Evidence, scores, and the verdict above are computed by nittim. The written read below — this summary and every finding’s narrative — is Claude’s.The evidence, scores, and the verdict above are computed by nittim. The written explanation below — this summary and every finding’s write-up — is Claude’s, the AI assistant that reviewed your code.nittim computes the evidence, scores, and verdict. Claude writes the summary below.

This is the public monorepo for supabase/supabase — a large, mature, professionally engineered open-source platform (Postgres development platform, Studio dashboard, docs site, design system, edge functions). The snapshot covers CI/CD workflows, the docs Next.js app, the design system, and supporting tooling. Overall engineering quality is very high: pinned GitHub Action SHAs, sparse checkouts with persist-credentials:false, careful internal/external PR security separation in docs-lint workflows, GraphQL query depth/complexity limiting, SSRF-hardened markdown route resolution, Zod validation, and comprehensive test suites. No live production secrets or known-vulnerable dependencies were flagged by the scanners. The two JWT hits are public anon keys committed intentionally to apps/docs/.env.development (documented as publicly available, non-secret) — informational only. As an open-source product, code-vector IP exposure is by design and not a defect. The most notable findings are minor: a likely bug in a workflow's curl payload using single-quoted shell interpolation, broad write permissions on some bot workflows, and the usual maintainability burden of a 16k-file monorepo. The audit was conducted on a heavily truncated snapshot (220 of 16,031 files), so coverage of the core Studio app, edge functions, and database migrations is limited; findings are scoped accordingly.