Every review, at a glance
Prominent verdicts from the five downstream dashboards. Colour stripe on top signals health: green for pass, amber for watch, red for block. Click any card to drill in.
Eight rounds. One convergence.
Each row is a full external code + security review pass on this codebase. Grade shifts trace the fix trajectory: security lifted from B- to A, code held between B- and Approve. The latest row is the current state; earlier rows are historical.
| Round | Code | Security | Notable finding |
|---|---|---|---|
| #1 | B | B- | Silent excepts, prompt injection, CSP unsafe-inline |
| #2 | B- | B- | HTML injection into outbound email, SSRF, path traversal |
| #3 | B- | B | Clock injection, Feb-29 crash, CSP hardened on script-src |
| #4 | B- | B- | Content-Length cap placement was cosmetic; sibling caps missing |
| #5 | B- | B+ | Missed upload sites wired to cap helper; MAX_PAGES shared |
| #6 | B- | B | SMTP CRLF injection, PIL bomb guard, no-mutation refactor |
| #7 | B | A- | PAP intake rate-limit gap closed |
| #8Current | Approve | A | Open-redirect on ?next= guarded (CWE-601) |
Ship signal
The dashboards below all render a paper-stamp verdict. This card is the aggregate: approved only when every downstream verdict is green. Production readiness is tracked separately since it's an operational status, not a ship-review gate.
The stamp mirrors Verdikt's real product output. Same shape for every case Verdikt decides: verdict word, four meta fields, paper texture, wax-stamp accent. Consistency is the point.
Sources: dashboard-data.json, features-data.json, code-review-data.json, security-review-data.json, production-data.json.
By the count
Raw totals across the five surfaces: the numbers behind the verdicts.
Serve the folder
These pages fetch JSON with fetch(), which browsers block over file://. Serve reports/ over HTTP.
- python -m http.server 8765 --directory reports (then visit
http://localhost:8765/) - Rebuild test JSON: python reports/_gen_dashboard.py after a fresh pytest run
- Rebuild feature/code/security JSON: hand-edit. They're grounded in
docs/roadmap.mdand the ADRs, not scraped