Repo brief: pglombardo/PasswordPusher

Generated by RepoPilot · document generated 2026-09-14 · concise human review Evidence snapshot · analyzed 2026-09-14T22:02:36.443Z · commit 1ca276271bd7

Verdict

Healthy — Strong maintenance signals

• Last commit today
• 5 active contributors
• Apache-2.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Password Pusher is a Ruby on Rails web application that securely shares sensitive information (passwords, text, files, URLs) via self-deleting links with automatic expiration by view count and/or time duration. It provides encrypted storage, optional passphrase protection, and comprehensive audit logging to track access; recipients receive one-time links that expire and are permanently removed after conditions are met. Monolithic Rails application with asset pipeline configuration (app/assets/config/manifest.js), localized image assets for multi-language support (app/assets/images/features/), and a standard Rails structure. The codebase is 1,028,479 lines of Ruby (primary), augmented by…

Start here

Open these first:

• app/controllers/api/v1/pushes_controller.rb — V1 API endpoint for creating and retrieving password pushes; primary integration point for external clients.
• app/controllers/api/v2/pushes_controller.rb — V2 API endpoint with improved payload handling; shows evolution of the core push creation/retrieval logic.
• app/controllers/base_controller.rb — Base controller that likely defines authentication, authorization, and cross-cutting concerns for all endpoints.
• app/controllers/concerns/set_push_attributes.rb — Shared concern for normalizing push parameters across controllers; critical for consistent push configuration.
• app/assets/config/manifest.js — Asset pipeline configuration defining how Rails serves static assets and compiled bundles.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone the repository, verify the presence of Gemfile for Ruby dependencies (standard Rails), then run bundle install to install gems. A Procfile is present (88 bytes), suggesting Heroku or Procfile-compatible deployme…

Daily commands:

Exact commands cannot be provided without viewing Gemfile or bin/ scripts, but standard Rails convention is: bundle install && bundle exec rails db:create db:migrate && bundle exec rails server. Docker users: `docker…

…shortened for this brief.

Key cautions & unknowns

• Concentrated ownership — top contributor handles 68% of recent commits
• Scorecard: default branch unprotected (0/10)
• The repository data does not include Gemfile, Gemfile.lock, config files, or environment variable documentation—verify these before running setup. The ephemeral Docker variant (pwpush-ephemeral) suggests two deployment…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.