Aller au contenu principal
Nicolas Cousin Tech SolutionsNicolas Cousin Tech Solutions

.NET code audit · Flash package

Bonobo Git Server, Flash audit, public case study

Cover of the Bonobo Git Server Flash audit report: grades Security D, Reliability B, Maintainability C, Architecture C, Tests D, Migrability D.
Download the report (PDF, 11 pages, in French)Request a Flash audit

The full report is in French. An English version is available on request. Request the English version

The audited project

Bonobo Git Server is an open source Git server built with ASP.NET MVC 5 (.NET Framework 4.6). Audited version: commit 6277ecf of March 5, 2021. Audit carried out on October 31, 2026.

See the project on GitHub

The grades

Each area is graded from A to E: A, no major issue; C, several major issues; E, a serious risk to fix before any production use.

  • D

    Security

    Password hashing and dependencies must be fixed first.

  • B

    Reliability

    Few defects confirmed by a recent analysis engine.

  • C

    Maintainability

    Readable code, but libraries copied into the repository and dead code.

  • C

    Architecture

    One controller carries too many responsibilities.

  • D

    Tests

    A healthy suite, but blind to authorisation and the Git protocol.

  • D

    Migrability

    Unsupported platform: moving to .NET 10 is a real project.

Key figures

  • 17,130 lines of C#
  • 331 tests
  • 1,202 tool alerts triaged
  • 10 finding sheets
  • 27 actions
  • 13 to do within 1 month

The 3 priority risks

  1. Passwords: Their hashing is too fast, and a legacy MD5 format is still accepted.

  2. Vulnerable components: 6 libraries have public vulnerabilities, including authentication and jQuery.

  3. Unsupported platform: .NET Framework 4.6 has been out of support since 2022, and the project no longer builds as is on an up-to-date machine.

What works well

  • No secrets in the Git history.
  • A well-tested data access layer.
  • Few reliability defects.

The method

  • JetBrains inspections
  • NuGet package vulnerabilities
  • Test coverage
  • Secret scanning
  • Code volume

Analysis tools run over the whole codebase first. I then read the code where the measurements point to a risk. Every finding cites a file and can be checked.

Flash guarantee

This report contains 27 actions.

What counts as an action?

Case study carried out on an open source project, as a demonstration of method, with no connection to the project's authors. The findings apply to the version cited.

The same report, on your code

Download the report (PDF, 11 pages, in French)Request a Flash audit

The full report is in French. An English version is available on request. Request the English version