io.github.ChesterHsu/flyto-indexer

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  benchmark.py, line 46

  subprocess.run(

  benchmark.py, line 52

  subprocess.run(

  benchmark.py, line 203

  shutil.rmtree(tmp_dir, ignore_errors=True)

  Show more

  benchmarks/build_semgrep_baseline.py, line 46

  subprocess.check_call([

  benchmarks/build_semgrep_baseline.py, line 136

  shutil.rmtree(tmp, ignore_errors=True)

  benchmarks/mutation_corpus.py, line 26

  "# accuracy decoy: os.system(request.args.get('cmd'))\n"

  benchmarks/fixture/corpus/go-rce/main.go, line 11

  exec.Command("sh", "-c", command)

  benchmarks/fixture/corpus/python-rce/app.py, line 6

  os.system(command)

  benchmarks/fixture/corpus/python-rce-sanitized/app.py, line 7

  subprocess.run(argv, shell=False, check=True)

  benchmarks/fixture/corpus/python-sanitized/app.py, line 7

  os.system(command)

  examples/demo_audit.py, line 215

  shutil.rmtree(temp_dir)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  benchmarks/mutation_corpus.py, line 29

  "// accuracy decoy: axios.get(req.query.url)\n"

  benchmarks/mutation_corpus.py, line 33

  "// accuracy decoy: axios.get(req.query.url)\n"

  benchmarks/fixture/corpus/javascript-constant-ssrf/app.js, line 1

  app.get("/proxy", async (_req, res) => { const upstream = await axios.get("https://example.invalid/health"); res.send(upstream.data) })

  Show more

  benchmarks/fixture/corpus/javascript-ssrf/app.js, line 1

  app.get("/proxy", async (req, res) => { const upstream = await axios.get(req.query.url); res.send(upstream.data) })

  benchmarks/fixture/corpus/typescript-constant-ssrf/app.ts, line 1

  app.get("/proxy", async (_req, res) => { const upstream = await axios.get("https://example.invalid/health"); res.send(upstream.data) })

  benchmarks/fixture/corpus/typescript-ssrf/app.ts, line 1

  app.get("/proxy", async (req, res) => { const upstream = await axios.get(req.query.url); res.send(upstream.data) })

  scripts/write_public_site_verification_evidence.py, line 103

  with socket.create_connection((host, 443), timeout=timeout) as sock, context.wrap_socket(

  src/cli.py, line 253

  "Usage: flyto-index export . | curl -X POST -H 'Authorization: Bearer TOKEN' "

  src/scanner/vue.py, line 487

  # fetch("/api/..."), useFetch("/api/..."), useAsyncData("/api/..."), $fetch("/api/...")

  src/scanner/vue.py, line 489

  # axios.get("/path"), axios.post("/path"), etc. - known HTTP client, any URL

  src/scanner/vue.py, line 491

  # api.get("/path"), $api.post("/path"), http.get("/path") - known HTTP client, any URL

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  analyze.py, line 89

  if item.name.startswith('.') and item.name not in {'.env.example', '.gitignore'}:

  examples/audit_all.py, line 17

  Path(__file__).parent.parent / ".env",

  examples/audit_all.py, line 18

  Path("/path/to/your/projects/flyto-pro/.env"),

  Show more

  examples/audit_all.py, line 179

  if not os.getenv("OPENAI_API_KEY"):

  examples/audit_incremental.py, line 21

  Path(__file__).parent.parent / ".env",

  examples/audit_incremental.py, line 22

  Path("/path/to/your/projects/flyto-pro/.env"),

  examples/audit_incremental.py, line 178

  if not args.dry_run and not os.getenv("OPENAI_API_KEY"):

  examples/demo_audit.py, line 19

  Path(__file__).parent.parent / ".env",

  examples/demo_audit.py, line 223

  if not os.getenv("OPENAI_API_KEY"):

  src/doc_scanner.py, line 405

  """Check if .env.example exists and has comments. Returns (exists, has_comments)."""

  src/doc_scanner.py, line 406

  env_names = [".env.example", ".env.sample", ".env.template"]

  src/auditor/llm_auditor.py, line 107

  self._client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))

  src/tools/proof_receipts.py, line 47

  raw = os.environ.get("FLYTO_INDEXER_PROOF_KEYS_JSON", "").strip()

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  docs/reference/python-api.md, line 1

  <!-- Generated by scripts/generate-reference.py; do not edit. -->

  tests/test_dockerfile_stages.py, line 1

  """Docker stage identity regressions shared by findings and dependency inventory."""

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 01b3ea9f7eb3. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen