an allow-list, in-memory handling of entire CSV uploads held in HTTP session, and localized code-quality defects (e.g., a misuse of Long.getLong for a query offset). Because this is an established open-source product intentionally published, there is little defensible proprietary IP at stake. Note: the snapshot was heavily truncated, so absence-based conclusions are scoped to audited files only.

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Security71

weightimportanceweight

Privacy70

weightimportanceweight

Production ReadinessReady for real usersProduction Readiness78

weightimportanceweight

ArchitectureHow the code is put togetherArchitecture72

weightimportanceweight

Weighted blend of 4 dimensions → ~73/100. Dimensions are weighted by importance (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting and precise scoring are proprietary, while the verdict is computed on exact internal values.4 categories combine into ~73/100. Some categories count for more than others (Security and Privacy count the most). The published numbers are approximate; nittim's exact math is kept private, while the verdict itself is worked out from the exact internal numbers.Weighted blend of 4 dimensions → ~73/100 (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting is proprietary. The verdict runs on exact internal values.
IP Protection is an independent IP-defensibility lens and is excluded from this blend.IP Protection (checking whether your ideas are exposed) is judged separately and isn’t part of this combined number.IP Protection is judged separately, excluded from this blend.
Scores are a judgement, not a measurement: a re-audit of the same commit can land a few points either side of this figure. The evidence underneath it is deterministic — the same commit always yields the same committed-secret and vulnerable-dependency findings.Scores are a judgment call, not an exact measurement: checking the same saved snapshot of your code twice can land a few points either side of this number. The evidence underneath it is not — the same snapshot always turns up the same passwords-in-code and known-security-bug findings.Scores are a judgment, not a measurement — a re-audit can land a few points either side. The evidence underneath is deterministic: the same commit always yields the same secret and vulnerable-dependency findings.
Each score is the model's overall assessment of the dimensions it covers, across everything it reviewed — not a tally of the findings in this report. Findings are the subset worth acting on, so a score can sit above or below what the listed findings alone would suggest.Each score is the AI's overall judgment of everything it reviewed in that category — not a count of the problems listed in this report. The listed problems are the ones worth acting on, so a score can sit above or below what they alone would suggest.Each score is the model's overall assessment across everything it reviewed — not a tally of this report's findings. A score can sit above or below what the findings alone suggest.

Production Ready with Conditions — fix 3 things before you ship.Production Ready with Conditions — fix 3 things before you make it live.Production Ready with Conditions — fix 3 things before you ship.

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

Hardcoded database credentials in committed docker-compose.yml

SSRF surface in bulk/item import via remote URL and FTP fetch, only conditionally mitigated

Entire CSV upload held in memory and stored in HTTP session

Everything else we foundEverything else we noticedEverything else

Security
Priority: Core2 findings

Security

How we scored it

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

Audit CoverageHow Much We CheckedCoverage

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Test Docker image enables remote JDWP debugging on a wildcard address

pull_request_target workflows perform unsafe checkout of forked PR code

Privacy & Compliance
Priority: Core1 finding

Privacy & Compliance

Personal data (EPerson emails/identity) handled without visible data-governance controls in snapshot

Reliability & Resilience
Priority: Core1 finding

Reliability & Resilience

Import/export flows swallow or stack-trace-print some errors instead of structured handling

Code Quality & Architecture
Priority: Important1 finding

Code Quality & Architecture

Misuse of Long.getLong for pagination offset in search export

Maintainability Forecast
Priority: Specialized1 finding

Maintainability Forecast

Very large god-classes concentrate complexity and raise maintenance cost

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Where this score sits on nittim's production-readiness scaleWhere this score falls on nittim's “is it ready to ship” scaleThis score's spot on nittim's scale.

Modules run (16)

Production Ready with Conditions — fix 3 things before you ship.Production Ready with Conditions — fix 3 things before you make it live.Production Ready with Conditions — fix 3 things before you ship.

3 things to fix before you ship3 things to fix before you launch3 things to fix before you ship

Hardcoded database credentials in committed docker-compose.yml

SSRF surface in bulk/item import via remote URL and FTP fetch, only conditionally mitigated

Entire CSV upload held in memory and stored in HTTP session

Everything else we foundEverything else we noticedEverything else

SecurityPriority: Core2 findings

Security

How we scored it

What we read — and what we didn’tWhat we checked — and what we didn’tWhat we read — and didn’t

Audit CoverageHow Much We CheckedCoverage

In the model’s wordsWhat the AI wrote, in its own wordsThe model's words

executive summary · in the model’s wordssummary · in the AI’s own wordssummary · in the model's words

Test Docker image enables remote JDWP debugging on a wildcard address

pull_request_target workflows perform unsafe checkout of forked PR code

Privacy & CompliancePriority: Core1 finding

Privacy & Compliance

Personal data (EPerson emails/identity) handled without visible data-governance controls in snapshot

Reliability & ResiliencePriority: Core1 finding

Reliability & Resilience

Import/export flows swallow or stack-trace-print some errors instead of structured handling

Code Quality & ArchitecturePriority: Important1 finding

Code Quality & Architecture

Misuse of Long.getLong for pagination offset in search export

Maintainability ForecastPriority: Specialized1 finding

Maintainability Forecast

Very large god-classes concentrate complexity and raise maintenance cost

How the executive score is composedHow the overall score is put togetherHow the exec score is composed

Where this score sits on nittim's production-readiness scaleWhere this score falls on nittim's “is it ready to ship” scaleThis score's spot on nittim's scale.

Modules run (16)

Security
Priority: Core2 findings

Privacy & Compliance
Priority: Core1 finding

Reliability & Resilience
Priority: Core1 finding

Code Quality & Architecture
Priority: Important1 finding

Maintainability Forecast
Priority: Specialized1 finding