P Backlog

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 55

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/port-guard/guard.mjs, line 9

  // net.connect() and http hand Socket.prototype.connect their arguments pre-normalized as [options, callback].

  src/cli/service/server-probe.ts, line 5

  const response = await fetch(`${origin}${PROBE_PATH}`, { signal: AbortSignal.timeout(timeoutMs) });

  src/server/start.test.ts, line 60

  const response = await fetch(`http://127.0.0.1:${server.port}/api/settings`);

  Show more

  src/server/start.test.ts, line 72

  const response = await fetch(`http://127.0.0.1:${server.port}/api/tasks/SPA-1`, {

  src/server/start.test.ts, line 110

  const response = await fetch(`http://127.0.0.1:${server.port}/api/no-such-route`);

  src/server/start.test.ts, line 124

  for (let request = 0; request < 2; request++) expect(await (await fetch(`http://127.0.0.1:${server.port}/api/settings`)).json()).toEqual({ language: "en" });

  src/server/start.test.ts, line 144

  const events = await fetch(`http://127.0.0.1:${server.port}/api/events`);

  src/server/start.test.ts, line 159

  const { tasks } = (await (await fetch(`${origin}/api/tasks`)).json()) as { tasks: { id: string; version: string }[] };

  src/server/start.test.ts, line 163

  const patch = fetch(`${origin}/api/tasks/SPA-1`, {

  src/web/app/backlog-api.tsx, line 13

  client: createApiClient((path, init) => fetch(path, init)),

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED

  src/cli/io.ts, line 33

  return { ...env, language, cli: cliMessages(language), core: coreMessages(language) };

  src/cli/service/startup-folder.test.ts, line 20

  return { ...env, APPDATA: roots.appData, LOCALAPPDATA: roots.localAppData };

  src/core/claude-dir.test.ts, line 12

  expect(claudeSkillsDir({ ...env, CLAUDE_SKILLS_DIR: "/s" }, "/home/u")).toBe("/s");

  Show more

  scripts/screenshots/demo-repo.ts, line 123

  const { stdout } = await runFile("git", ["-C", this.dir, ...args], { env: { ...process.env, ...ISOLATED_GIT_ENV, ...env } });

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  package-lock.json, line 1

  {

  src/server/memory-sampler.ts, line 1

  import { MEMORY_HISTORY_MS, MEMORY_SAMPLE_INTERVAL_MS, mebibytesOf } from "../core/api/memory";

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 80681d70a820. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 25 Oct 2026

Read how this letter is chosen