Invio - Moses Yebei

The Problem

Invio targets small businesses and freelancers who need invoicing without SaaS lock-in. The pain point is concrete: hosted invoicing tools charge monthly fees, hold customer data hostage, and force clients through account creation just to view a bill. Invio replaces that with a self-hosted system where invoices are shared via secure, tokenized links—no client login required.

What This Does

Invio is a full-stack invoicing application with a SvelteKit frontend (frontend/src/routes/) and a Bun/TypeScript backend (backend/src/). The backend handles authentication (JWT, OIDC, two-factor), invoice generation (PDF, UBL, Factur-X, FatturaPA), customer/product management, and i18n across four locales. The frontend provides dashboards, invoice editors, and public invoice views.

The system runs as Docker containers (docker-compose.yml) with a supervisord.conf orchestrating processes. A notable feature is the translation pipeline (.github/scripts/translations.py) that keeps locale files in sync.

How It Is Wired

Execution starts at backend/src/app.ts which mounts three route groups: admin.ts, auth.ts, and public.ts. The admin routes (19 imports, instability 0.95) are the most volatile—they touch controllers, models, and utils. The auth flow routes through middleware/auth.ts for JWT verification and rateLimiter.ts for throttling.

The import graph shows 83 internal modules with 100 edges and zero circular dependencies—clean structure. The hubs are backend/src/types/index.ts (17 dependents) and backend/src/database/init.ts (14 dependents, 826 lines). Any change to types/index.ts ripples across a quarter of the codebase; it should stay stable.

The backend hits SQLite (backend/invio-demo.db), the filesystem for PDF/logo storage, and SMTP for email. The frontend proxies API calls through frontend/src/routes/api/[...path]/+server.ts to the backend. Public invoice access flows through frontend/src/routes/public/invoices/[token]/+page.svelte.

How To Use It

git clone https://github.com/moses-y/Invio
cd Invio
docker compose up -d

The .env.example at root defines required environment variables (database paths, JWT secrets, SMTP config). The docker-compose.yml builds both backend/ and frontend/ images with their respective Dockerfiles. For development, docker-compose-dev.yml mounts source for hot reload. The frontend has bun.lock for reproducible installs; the backend uses deno.lock.

Real-World Use

A consultancy runs Invio on a $5 VPS behind Caddy. A project manager creates an invoice, Invio generates a PDF, and the client receives a https://invoices.example.com/public/invoices/<token> link. The client pays via bank transfer without creating an account. The consultant exports Factur-X XML for their accounting software.

Code Health & Issues

Static analysis found 44 findings (3 high, 41 medium) across 6 kinds. The critical ones:

High - Oversized files: backend/src/database/init.ts (826 lines), backend/src/controllers/invoices.ts, backend/src/routes/admin.ts—hard to hold in one head, changes ripple widely.
High - Duplicated code: 220 repeated 6-line blocks across 52 files, particularly in customers.ts and invoices.ts. Extract shared helpers.
Medium - Empty catch block: frontend/src/lib/backend.ts silently discards errors.
Medium - High branching: backend/src/controllers/settings.ts has 23 branch points over 65 lines.

The security audit flags: wildcard CORS with credentials (backend/src/app.ts), unpinned Docker base images (oven/bun:1), and unpinned GitHub Actions versions. No test suite exists across 115 source files—regressions ship undetected.

The Bottom Line

Invio is a solid, feature-complete invoicing app with clean module boundaries and no circular dependencies. It's not production-hardened yet: the 826-line init file, missing tests, and wildcard CORS need attention before trusting it with real client data. For a solo developer or small team willing to fix the security gaps, it's a legitimate alternative to paying $20/month for FreshBooks.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

172 files

TypeScript78
Svelte32
JSON15
Markdown7
HTML5
YAML4

ReactSvelteDocker

Module dependencies

The 10 most depended-upon modules of 83, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_backend_src_types_index["index"] n1_backend_src_database_init["init"] n2_backend_src_utils_env["env"] n3_backend_src_utils_uuid["uuid"] n4_ackend_src_utils_xmlProfiles["xmlProfiles"] n5_end_src_controllers_settings["settings"] n6_backend_src_utils_dataPaths["dataPaths"] n7_ackend_src_utils_logoStorage["logoStorage"] n8_backend_src_utils_ubl["ubl"] n9_ackend_src_i18n_translations["translations"] n5_end_src_controllers_settings --> n1_backend_src_database_init n5_end_src_controllers_settings --> n0_backend_src_types_index n1_backend_src_database_init --> n2_backend_src_utils_env n1_backend_src_database_init --> n3_backend_src_utils_uuid n1_backend_src_database_init --> n0_backend_src_types_index n0_backend_src_types_index --> n9_ackend_src_i18n_translations n6_backend_src_utils_dataPaths --> n2_backend_src_utils_env n7_ackend_src_utils_logoStorage --> n6_backend_src_utils_dataPaths n8_backend_src_utils_ubl --> n0_backend_src_types_index n4_ackend_src_utils_xmlProfiles --> n0_backend_src_types_index n4_ackend_src_utils_xmlProfiles --> n8_backend_src_utils_ubl

Findings

MediumNo test files detected - untested code paths repository-wide
LowDependencies declared without a lockfile - non-reproducible builds frontend/package.json

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh6 occurrences

.github/workflows

docker/setup-qemu-action@v3.6.0, docker/setup-buildx-action@v3.11.1, docker/login-action@v3.5.0, docker/metadata-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a test suite; this repository has nonehigh115 occurrences

115 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Replace the wildcard CORS origin with an explicit allow listhigh

backend/src/app.ts

origin: "*" together with credentials enabled

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

Dockerfile

oven/bun:1, debian:12-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/docker.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.