anacraft

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Note

  README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

  INSTALL_DOCUMENTED_INSTALLER

  README.md, line 35

  curl -fsSL https://anacraft.dev/install.sh | bash

  .claude/skills/anacraft/SKILL.md, line 40

  curl -fsSL https://anacraft.dev/install.sh | bash

  docs/_of.html, line 399

  <span class="c">curl -fsSL https://anacraft.dev/install.sh | bash</span>

  Show more

  docs/_of.html, line 978

  <span class="c">$</span> <span class="w">curl -fsSL https://anacraft.dev/install.sh | bash</span>

  docs/_of.html, line 1042

  <span class="c">curl -fsSL https://anacraft.dev/install.sh | bash</span>

  docs/_of.html, line 1078

  navigator.clipboard.writeText('curl -fsSL https://anacraft.dev/install.sh | bash').then(function () {

  docs/index.html, line 719

  <span class="c">curl -fsSL https://anacraft.dev/install.sh | bash</span>

  docs/index.html, line 2482

  <span class="c">curl -fsSL https://anacraft.dev/install.sh | bash</span>

  docs/pricing.html, line 568

  <button class="install" onclick="cp(this, 'curl -fsSL https://anacraft.dev/install.sh | bash')">

  docs/pricing.html, line 570

  <span class="c">curl -fsSL https://anacraft.dev/install.sh | bash</span>

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  install.sh, line 53

  tag="$(curl -fsSL "${API}/repos/${REPO}/releases/latest" \

  install.sh, line 106

  curl -fsSL "$url" -o "$tmpdir/$archive" \

  deploy/dns.sh, line 31

  ZONE_ID=$(curl -fsS "${auth[@]}" "$CF/zones?name=$ZONE" | jq -r '.result[0].id // empty')

  Show more

  deploy/dns.sh, line 34

  RECORD_ID=$(curl -fsS "${auth[@]}" "$CF/zones/$ZONE_ID/dns_records?type=A&name=$HOST" | jq -r '.result[0].id // empty')

  deploy/dns.sh, line 38

  curl -fsS "${auth[@]}" -X PUT "$CF/zones/$ZONE_ID/dns_records/$RECORD_ID" --data "$BODY" | jq -e '.success' >/dev/null

  deploy/dns.sh, line 41

  curl -fsS "${auth[@]}" -X POST "$CF/zones/$ZONE_ID/dns_records" --data "$BODY" | jq -e '.success' >/dev/null

  deploy/sync-secrets.sh, line 18

  fetch() {

  docs/install.sh, line 53

  tag="$(curl -fsSL "${API}/repos/${REPO}/releases/latest" \

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  build.rs, line 8

  //! A local `.env` is read too, so working on the paid path does not mean

  build.rs, line 15

  /// Everything the binary may have baked in. Anything else in `.env` is left

  docs/_of.html, line 1007

  <tr><td style="width:auto"><code style="font-family:var(--mono);color:var(--fg)">~/.anacraft/credentials.json</code></td><td>OAuth refresh token</td></tr>

  Show more

  build.rs, line 33

  println!("cargo:rerun-if-changed=.env");

  build.rs, line 35

  let Ok(raw) = fs::read_to_string(".env") else {

  scripts/stripe-reprice.py, line 70

  key = os.environ.get("STRIPE_SECRET_KEY", "").strip()

  scripts/stripe_api.py, line 32

  key = os.environ.get("STRIPE_SECRET_KEY", "").strip()

  scripts/sync-maker.py, line 81

  token = os.environ.get("GITHUB_TOKEN", "").strip()

  scripts/sync-maker.py, line 84

  service_key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY", "").strip()

  .env.example, line 1

  # Copy to .env and fill in. Everything here is baked into the binary at build

  .gitignore, line 7

  *.secret.json

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  docs/_of.html, line 1

  <!DOCTYPE html>

  docs/index.html, line 1

  <!DOCTYPE html>

  src/ui.rs, line 1

  //! The full-screen live dashboard (`anacraft dash`), built on ratatui.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 76c110d896b7. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 24 Oct 2026

Read how this letter is chosen