io.github.Dhevenddra/forensic-deepdive

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  experiments/fastcontext/localization_eval.py, line 109

  subprocess.run(["git", "init", "-q", str(dest)], check=True)

  experiments/fastcontext/localization_eval.py, line 111

  subprocess.run(

  experiments/fastcontext/localization_eval.py, line 115

  subprocess.run(["git", "-C", str(dest), "checkout", "-q", "FETCH_HEAD"], check=True)

  Show more

  experiments/fastcontext/localization_eval.py, line 117

  subprocess.run(["git", "clone", "-q", repo_url, str(dest)], check=True)

  experiments/fastcontext/localization_eval.py, line 118

  subprocess.run(["git", "-C", str(dest), "checkout", "-q", base_commit], check=True)

  scripts/regen_examples.py, line 101

  proc = subprocess.run(

  scripts/render_demo_gif.py, line 98

  shutil.rmtree(SCRATCH)

  scripts/render_demo_gif.py, line 107

  result = subprocess.run(

  scripts/render_demo_gif.py, line 199

  shutil.rmtree(SCRATCH, ignore_errors=True)

  src/forensic_deepdive/flatten/repomix_backend.py, line 131

  proc = subprocess.run( # noqa: S603 - command built from a resolved path

  src/forensic_deepdive/pipeline/phases.py, line 643

  shutil.rmtree(db_path)

  src/forensic_deepdive/pipeline/phases.py, line 652

  shutil.rmtree(wal_path)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  experiments/fastcontext/localization_eval.py, line 104

  per-commit fetch (`git init` + `fetch --depth 1 <commit>`) avoids cloning the

  src/forensic_deepdive/contracts/http/consumers/angular_http.py, line 9

  getUser(id: string) { return this.http.get(`/api/users/${id}`); }

  src/forensic_deepdive/contracts/http/consumers/fetch_axios.py, line 5

  - ``fetch(url, { method })`` - method from the options object, **default GET**;

  Show more

  src/forensic_deepdive/contracts/http/consumers/py_requests.py, line 6

  requests.get(f"/api/users/{id}") # module verb, url = arg 0

  src/forensic_deepdive/contracts/http/consumers/py_requests.py, line 7

  requests.post("/api/users", json=body)

  src/forensic_deepdive/contracts/http/consumers/py_requests.py, line 8

  requests.request("DELETE", "/api/users/1") # verb = arg 0, url = arg 1

  src/forensic_deepdive/contracts/http/consumers/py_requests.py, line 9

  httpx.get("/api/things")

  src/forensic_deepdive/contracts/http/consumers/py_requests.py, line 113

  # requests.request("DELETE", url)

  src/forensic_deepdive/contracts/http/consumers/react_query.py, line 10

  queryFn: () => fetch(`/api/users/${id}`),

  src/forensic_deepdive/serve/assets/app.js, line 44

  return fetch(url).then(function (r) { return r.json(); });

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_DOTENV

  .gitignore, line 39

  # Secrets

  .gitignore, line 40

  .env

  docs/RESEARCH.md, line 31

  **Adopt as default: Repomix (`yamadashy/repomix`, 24.6k stars as of May 2026).** `--compress` uses Tree-sitter to extract key code elements (class/function signatures, drop bodies)

  Show more

  docs/v0.8/research_v0.8.md, line 37

  **(e) Evaluation.** Benchmarks: SWE-bench Multilingual (300 instances), SWE-bench Pro (fixed 200-instance subset), SWE-QA (repo QA, GPT-5.4 as LLM judge). Harness = **Mini-SWE-Agen

  examples/hermes-agent/ARCHAEOLOGY.md, line 28

  | `.env.example` | 1 |

  examples/hermes-agent/HOTPATHS.md, line 81

  | `.env.example` | 1 |

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  uv.lock, line 1

  version = 1

  tests/fixtures/cross_stack_polyglot_sample/OrderController.java, line 1

  package com.example;

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit ddef84f6bcba. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 18 Oct 2026

Read how this letter is chosen