#2954

feat(web-start): TanStack Start port of the website on Cloudflare Workers (experimental preview)

What changed

  • New package apps/web-start (@phaseo/web-start). It is the whole website rebuilt on TanStack Start 1.169 and running on Cloudflare Workers. apps/web is untouched, and nothing in this PR changes production.
  • Every route is ported: 347 route files, covering all pages, layouts, API route handlers, OG images, robots.txt and sitemap.xml.
  • New CI matrix entry web-start, which runs typecheck and build for the package.

Commit 9d16fb8b9d copies apps/web/src verbatim. To review only the port, use git diff 9d16fb8b9d HEAD -- apps/web-start/src (793 files, +13.8K/−3.3K), plus the files outside src.

Why

  • Cost. We want to know whether the site can leave Vercel for Workers at a lower cost without losing speed, and which framework makes that cheapest.

  • Earlier measurements on 2026-10-30 (same shared components, same live data, mean CPU per render):

    Framework1× page4× page
    vinext37 ms128 ms
    OpenNext22 ms46 ms
    TanStack Start9 ms22 ms
  • The alternatives didn't hold up on the full app.

    • vinext still needed 220–280 ms CPU per page after optimising.
    • OpenNext could not deploy at all: 113.7 MiB against the 64 MiB Worker limit.
  • This PR answers the question with the real app: the measured cost and speed are in Before and after below.

How

  • Next.js compatibility layer (src/compat). Vite aliases point next/link, next/navigation, next/image, next/dynamic, next/headers, next/server, next/og, next-intl, next-intl/server, flags/next and others at small shims. The copied components therefore mostly run unchanged.
  • Data loading. The 252 async server components became plain SSR:
    • Data comes through createServerFn in *.functions.ts, read with useSuspenseQuery.
    • setupRouterSsrQueryIntegration streams the results to the browser.
    • Route loaders prefetch, and handle redirects and not-founds before render.
  • Generated routes (scripts/codemods/generate-routes.mjs) wrap each Next page or layout and run its generateMetadata in a server function.
    • Catch-all segments become $.tsx files. A $/index.tsx splat matches an empty tail and shadowed the model page.
    • Redirect-only pages redirect in beforeLoad.
  • Request middleware (src/lib/start/requestMiddleware.ts, session.ts) replaces next.config.mjs redirects/headers and src/proxy.ts. It covers:
    • locale negotiation;
    • the Supabase session refresh;
    • proxies for /api/_web|account|chat|internal, /docs and /ingest;
    • markdown negotiation and the blog preview gate.
  • Server actions. "use server" modules become POST stubs to /api/server-actions. The endpoint checks the Origin and only calls registered exports.
  • Build plugins (build/phaseo-plugins.ts):
    • blog MDX is compiled at build time;
    • src/content is served from static assets through an fs shim;
    • the Geist font for OG images is inlined.
  • Worker memory. A Worker isolate holds every uploaded module's source within its 128 MB, and any file with one non-Latin1 character costs 2 bytes per character. The first deploy needed about 81 MB for source alone and took about 2 s to first byte. The fixes:
    • translations load from static assets;
    • Shiki and the docs search index stay out of the server bundle;
    • server chunks escape non-Latin1 text where that is smaller.
  • Trade-off: we return real 404s for unknown models and providers. Next streamed those as 200 with a not-found page.

Before and after

Method: 300 requests replaying the production page and locale mix at 1 request/s (seed 9). CPU comes from wrangler tail, and first byte is measured client-side from London. vinext was measured the same way on 2026-10-30, and the Vercel figure comes from that same session.

Metricvinext on Workers (optimised)TanStack Start on Workers (this PR)Change
Mean CPU per page220–280 ms (3 runs)104 msabout −55%
Median CPU per page165–217 ms70 msabout −60%
p90 CPU per page–257 ms–
Median first byte139–182 ms (Vercel: 84 ms, cached)141 msabout the same as vinext
p90 first byte–566 ms–
Errors0 / ~9000 / 300 (294 × 200, 6 × 404 retired providers)–
Server bundle21.8 MB29.6 MB (11.5 MB → 6.8 MB gzip after trimming)–
Estimated isolate source memory–80.7 MB → 29.8 MB after trimming−63%

Median CPU by page type: models 90 ms, rankings 153 ms, tools 285 ms, home 58 ms, api-providers 47 ms, benchmarks 31 ms, compare 28 ms, chat 17 ms.

Verification

  • pnpm --filter @phaseo/web-start typecheck: clean.
  • vite build: passes with and without the local env file, as CI will run it.
  • Parity against https://phaseo.app (scripts/parity-check.mjs, Playwright: status, title, visible text, console and page errors, error screen):
    • 50 of 58 sitemap route shapes, plus 11 of 12 extra locale checks (zh-Hans, ar-SA, ja, hi, fr-FR, de-DE, es-ES, pt-BR), match.
    • The remaining differences are all explained:
      • /pricing (and its locale versions) is missing the Enterprise section. It is behind a Statsig gate, and the Statsig server key is not set on the preview Worker.
      • Three methodology pages log missing-message errors. Prod has the same bug: phaseo.app shows raw translation keys as section headings.
      • /chat/image has a " | Phaseo" title suffix that prod omits because of a quirk in Next's title templates.
      • Unknown models and providers return a real 404 instead of 200.
  • Spot checks with curl: the redirects match prod, including retired model sub-paths, /docs, /en-GB/*, the social links, /chat/audio and /gateway/usage?tab=. sitemap.xml lists the same 2,745 URLs as prod.
  • Not verified:
    • Signed-in flows (settings, billing, server actions with a session) on the preview, since its workers.dev address is not an allowed auth origin.
    • Admin and internal pages.
    • Real browsers other than Playwright Chromium.
    • The web Jest suite, which is not configured for apps/web-start.
  • Review: sol-loop, 2 rounds with GPT-6.1 Sol. Round 1 found one blocker: unscoped account query keys would have made the session listener clear the cache and reload the page. It is fixed in 39ae0203c8, and round 2 approved.
  • No changeset: @phaseo/web-start is private and not published.

Reviewed with sol-loop: 2 rounds with gpt-6.1-sol on high. Sol verdict: approved

Model: Claude Opus 5.5 (effort unknown) · Harness: Claude Code in T3 Code

🤖 Generated with Claude Code

Activity

36
vercel[bot]2h ago

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated
phaseo ReadyPreviewOct 30, 2026 10:57pm UTC

chatgpt-codex-connector[bot]2h ago

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

ReviewStatusCommitReview trigger
📝 Code Review✅ Completed 2026-10-30T22:41:37.490762Z39ae020PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions[bot]2h ago

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

apps/web-start/package.json

PackageVersionLicenseIssue Type
@phaseo/app-kitworkspace:*NullUnknown License
@phaseo/uiworkspace:*NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/katex 0.16.47:green_circle: 4.3
Details
CheckScoreReason
Security-Policy:green_circle: 10security policy file detected
Dangerous-Workflow:warning: 0dangerous workflow patterns detected
Code-Review:green_circle: 5Found 12/21 approved changesets -- score normalized to 5
Maintained:green_circle: 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts:green_circle: 10no binaries found in the repo
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Fuzzing:warning: 0project is not fuzzed
Packaging:warning: -1packaging workflow not detected
License:green_circle: 10license file detected
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases:warning: 0Project has not signed or included provenance with any releases.
Branch-Protection:warning: -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST:green_circle: 10SAST tool is run on all commits
npm/@1password/save-button ^1.3.0 UnknownUnknown
npm/@base-ui/react ^1.3.0 UnknownUnknown
npm/@cloudflare/vite-plugin ^1.65.0 UnknownUnknown
npm/@dnd-kit/core ^6.3.1 UnknownUnknown
npm/@dnd-kit/sortable ^10.0.0 UnknownUnknown
npm/@dnd-kit/utilities ^3.2.2 UnknownUnknown
npm/@dqbd/tiktoken ^1.0.22 UnknownUnknown
npm/@eslint/eslintrc ^3 UnknownUnknown
npm/@flags-sdk/statsig ^0.2.5 UnknownUnknown
npm/@fontsource-variable/montserrat 5.3.0 UnknownUnknown
npm/@fontsource-variable/noto-sans-arabic 5.3.0 UnknownUnknown
npm/@fontsource-variable/noto-sans-devanagari 5.3.0 UnknownUnknown
npm/@fontsource-variable/noto-sans-jp 5.3.1 UnknownUnknown
npm/@fontsource-variable/noto-sans-sc 5.3.1 UnknownUnknown
npm/@formatjs/icu-messageformat-parser 3.5.21:green_circle: 4.2
Details
CheckScoreReason
Code-Review:warning: 0Found 0/28 approved changesets -- score normalized to 0
Maintained:green_circle: 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
License:warning: 0license file not detected
Fuzzing:warning: 0project is not fuzzed
Branch-Protection:green_circle: 3branch protection is not maximal on development and all release branches
Signed-Releases:warning: -1no releases found
Security-Policy:warning: 0security policy file not detected
Packaging:green_circle: 10packaging workflow detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/@hookform/resolvers ^5.7.1 UnknownUnknown
npm/@mdx-js/mdx 3.1.1:green_circle: 4.4
Details
CheckScoreReason
Maintained:green_circle: 32 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 3
Code-Review:green_circle: 4Found 13/28 approved changesets -- score normalized to 4
Packaging:warning: -1packaging workflow not detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies:green_circle: 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Security-Policy:green_circle: 10security policy file detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/@number-flow/react ^0.6.2 UnknownUnknown
npm/@octokit/rest ^22.0.1 UnknownUnknown
npm/@openuidev/react-lang 0.3.2 UnknownUnknown
npm/@phaseo/app-kit workspace:* UnknownUnknown
npm/@phaseo/ui workspace:* UnknownUnknown
npm/@playwright/test ^1.62.1 UnknownUnknown
npm/@react-three/drei ^10.7.9 UnknownUnknown
npm/@react-three/fiber ^9.6.1 UnknownUnknown
npm/@rive-app/react-webgl2 ^4.36.0 UnknownUnknown
npm/@shadcn/react 0.3.1 UnknownUnknown
npm/@shikijs/colorized-brackets ^4.3.1 UnknownUnknown
npm/@statsig/js-client ^3.33.5 UnknownUnknown
npm/@statsig/react-bindings ^3.33.5 UnknownUnknown
npm/@statsig/session-replay ^3.33.5 UnknownUnknown
npm/@statsig/web-analytics ^3.33.5 UnknownUnknown
npm/@streamdown/math ^1.0.2 UnknownUnknown
npm/@stripe/react-stripe-js ^6.3.0 UnknownUnknown
npm/@stripe/stripe-js ^9.7.0 UnknownUnknown
npm/@supabase/ssr ^0.12.7 UnknownUnknown
npm/@supabase/supabase-js ^2.112.4 UnknownUnknown
npm/@tailwindcss/vite 4.3.3:green_circle: 7
Details
CheckScoreReason
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Maintained:green_circle: 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Code-Review:green_circle: 6Found 18/30 approved changesets -- score normalized to 6
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:green_circle: 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies:green_circle: 10all dependencies are pinned
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Security-Policy:warning: 0security policy file not detected
License:green_circle: 10license file detected
Fuzzing:green_circle: 10project is fuzzed
Branch-Protection:warning: -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases:warning: 0Project has not signed or included provenance with any releases.
Packaging:green_circle: 10packaging workflow detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/@tanstack/react-query 5.104.5 UnknownUnknown
npm/@tanstack/react-router 1.170.46 UnknownUnknown
npm/@tanstack/react-router-ssr-query 1.167.3 UnknownUnknown
npm/@tanstack/react-start 1.169.4 UnknownUnknown
npm/@tanstack/react-table ^8.21.3 UnknownUnknown
npm/@tanstack/react-virtual ^3.14.6 UnknownUnknown
npm/@types/jest ^30.0.0 UnknownUnknown
npm/@types/node ^26 UnknownUnknown
npm/@types/react 19.3.0:green_circle: 6.6
Details
CheckScoreReason
Code-Review:green_circle: 9Found 28/30 approved changesets -- score normalized to 9
Packaging:warning: -1packaging workflow not detected
Maintained:green_circle: 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Security-Policy:green_circle: 10security policy file detected
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 9license file detected
Branch-Protection:warning: -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases:warning: -1no releases found
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:green_circle: 8dependency not pinned by hash detected -- score normalized to 8
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
npm/@types/react-dom 19.3.0:green_circle: 6.6
Details
CheckScoreReason
Code-Review:green_circle: 9Found 28/30 approved changesets -- score normalized to 9
Packaging:warning: -1packaging workflow not detected
Maintained:green_circle: 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Security-Policy:green_circle: 10security policy file detected
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 9license file detected
Branch-Protection:warning: -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases:warning: -1no releases found
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:green_circle: 8dependency not pinned by hash detected -- score normalized to 8
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
npm/@types/three ^0.184.0 UnknownUnknown
npm/@typescript/native catalog: UnknownUnknown
npm/@upstash/ratelimit ^2.0.6 UnknownUnknown
npm/@upstash/redis ^1.39.0 UnknownUnknown
npm/@vercel/og 1.0.3 UnknownUnknown
npm/@vitejs/plugin-react 6.1.2:green_circle: 7.4
Details
CheckScoreReason
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Code-Review:green_circle: 5Found 11/20 approved changesets -- score normalized to 5
Packaging:warning: -1packaging workflow not detected
Maintained:green_circle: 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions:green_circle: 8detected GitHub workflow tokens with excessive permissions
Binary-Artifacts:green_circle: 10no binaries found in the repo
Pinned-Dependencies:green_circle: 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Security-Policy:green_circle: 10security policy file detected
Branch-Protection:green_circle: 3branch protection is not maximal on development and all release branches
SAST:green_circle: 10SAST tool is run on all commits
npm/@xyflow/react ^12.11.1 UnknownUnknown
npm/ai ^6.0.168 UnknownUnknown
npm/ajv ^8.20.0 UnknownUnknown
npm/ajv-formats ^3.0.1 UnknownUnknown
npm/baseline-browser-mapping ^2.9.0 UnknownUnknown
npm/cheerio ^1.1.2 UnknownUnknown
npm/class-variance-authority ^0.7.1 UnknownUnknown
npm/cmdk ^1.1.1 UnknownUnknown
npm/cn ^0.2.4 UnknownUnknown
npm/date-fns ^4.4.0 UnknownUnknown
npm/dotenv ^17.4.2 UnknownUnknown
npm/drizzle-kit ^0.31.11 UnknownUnknown
npm/echarts ^6.1.0 UnknownUnknown
npm/echarts-for-react ^3.0.2 UnknownUnknown
npm/embla-carousel-react ^8.6.0 UnknownUnknown
npm/eslint ^10.13.0 UnknownUnknown
npm/fast-xml-parser ^5.11.2 UnknownUnknown
npm/flags ^4.1.0 UnknownUnknown
npm/fuse.js ^7.5.0 UnknownUnknown
npm/glicko2 ^1.2.1 UnknownUnknown
npm/google-play-scraper ^10.0.1 UnknownUnknown
npm/html-to-image 1.11.13:green_circle: 3.4
Details
CheckScoreReason
Code-Review:warning: 0Found 0/29 approved changesets -- score normalized to 0
Maintained:warning: 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
License:green_circle: 10license file detected
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Signed-Releases:warning: -1no releases found
SAST:green_circle: 10SAST tool is run on all commits
Security-Policy:warning: 0security policy file not detected
npm/i18n-iso-countries ^7.14.0 UnknownUnknown
npm/input-otp ^1.4.2 UnknownUnknown
npm/jest 30.2.0 UnknownUnknown
npm/jest-environment-jsdom 30.5.2 UnknownUnknown
npm/jest-environment-node 30.4.1 UnknownUnknown
npm/js-yaml ^4.2.0 UnknownUnknown
npm/jspdf ^4.2.1 UnknownUnknown
npm/jspdf-autotable ^5.0.8 UnknownUnknown
npm/jszip ^3.10.1 UnknownUnknown
npm/lucide-react ^1.17.0 UnknownUnknown
npm/motion ^13.1.1 UnknownUnknown
npm/nanoid ^6.0.1 UnknownUnknown
npm/next-themes ^0.4.6 UnknownUnknown
npm/nuqs ^2.10.1 UnknownUnknown
npm/obscenity ^0.4.6 UnknownUnknown
npm/octokit ^5.0.5 UnknownUnknown
npm/postcss ^8 UnknownUnknown
npm/postgres ^3.4.9 UnknownUnknown
npm/posthog-js ^1.372.10 UnknownUnknown
npm/posthog-node ^5.28.0 UnknownUnknown
npm/react 19.3.0 UnknownUnknown
npm/react-day-picker ^10.0.1 UnknownUnknown
npm/react-dom 19.3.0 UnknownUnknown
npm/react-fast-marquee ^1.6.5 UnknownUnknown
npm/react-hook-form ^7.81.0 UnknownUnknown
npm/react-markdown ^10.1.0 UnknownUnknown
npm/react-resizable-panels ^4.12.4 UnknownUnknown
npm/recharts ^3.10.1 UnknownUnknown
npm/rehype-raw ^7.0.0 UnknownUnknown
npm/rehype-sanitize ^6.0.0 UnknownUnknown
npm/remark-breaks ^4.0.0 UnknownUnknown
npm/remark-gfm ^4.0.1 UnknownUnknown
npm/resend ^6.12.4 UnknownUnknown
npm/shadcn ^4.12.0 UnknownUnknown
npm/shiki ^4.4.3 UnknownUnknown
npm/sonner ^2.0.7 UnknownUnknown
npm/streamdown ^2.5.0 UnknownUnknown
npm/stripe ^22.1.0 UnknownUnknown
npm/tailwindcss ^4 UnknownUnknown
npm/tailwindcss-animate ^1.0.7 UnknownUnknown
npm/thinking-orbs 0.3.1 UnknownUnknown
npm/three ^0.184.0 UnknownUnknown
npm/tokenlens ^1.3.1 UnknownUnknown
npm/tsx ^4.23.13 UnknownUnknown
npm/tw-animate-css ^1.4.0 UnknownUnknown
npm/typescript catalog: UnknownUnknown
npm/typescript-eslint ^8.60.0 UnknownUnknown
npm/use-intl 4.13.7:green_circle: 4.2
Details
CheckScoreReason
Maintained:green_circle: 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Code-Review:warning: 1Found 5/30 approved changesets -- score normalized to 1
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts:green_circle: 9binaries present in source code
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Security-Policy:warning: 0security policy file not detected
License:green_circle: 10license file detected
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing:warning: 0project is not fuzzed
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Signed-Releases:warning: -1no releases found
Packaging:green_circle: 10packaging workflow detected
SAST:warning: 0SAST tool is not run on all commits -- score normalized to 0
npm/use-stick-to-bottom ^1.1.6 UnknownUnknown
npm/vaul ^1.1.2 UnknownUnknown
npm/vite 8.3.4:green_circle: 6.5
Details
CheckScoreReason
Code-Review:green_circle: 5Found 13/24 approved changesets -- score normalized to 5
Maintained:green_circle: 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Packaging:warning: -1packaging workflow not detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Security-Policy:green_circle: 10security policy file detected
Token-Permissions:green_circle: 7detected GitHub workflow tokens with excessive permissions
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts:warning: 1binaries present in source code
Pinned-Dependencies:green_circle: 9dependency not pinned by hash detected -- score normalized to 9
License:green_circle: 10license file detected
Fuzzing:warning: 0project is not fuzzed
Signed-Releases:warning: -1no releases found
Branch-Protection:green_circle: 4branch protection is not maximal on development and all release branches
SAST:green_circle: 10SAST tool is run on all commits
npm/wrangler ^4.152.0 UnknownUnknown
npm/ws ^8.21.0 UnknownUnknown
npm/zod ^4.6.7 UnknownUnknown

Scanned Files

  • apps/web-start/package.json
DanielButler12h ago

Closing: this was an experiment to measure whether the website could move to Cloudflare Workers. The measurements are in the description above, and the branch stays as a reference.

github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
github-advanced-security[bot]reviewed2h ago
admin closed this pull request2h ago

This pull request was closed without being merged. Branch feat/web-tanstack-start-20261030 is still available.