my translator - Moses Yebei

The Problem

Users need a desktop translator that works offline, respects privacy, and avoids costly cloud‑only services. Existing solutions either require a permanent server, expose API keys, or run only on a single OS. The lack of a cross‑platform, real‑time UI forces teams to stitch together separate STT/TTS tools.

What This Does

my-translator is a Tauri‑based desktop app (macOS + Windows) that captures system or microphone audio, sends 16 kHz PCM to the Soniox API for speech‑to‑text + translation, and renders the result in a lightweight overlay. Optional TTS can read the translation via Edge, Google, or ElevenLabs. All API keys are supplied by the user; no third‑party backend is involved.

Key files:

src-tauri/src/audio/microphone.rs – creates the audio stream, exposes start/stop.
src-tauri/src/commands/local_pipeline.rs – orchestrates the pipeline, writes logs (log_to_file), and performs network calls to Soniox.
src/js/app.js – the single‑page UI driver, handling settings, panel mode, and invoking TTS modules (src/js/edge-tts.js, google-tts.js, elevenlabs-tts.js).
src-tauri/src/settings.rs – persists user preferences and API keys to disk.

How It Is Wired

Execution begins in the Tauri runtime:

Entry point – src-tauri/src/lib.rs calls run (line 22), which constructs the Tauri app and registers command callbacks.
The UI (src/index.html + src/js/app.js) triggers the start command via invoke('start').
src-tauri/src/audio/microphone.rs::start creates a capture object and spawns start_local_pipeline.
src-tauri/src/commands/local_pipeline.rs::start_local_pipeline writes a start log (log_to_file) and forwards PCM buffers to send_audio_to_pipeline.
send_audio_to_pipeline issues an HTTP POST to Soniox (the only outbound network call).
The response is parsed and passed back to the UI through the Tauri event system; the UI updates the overlay.
If TTS is enabled, the UI invokes one of the JS TTS modules, which each call their respective provider APIs (Edge, Google, ElevenLabs).

Blast‑radius hubs – log_to_file is called from five locations, making it a high‑impact change point. The UI file src/js/app.js imports eight other JS modules, so any modification ripples widely. The Rust audio pipeline (src-tauri/src/audio/*.rs) contains deep nesting (up to 8 levels) that complicates reasoning.

No circular module dependencies were detected; the import graph is a shallow DAG, easing incremental changes.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/my-translator.git
cd my-translator

# Install JavaScript dependencies (npm is declared in package.json)
npm ci

# Build the Rust side and launch the Tauri dev window
cargo tauri dev

Configuration: edit the JSON file produced by src-tauri/src/settings.rs (located at the path returned by settings_path()) to insert your Soniox, Google, and ElevenLabs API keys. The same file stores UI preferences (panel mode, font size, selected TTS provider).

Running the built binary launches the overlay UI; use the on‑screen controls to select audio source, language pair, and optional TTS.

Real‑World Use

A remote‑learning team on Windows wants live subtitles for a bilingual lecture. They install the app, paste the Soniox key, enable “Two‑Way” mode, and set English ↔ Vietnamese. The app captures system audio, translates each speaker in real time, and displays side‑by‑side panels without any server‑side processing, keeping student data on‑device.

Code Health & Issues

HIGH – Pin GitHub Actions to commit SHA (.github/workflows).
HIGH – Upgrade vulnerable dependencies (tauri@2, futures-util@0.3).
HIGH – No test suite (26 source files, 0 test files).
MEDIUM – Enable Dependabot/Renovate for automatic updates.
MEDIUM – Use npm ci (or cargo install --locked) to respect lockfiles in CI.
MEDIUM – Add a dependency‑vulnerability scan step to CI.
MEDIUM – Set persist-credentials: false on checkout in release workflow.
LOW – Define job timeouts in CI workflows.
LOW – Add conventional repo files (.editorconfig, formatter config).

Additional static findings: deep nesting in several Rust and JS files, duplicated 6‑line blocks across audio and TTS modules, and a 1 270‑line src/js/app.js that centralises most UI logic.

The Bottom Line

my-translator delivers a functional, cross‑platform real‑time translation overlay with user‑controlled API keys and no server dependency. The architecture is clear and modular, but the codebase suffers from high cognitive load, duplicated logic, and a complete lack of automated tests. It is suitable for teams comfortable extending Rust/JS code and willing to invest in refactoring and test coverage before production use.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

91 files

Rust14
JavaScript10
Markdown8
JSON5
Python2
YAML1

ReactExpress

Module dependencies

The 10 most depended-upon modules of 12, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_js_audio_player["audio-player"] n1_src_js_edge_tts["edge-tts"] n2_src_js_elevenlabs_tts["elevenlabs-tts"] n3_src_js_google_tts["google-tts"] n4_src_js_settings["settings"] n5_src_js_soniox["soniox"] n6_src_js_ui["ui"] n7_src_js_updater["updater"] n8_src_js_app["app"] n9_scripts_local_pipeline["local_pipeline"] n8_src_js_app --> n4_src_js_settings n8_src_js_app --> n6_src_js_ui n8_src_js_app --> n5_src_js_soniox n8_src_js_app --> n2_src_js_elevenlabs_tts n8_src_js_app --> n3_src_js_google_tts n8_src_js_app --> n1_src_js_edge_tts n8_src_js_app --> n0_src_js_audio_player n8_src_js_app --> n7_src_js_updater

Dependencies

20 declared dependencies, none a major version behind. Resolved 3 of 20 against the registry.

Findings

MediumNo test files detected - untested code paths repository-wide

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, softprops/action-gh-release@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh3 occurrences

tauri@2 CVE-2026-42184 (medium); futures-util@0.3 CVE-2020-35908 (medium) +1 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh26 occurrences

26 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

npm install with a committed package-lock.json

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/release.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/release.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.