Why it exists
Most tools in this space read one diff at a time. That is enough to catch a typo and not enough to notice that a constant is duplicated across two services, or that the function being changed has callers in a repository nobody in the review has open. The index is the part that makes the second kind of answer possible, and once it exists, questions and reviews and dependency audits stop being separate products.
It runs on your own machine. That is a deliberate constraint rather than a feature: the people who most need to ask questions about a codebase are often the ones least able to send it to a third party.
What we try not to do
The benchmark position on the front page is unflattering and stays that way, with the reason it is a poor measure of this particular product stated next to it rather than instead of it. The dependency audit reports what it did not check as prominently as what it did, because an unchecked ecosystem reports zero vulnerabilities exactly like a clean one. And the evidence pack refuses to claim regulatory compliance on your behalf, in its own output.
If you find a place where the software or these pages overclaim, that is a bug worth reporting, and one we will fix.
Getting in touch
- Email kostiantynmakoid@gmail.com Questions, use cases, or anything that does not belong in a public issue.
- LinkedIn constantine-makoid Where most of the writing about this project is posted first.
- Security kostiantynmakoid@gmail.com Same address, with security in the subject. Please do not open a public issue for an unpatched vulnerability.
Reporting a vulnerability
If you find a security problem in Celmis, write to kostiantynmakoid@gmail.com with security in the subject line. Include what you did, what happened, and the version you were running — the footer of any running instance carries the exact commit.
You will get an acknowledgement within three working days. Once a fix is available, the advisory and the fix are published together; if you would like to be credited, say so and you will be.
Please do not file an unpatched vulnerability as a public issue, and please do not test against anyone else's running instance.
Licence
Celmis is released under the GNU Affero General Public License v3.0, with one exception noted in the licence file. In practice: you may run it, read it, modify it and deploy it, including commercially — and if you run a modified version as a network service, the people using that service are entitled to your modified source.