Fantasy Football Manager

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  deployment/backup.py, line 110

  pg_dump="pg_dump", runner=subprocess.run, now=None):

  scripts/check_distribution_status.py, line 169

  result = subprocess.run(["git", *args], cwd=ROOT, capture_output=True, text=True, timeout=10)

  scripts/install_local_plugin.py, line 59

  subprocess.run([sys.executable, str(helpers["validate_plugin.py"]), str(source)], check=True)

  Show more

  scripts/install_local_plugin.py, line 61

  subprocess.run([sys.executable, str(helpers["read_marketplace_name.py"])], check=True)

  scripts/install_local_plugin.py, line 74

  subprocess.run(command, check=True)

  scripts/install_local_plugin.py, line 77

  subprocess.run([sys.executable, str(helpers["update_plugin_cachebuster.py"]), str(target)], check=True)

  scripts/install_local_plugin.py, line 78

  subprocess.run([sys.executable, str(helpers["validate_plugin.py"]), str(target)], check=True)

  scripts/install_local_plugin.py, line 79

  result = subprocess.run([sys.executable, str(helpers["read_marketplace_name.py"])],

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/check_distribution_status.py, line 40

  def fetch(url, *, token=None):

  scripts/collect_github_metrics.py, line 130

  def fetch(self, endpoint):

  scripts/collect_github_metrics.py, line 154

  data = normalize(endpoint, client.fetch(endpoint), repo, at)

  Show more

  src/fantasy_football_manager/dashboard_static/readiness.js, line 16

  const response = await fetch("api/readiness", { cache: "no-store" });

  web/public/readiness.js, line 16

  const response = await fetch("api/readiness", { cache: "no-store" });

  web/src/api.js, line 4

  const response = await fetch(path, {

  src/fantasy_football_manager/dashboard_static/assets/index-INJ6qdYg.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

  src/fantasy_football_manager/dashboard_static/assets/index-INJ6qdYg.js, line 9

  `).replace(Qf,``)}function ep(e,t){return t=$f(t),$f(e)===t}function $(e,t,n,r,a,o){switch(n){case`children`:if(typeof r==`string`)t===`body`||t===`textarea`&&r===``||vn(e,r);else

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  scripts/check_distribution_status.py, line 310

  report = collect(token=os.environ.get("GH_TOKEN"))

  scripts/collect_github_metrics.py, line 317

  token = sys.stdin.readline(4098).strip() if args.token_stdin else os.environ.get('GH_TOKEN', '').strip()

  scripts/validate_release.py, line 25

  "credentials.json", "corrected-recommendations.json"}

  Show more

  scripts/validate_release.py, line 143

  or path.name.startswith(".env") or any(part in PRIVATE_DIRS for part in relative.parts)

  src/fantasy_football_manager/dashboard_actions.py, line 29

  configured_credentials = credential_file or os.environ.get("FFM_ESPN_CREDENTIAL_FILE")

  src/fantasy_football_manager/espn_http_season.py, line 86

  self.client = client or ESPNHTTPClient(credential_file or os.environ.get("FFM_ESPN_CREDENTIAL_FILE")

  src/fantasy_football_manager/espn_http_season.py, line 87

  or self.data_dir / "espn-http-credentials.json")

  src/fantasy_football_manager/espn_http_season.py, line 90

  credential_path = credential_file or os.environ.get("FFM_ESPN_CREDENTIAL_FILE") or getattr(self.client, "credential_file", None)

  .codexignore, line 14

  *.log

  .codexignore, line 15

  .env

  .codexignore, line 17

  credentials.json

  .gitignore, line 22

  *.log

  .gitignore, line 23

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  uv.lock, line 1

  version = 1

  src/fantasy_football_manager/dashboard_static/assets/index-INJ6qdYg.js, line 1

  var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0c8bcf741936. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 16 Oct 2026

Read how this letter is chosen