Serial Studio - Moses Yebei

The Problem

Embedded developers and robotics teams need to visualize data from serial ports, BLE, MQTT, Modbus, and CAN in real time without writing custom dashboards. Serial Studio is a cross-platform desktop application that ingests telemetry from multiple transports and renders it as plots, gauges, and grids, with CSV logging built in.

What This Does

A Qt/C++ desktop app with a QML interface. Execution starts at app/src/main.cpp; the UI lives under app/qml/ with dashboard widgets (Plot.qml, Gauge.qml, FFTPlot.qml, GPS.qml, Terminal.qml) and per-transport setup panes in app/qml/MainWindow/Panes/SetupPanes/Drivers/ (UART, BLE, CANBus, Modbus, Network, Audio). A Project Editor (app/qml/ProjectEditor/) defines frame parsers, datasets, and groups without code. The repo bundles third-party libraries (QCodeEditor, QSimpleUpdater, KissFFT, OpenSSL, mdflib) under lib/, which accounts for most of the 2,631 files.

How It Is Wired

Static analysis resolved 215 internal modules with only 6 import edges, all in the Python test utilities (tests/utils/__init__, data_generator, device_simulator, validators, api_client) — no circular dependencies. tests/utils/data_generator is the hub with 3 importers. The C++/QML core's call graph has not been mapped by this pipeline; the traced paths cover only the test surface, so the internal wiring of app/src/main.cpp through the QML layer is undocumented here. The most connected modules are test utilities, which means the test suite is the only part with a resolvable dependency structure.

How To Use It

Build from source with CMake (root CMakeLists.txt):

git clone https://github.com/moses-y/Serial-Studio
cd Serial-Studio
cmake -S . -B build
cmake --build build

Prebuilt binaries are the documented path: AppImage for Linux, DMG for macOS, installer for Windows; brew install --cask serial-studio is community-maintained. No environment variables are required for a build. Runtime configuration happens through the QML Settings dialog, not config files. The README does not document a from-source build command verbatim, so the CMake commands above are inferred from the present CMakeLists.txt.

Real-World Use

A robotics team connects an ESP32 over UART streaming JSON telemetry. In the Project Editor they define a frame parser, map fields to datasets, and drop a Gauge and MultiPlot onto the Dashboard. Data logs to CSV while plots render live; the same project switches transports to MQTT or CAN without touching the dashboard.

Code Health & Issues

Static analysis found 578 issues (370 high, 208 medium) of one kind: deep nesting (max depth 8) in tests/utils/data_generator.py, app/src/API/CommandHandler.cpp, and app/src/API/CommandProtocol.h — fix with early returns and extraction.

The security audit found:

Critical — CLAUDE_CODE_OAUTH_TOKEN (publish/cloud scope) in .github/workflows/claude.yml; fork PRs could exfiltrate it. Move secret-using steps to a workflow_run job that never checks out PR code.
High — unpinned third-party actions (@v1, @latest tags) in .github/workflows; pin to commit SHAs.
Medium — no least-privilege GITHUB_TOKEN permissions in deploy.yml.
Medium — no Dependabot/Renovate configured.
Medium — no dependency vulnerability scan in CI.
Medium — four blobs over 5MB (libcrypto.lib at 48.9MB) under lib/OpenSSL; move to LFS.
Medium — checkout keeps persist-credentials; set false.
Low — no timeout-minutes on workflow jobs.

Tests, CI, and license are present.

The Bottom Line

A feature-complete telemetry dashboard for embedded work, inheriting a mature codebase from the upstream project. The CI security posture — particularly the exposed OAuth token — needs remediation before accepting contributions. Teams wanting a ready-made multi-transport telemetry UI should use the upstream releases rather than this fork.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

2,631 files

C/C++ Header631
C++333
HTML201
JavaScript151
Python48
Markdown46

RailsDockerPyTorch

Module dependencies

The 10 most depended-upon modules of 215, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_tests_utils_data_generator["data_generator"] n1_tests_utils_device_simulator["device_simulator"] n2_tests_utils_validators["validators"] n3_tests_utils_api_client["api_client"] n4_tests_utils___init__["__init__"] n5_app_rcc_scripts_at_commands["at_commands"] n6_p_rcc_scripts_base64_encoded["base64_encoded"] n7_app_rcc_scripts_binary_tlv["binary_tlv"] n8_app_rcc_scripts_cobs_encoded["cobs_encoded"] n9__rcc_scripts_comma_separated["comma_separated"] n4_tests_utils___init__ --> n3_tests_utils_api_client n4_tests_utils___init__ --> n1_tests_utils_device_simulator n4_tests_utils___init__ --> n0_tests_utils_data_generator n4_tests_utils___init__ --> n2_tests_utils_validators n1_tests_utils_device_simulator --> n0_tests_utils_data_generator n2_tests_utils_validators --> n0_tests_utils_data_generator

Dependencies

6 of 18 declared dependencies are a major version behind. Resolved 11 of 18 against the registry.

Package	Declared	Latest	Behind
`faker`	>=19.0.0	40.37.0	21 major
`pytest-cov`	>=4.1.0	7.1.0	3 major
`pytest`	>=7.4.0	9.1.1	2 major
`psutil`	>=5.9.0	7.2.2	2 major
`pytest-benchmark`	>=4.0.0	5.3.0	1 major
`pandas`	>=2.0.0	3.0.5	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high1

medium5

low1

Keep secrets out of workflows a fork can triggercritical

.github/workflows/claude.yml

CLAUDE_CODE_OAUTH_TOKEN (publish or cloud scope)

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh6 occurrences

.github/workflows

anthropics/claude-code-action@v1, lukka/get-cmake@latest, alex-spataru/import-codesign-certs@v4, TheMrMilchmann/setup-msvc-dev@v3

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/deploy.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium4 occurrences

lib/OpenSSL/dll/Windows/msvc/libcrypto.lib

4 blobs over 5MB: libcrypto.lib 48.9MB, libcrypto.a 16.7MB, libssl.lib 9.3MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/deploy.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/claude-code-review.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.