lemon chat - Moses Yebei

The Problem

Most chat tools route through a provider you don't control. This repo solves that with a self-hosted chat system—server you run yourself, client that works from a browser tab—where even the hosting admin can't read messages unless they belong to them. The README positions it as a Teamspeak/Mumble-style tool with end-to-end encryption layered on top of TLS.

What This Does

A lightweight C server in server-source-code/ plus a single-file HTML client, client/client.html, that runs by double-clicking or embeds into a website. WebSocket carries text and images; WebRTC data channels carry audio, client→server only, so clients don't leak IP addresses. A small Android client lives in client/android/ with Java activity classes (MainActivity.java, BackgroundService.java) wrapping the same HTML in a WebView.

The repo is 4,347 files but almost all of that is vendored dependencies—libdatachannel, mbedtls-3.5.1, libtom, nlohmann/json—not application code. The actual product logic is a small fraction of the tree.

How It Is Wired

The measured import graph resolved only 25 internal modules with 4 edges, all of them mbedtls test scripts. The actual server's call graph has not been mapped by this analysis—the listed entry points are all nlohmann/json test mains, which are irrelevant to the product. The wiring description comes from the README, not traced code: the client opens a WebSocket to IP:port for text/images, WebRTC data channels for audio, with the server's own encryption applied on top of TLS. Until the C server code is traced, the control flow between client.html and the server handlers remains unmapped.

How To Use It

git clone https://github.com/moses-y/lemon-chat
# build the server:
#   Windows: run windows_build_script.bat
#   Linux:   run linux_build_script.sh
# or use a prebuilt release
# then open client.html in a browser and enter the server IP and port

All server dependencies are vendored; no extra C/C++ libraries to download. The README documents embedding via stunnel + apache2 + certbot with a concrete /etc/stunnel.conf example. A 71.5MB walkthrough video, how-to-build-and-use-video.mkv, is committed in the repo root.

Real-World Use

A small VPS (1 CPU, 500MB RAM) acts as a public relay: run the server locally, expose it via SSH port forwarding, or front it with stunnel for WSS. The README's scenario is a team chat on a domain like justsometestchat.com where users reach client.html over HTTPS and the server is reachable from both desktop and website.

Code Health & Issues

Static analysis found 404 findings (183 high, 220 medium), one kind: deep nesting, with max indentation depth 10 in files like server-source-code/mbedtls-3.5.1/library/ssl_tls13_invasive.h and server-source-code/libtom/libtommath/bn_mp_shrink.c. Most of that lands in vendored code, not the app itself.

Critical – Committed private key: server-source-code/libdatachannel/test/uwp/benchmark/Windows_TemporaryKey.pfx. Rotate and purge from history; deletion in a later commit is not enough.
High – No LICENSE at repo root; redistribution rights are undefined.
High – No build gate for the Docker artifacts in server-source-code/mbedtls-3.5.1/tests/docker/bionic/Dockerfile.
Medium – No Dependabot/Renovate despite 8 manifests.
Medium – No pre-commit secret gate; the key leak is the symptom.
Medium – Large binaries committed: how-to-build-and-use-video.mkv (71.5MB), dbip-country-lite-2025-06.mmdb (7.1MB). Use LFS or object storage.
Low – Missing .editorconfig, .gitattributes, formatter config.

The Bottom Line

The product itself is a functional, genuinely self-hosted E2E-encrypted chat with a clever single-file client. The repo hygiene is the problem: a committed private key that must be rotated, no license, and a tree dominated by vendored dependencies that makes review and maintenance heavy. Fine for personal use as-is; needs a cleanup pass before it's suitable for client work.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

4,347 files

C1056
C/C++ Header597
C++299
Markdown75
Shell62
Python61

ExpressDockerCUDA

Module dependencies

The 10 most depended-upon modules of 25, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_scripts_mbedtls_dev___init__["__init__"] n1_cripts_mbedtls_dev_test_case["test_case"] n2_ripts_mbedtls_dev_bignum_mod["bignum_mod"] n3_bedtls_dev_crypto_data_tests["crypto_data_tests"] n4__mbedtls_dev_psa_information["psa_information"] n5_1_tests_scripts_scripts_path["scripts_path"] n6_channel_deps_usrsctp_gen_def["gen-def"] n7_s_scripts_generate_ecp_tests["generate_ecp_tests"] n8_eps_usrsctp_fuzzer_crashtest["crashtest"] n9_ipts_mbedtls_dev_typing_util["typing_util"] n1_cripts_mbedtls_dev_test_case --> n0_scripts_mbedtls_dev___init__ n2_ripts_mbedtls_dev_bignum_mod --> n0_scripts_mbedtls_dev___init__ n3_bedtls_dev_crypto_data_tests --> n0_scripts_mbedtls_dev___init__ n4__mbedtls_dev_psa_information --> n0_scripts_mbedtls_dev___init__

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them server-source-code/libdatachannel/test/uwp/benchmark/Windows_TemporaryKey.pfx, server-source-code/libdatachannel/test/uwp/tests/Windows_TemporaryKey.pfx, server-source-code/mbedtls-3.5.1/tests/data_files/crl-ec-sha1.pem

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high2

medium3

low1

Rotate and purge the committed private keycritical206 occurrences

server-source-code/libdatachannel/test/uwp/benchmark/Windows_TemporaryKey.pfx

test fixture material: server-source-code/libdatachannel/test/uwp/benchmark/Windows_TemporaryKey.pfx, server-source-code/libdatachannel/test/uwp/tests/Windows_TemporaryKey.pfx, server-source-code/libtom/libtomcrypt/tests/test.key

A published signing or TLS private key cannot be unpublished, and it lets anyone impersonate the service or decrypt captured traffic.

Fix: Reissue the key pair, then purge the blob from history; deleting it in a later commit is not enough.

Add a LICENSE; redistribution rights are undefinedhigh

no licence file at the repository root

Fix: Add MIT or Apache-2.0 at the repository root.

Add a build gate for the deployable artifacts herehigh

server-source-code/mbedtls-3.5.1/tests/docker/bionic/Dockerfile

deployment artifacts with no workflow

Something in the repo is meant to reach a server and no automated step has ever validated it, which is the state of 125 repositories here.

Fix: Add a workflow that at least builds the image and validates the manifests.

Enable Dependabot or Renovatemedium

8 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Add a pre-commit secret gatemedium

a secret-shaped file is tracked and no repo-level gate is visible

Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.

Fix: Add a pre-commit hook scanning staged content, and enable push protection.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

how-to-build-and-use-video.mkv

2 blobs over 5MB: how-to-build-and-use-video.mkv 71.5MB, dbip-country-lite-2025-06.mmdb 7.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.