Practical field notes on codebase health, technical debt, repo takeovers, AI-assisted engineering, and audit workflows.
August 8, 2026
6 min read
A release failed its own commit gate because the secrets scanner flagged the comment documenting the scanner. By midnight we had shipped four releases, and every block taught us something we fixed the same day. The fifth block was wrong, and why it was wrong matters just as much.
Read the note
August 7, 2026
7 min read
CodeTruss scored CodeTruss at 77 health and 50 security on exactly 14 HIGH findings. Adjudication threw out all 14, and then we found a live open redirect the scan never reported: a sanitizer that validated its input and returned its normalized output.
Read the note
August 7, 2026
12 min read
Eighteen merges to main in five hours, every commit pushed through the CodeTruss pre-commit gate. It blocked a credential-shaped test fixture, refused untrusted commands in every fresh worktree, surfaced two of its own bugs, and failed three production deploys out loud.
Read the note
August 6, 2026
7 min read
CodeTruss built a corpus of nine bugs AI agents actually write, detected six at the exact line, and swept the new rules across eight repositories for zero false positives. Here is the whole result, including the misses and the rule we had to split before shipping.
Read the note
August 6, 2026
9 min read
An independent public-source scan of jonradoff/lastsaas, a Go SaaS foundation built with Claude Code, shows how repository evidence becomes a fork release checklist — and why every automated security finding was rejected on manual review.
Read the note
August 6, 2026
7 min read
An independent public-source scan of nextjs/saas-starter shows the release work a deliberately minimal template assigns to every fork: tests, CI, webhook configuration, seed hygiene, and tracking upstream security fixes.
Read the note
July 16, 2026
8 min read
A redacted public-source field note on wasp-lang/open-saas shows how CodeTruss turns auth, billing, jobs, email, file upload, CI, and Playwright evidence into a release checklist.
Read the note
July 15, 2026
9 min read
An independent review of a pinned public repository shows how CodeTruss turns architecture and test signals into a release checklist—and why analyzer output still needs human judgment.
Read the note
July 14, 2026
8 min read
CodeTruss v0.1.1 signed PASS for a change that had not passed every check. We reproduced the flaw and retested the immutable-snapshot fix in v0.2.14.
Read the note
July 7, 2026
8 min read
A practical, step-by-step process for auditing an unfamiliar codebase: structure, dependencies, security hygiene, technical debt, and how AI can compress days of work into minutes.
Read the note
July 7, 2026
6 min read
Technical debt scores explained: how they are computed, what the research says about debt and delivery speed, and a concrete playbook for paying debt down without stopping feature work.
Read the note
July 7, 2026
5 min read
Code review tools primarily inspect change sets; codebase audits assess the whole system. Learn the difference, when each pays off, and how teams combine both.
Read the note
July 7, 2026
7 min read
A practical checklist for evaluating a client codebase before you quote, refactor, or accept maintenance responsibility.
Read the note
July 7, 2026
6 min read
Learn what a useful codebase architecture map includes: routes, models, modules, dependencies, jobs, external calls, and risk hotspots.
Read the note
July 7, 2026
6 min read
AI coding tools create more code faster, but teams still need architecture visibility, review discipline, and technical debt tracking.
Read the note
Prepared by CodeTruss — the deterministic first-pass gate for AI-written code.
Signed