I scanned Cal.com with my evidence-based CLI. The best result was what it refused to say

I pointed my scanner at Cal.com this week, fully expecting to write a post about everything it got wrong.

The most interesting result was the thing it refused to say.

Quick context: I build DevTime, a local-first CLI that scans a repository and helps it explain itself from evidence. It detects a closed set of concepts (authentication, billing webhooks, background jobs, data export, admin permissions, file uploads), links every claim to evidence files, and reports uncertainty when it cannot prove something. No cloud, no telemetry, no code execution during scan, no AI.

The Setup

Cal.com is a well-known open-source scheduling platform. Big TypeScript monorepo, Next.js frontend, NestJS API, Stripe integration. If you wanted to stress a heuristic scanner, this is a good place to do it.