- Author
- Not stated (GitHub user notactuallytreyanastasio)
- Published
- Undated
- Kind
- GitHub README for a code repository, with a self-written security analysis
- Original
- github.com/notactuallytreyanastasio/alloy
- Subject
- Programming languages and types
What it is
The repository holds the ORM source, the CI setup and demo apps. The README gives the architecture, build steps, API summary and security notes.
What it says
- Alloy is an ORM written in Temper and compiled to 6 targets.
- A push to main builds the ORM, runs JavaScript tests and publishes six library repos.
- Each library push triggers a workflow that updates the matching demo app.
- Table and column names must pass safeIdentifier, which validates them against a letter-and-underscore pattern.
- User values go through typed SqlPart classes, with strings quote-escaped, instead of being concatenated.
- Update and delete queries refuse to build with an empty WHERE clause.
- The README admits the ORM renders escaped SQL, not parameterized queries, and rates this informational.
What evidence it gives
The README reports 184 passing tests, six demo apps, and a table of six findings. Three findings are resolved, one is acknowledged and two are new. The security claims rest on the project's own analysis.
Interests and limits
The security assessment is by the project itself, not an independent audit. The README says the ORM builds escaped SQL instead of using parameterized queries. Linked per-app reports and the research file were not read. Demo apps were not run.