codeinspectus

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  fixtures/go-ai-corpus/fixed/src/main.go, line 25

  return exec.CommandContext(ctx, "go", "test", "./...").Run()

  fixtures/go-ai-corpus/fp/src/main.go, line 38

  return exec.Command("sh", "-c", args.Command).Run()

  fixtures/go-ai-corpus/fp/src/main.go, line 51

  return exec.Command("bash", "-c", args.Command).Run()

  Show more

  fixtures/go-ai-corpus/fp/src/main.go, line 63

  return exec.Command("sh", "-c", safeCommand).Run()

  fixtures/go-ai-corpus/fp/src/main.go, line 73

  if err := exec.Command("git", "status", "--short").Run(); err != nil {

  fixtures/go-ai-corpus/fp/src/main.go, line 76

  if err := exec.Command("python3", "-c", args.Command).Run(); err != nil {

  fixtures/go-ai-corpus/fp/src/main.go, line 79

  return exec.Command("sh", "-c", "go test ./...").Run()

  fixtures/go-ai-corpus/fp/src/main.go, line 83

  return exec.Command("sh", "-c", command).Run()

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  detection-db/opengrep-rules/security-baseline/ssrf.yaml, line 17

  - pattern: fetch($U + ..., ...)

  detection-db/opengrep-rules/security-baseline/ssrf.yaml, line 18

  - pattern: fetch(`...${...}...`, ...)

  detection-db/opengrep-rules/security-baseline/ssrf.yaml, line 19

  - pattern: axios.get($U + ..., ...)

  Show more

  detection-db/opengrep-rules/security-baseline/ssrf.yaml, line 20

  - pattern: axios.get(`...${...}...`, ...)

  docs/RULE-ORIGINALITY-AUDIT.md, line 95

  | `ci-baseline-ssrf-request-from-input` (js) | `express/security/audit/express-ssrf.yaml` | likely-original | Registry is taint-mode. CI is syntactic `fetch($U+...)` / `axios.get`

  fixtures/ruby-ai-corpus/fixed/agent.rb, line 4

  "read_file" => ->(arguments) { File.read(arguments.fetch("path")) },

  fixtures/ruby-ai-corpus/fixed/agent.rb, line 5

  "list_files" => ->(arguments) { Dir.children(arguments.fetch("path", ".")) },

  fixtures/ruby-ai-corpus/fixed/agent.rb, line 10

  tool = TOOLS.fetch(tool_call.function.name)

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  fixtures/nextjs-admin-route-corpus/fp/app/api/admin/supabase-client-alias/route.ts, line 3

  const baseClient = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_PUBLISHABLE_KEY!);

  fixtures/nextjs-admin-route-corpus/fp/src/app/api/admin/audit/route.ts, line 4

  const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_PUBLISHABLE_KEY!);

  CHANGELOG.md, line 46

  - Finding snippets from configuration files (YAML, `.env`, `.npmrc`, `.pypirc`, INI, TOML, properties, HCL) mask

  Show more

  fixtures/nextjs-admin-route-corpus/tp/app/api/admin/mixed-supabase-client/route.ts, line 9

  ? createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_PUBLISHABLE_KEY!)

  fixtures/nextjs-admin-route-corpus/tp/src/app/api/admin/billing/route.ts, line 4

  const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_PUBLISHABLE_KEY!);

  .gitignore, line 13

  # Secrets - never commit

  .gitignore, line 14

  .env

  fixtures/secret-rls-corpus/fp/src/public-env-in-error-string.ts, line 3

  export const help = "Please set NEXT_PUBLIC_FOO_SECRET in your .env file to enable payments";

  src/ai-checks/client-secrets.ts, line 2

  * §6.1 - Client-side secret / .env exposure (CodeInspectus AI-code check).

  src/ai-checks/client-secrets.ts, line 51

  /(?:process\.env\.|import\.meta\.env\.|(?<![\w$.])env\.)((?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|NUXT_PUBLIC_|PUBLIC_)[A-Z0-9_]*(?:SECRET|PRIVATE|API[_]?KEY|ACCESS[_]

  src/ai-checks/security-controls.ts, line 218

  /(?:NODE_ENV\s*={2,3}\s*["']development["']|import\.meta\.env\.DEV\b)/.test(line)

  src/ai-checks/security-controls.ts, line 228

  !/(?:NODE_ENV\s*={2,3}\s*["']development["']|import\.meta\.env\.DEV\b)/.test(candidate)

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  evals/run-evals.ts, line 1

  /**

  fixtures/pub-sca-corpus/tp/pubspec.lock, line 1

  # Generated fixture. Do not run pub get.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 718a8afb07f4. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen