Web Standards

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach gis.example.gov.tr. The description does not name that host. can reach www.google.com. The description does not name that host. can reach staging.example.bel.tr. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  plugins/backend-standards/skills/backend/13-DOCKER-DEPLOY.md, line 37

  RUN apk add --no-cache ca-certificates wget tzdata \

  plugins/backend-standards/skills/backend/13-DOCKER-DEPLOY.md, line 50

  CMD wget -qO- http://localhost:3300/health || exit 1

  plugins/backend-standards/skills/backend/tools/load-test.sh, line 270

  const res = http.get(__ENV.YT_HEDEF);

  Show more

  plugins/backend-standards/skills/backend/tools/run-collection.sh, line 592

  printf ' Check: docker compose ps · curl -i <base-url>/health\n' >&2

  plugins/frontend-standards/skills/frontend/04-API-CLIENT.md, line 106

  return fetch(url, init)

  plugins/frontend-standards/skills/frontend/04-API-CLIENT.md, line 771

  http.get('/api/parkings', ({ request }) => {

  plugins/frontend-standards/skills/frontend/04-API-CLIENT.md, line 775

  http.get('/api/parkings/:id', ({ params }) => {

  plugins/frontend-standards/skills/frontend/06-SECURITY.md, line 288

  curl -sI https://gis.example.gov.tr/ | grep -

  plugins/frontend-standards/skills/frontend/06-SECURITY.md, line 298

  curl -sI https://gis.example.gov.tr/config.js | grep -i cache-control

  plugins/frontend-standards/skills/frontend/10-SEO-RENDERING.md, line 533

  CMD node -e "fetch('http://127.0.0.1:8081/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

  plugins/frontend-standards/skills/frontend/11-DOCKER-COMPOSE.md, line 136

  CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1

  plugins/frontend-standards/skills/frontend/11-DOCKER-COMPOSE.md, line 416

  test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1"]

  plugins/frontend-standards/skills/frontend/12-NGINX.md, line 468

  $ curl -s -w ' [%{http_code}]' http://localhost:8080/api/x

  plugins/frontend-standards/skills/frontend/14-GIT-CI.md, line 295

  curl -fsS http://localhost:8080/healthz && break || sleep 1

  plugins/frontend-standards/skills/frontend/14-GIT-CI.md, line 297

  curl -fsS http://localhost:8080/healthz | grep -q ok

  plugins/frontend-standards/skills/frontend/14-GIT-CI.md, line 299

  curl -fsSI http://localhost:8080/config.js | grep -qi 'cache-control:.*no-cache'

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  plugins/backend-standards/skills/backend/03-PROJECT-STRUCTURE.md, line 16

  │ ├── .env.example # variable NAMES only, no values - goes into git

  plugins/backend-standards/skills/backend/03-PROJECT-STRUCTURE.md, line 17

  │ ├── .env.local / .env.prod # real values - do NOT go into git

  plugins/backend-standards/skills/backend/tools/check-secrets.sh, line 127

  TRACKED_SECRETS='(^|/)\.env($|\.)|\.(pem|key|p12|pfx|jks)$|(^|/)id_rsa$|(^|/)credentials\.json$|(^|/)serviceaccount[^/]*\.json$'

  Show more

  plugins/backend-standards/skills/backend/03-PROJECT-STRUCTURE.md, line 18

  │ └── .env # COMPOSE_PROJECT_NAME only

  plugins/backend-standards/skills/backend/13-DOCKER-DEPLOY.md, line 70

  .env*

  plugins/backend-standards/skills/backend/13-DOCKER-DEPLOY.md, line 166

  docker compose --env-file .env.local -f docker-compose.yml up -d --build

  plugins/backend-standards/skills/backend/13-DOCKER-DEPLOY.md, line 168

  docker compose --env-file .env.prod -f docker-compose.yml up -d --build

  plugins/backend-standards/skills/backend/tools/check-secrets.sh, line 128

  # .env.example / .env.sample / .env.template SHOULD be in git [SEC-21] - excluded.

  plugins/frontend-standards/skills/frontend/13-TESTING.md, line 785

  const password = process.env.E2E_PASSWORD

  plugins/frontend-standards/skills/frontend/13-TESTING.md, line 870

  await page.getByLabel('Şifre').fill(process.env.E2E_PASSWORD!)

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b1601fecb2da. can reach a host that is not written as a fixed address. can reach gis.example.gov.tr. The description does not name that host. can reach www.google.com. The description does not name that host. can reach staging.example.bel.tr. The description does not name that host. reads a credential or environment file.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen