io.github.HatmanStack/ragstack

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  publish.py, line 63

  result = subprocess.run(cmd, capture_output=True, text=True, check=check, cwd=cwd)

  publish.py, line 65

  result = subprocess.run(cmd, check=check, cwd=cwd)

  publish.py, line 233

  node_result = subprocess.run(["node", "--version"], capture_output=True, text=True)

  Show more

  publish.py, line 242

  npm_result = subprocess.run(["npm", "--version"], capture_output=True, text=True)

  publish.py, line 283

  aws_result = subprocess.run(["aws", "--version"], capture_output=True, text=True)

  publish.py, line 291

  creds_result = subprocess.run(

  publish.py, line 316

  sam_result = subprocess.run(["sam", "--version"], capture_output=True, text=True)

  publish.py, line 668

  os.remove(zip_path)

  publish.py, line 675

  os.remove(zip_path)

  publish.py, line 680

  os.remove(zip_path)

  src/ragstack-chat/scripts/inject-css-to-bundle.js, line 72

  // fs.unlinkSync(CSS_FILE);

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  requirements.txt, line 3

  boto3>=1.43.111,<2.0

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  lib/ragstack_common/appsync.py, line 80

  with urllib.request.urlopen(req, timeout=10) as response:

  lib/ragstack_common/scraper/fetcher.py, line 72

  def fetch(self, url: str) -> FetchResult:

  lib/ragstack_common/scraper/fetcher.py, line 309

  result = fetcher.fetch(url)

  Show more

  src/lambda/admin_user_provisioner/index.py, line 50

  with urllib.request.urlopen(req) as response:

  src/lambda/budget_sync/index.py, line 94

  with urllib.request.urlopen(req, timeout=30) as response:

  src/lambda/initial_sync/index.py, line 54

  with urllib.request.urlopen(request, timeout=30) as response:

  src/lambda/scrape_discover/index.py, line 136

  result = fetcher.fetch(normalized_url)

  src/ragstack-chat/src/utils/fetchCDNConfig.ts, line 42

  const response = await fetch(configUrl, {

  src/ui/src/components/Search/index.tsx, line 20

  const jsExample = `const res = await fetch(ENDPOINT, {

  src/ui/src/components/Search/index.tsx, line 30

  const curlExample = `curl -X POST 'ENDPOINT' \\

  src/ui/src/components/Upload/index.tsx, line 27

  const res = await fetch(ENDPOINT, {

  src/ui/src/components/Upload/index.tsx, line 38

  await fetch(uploadUrl, { method: 'POST', body: form });`;

  src/ui/src/components/Upload/index.tsx, line 41

  curl -X POST 'ENDPOINT' \\

  src/ui/src/components/Upload/index.tsx, line 67

  const res = await fetch(ENDPOINT, {

  src/ui/src/components/Upload/index.tsx, line 78

  await fetch(uploadUrl, { method: 'POST', body: form });

  src/ui/src/components/Upload/index.tsx, line 81

  const captionRes = await fetch(ENDPOINT, {

  src/ui/src/components/Upload/index.tsx, line 89

  await fetch(ENDPOINT, {

  src/ui/src/components/Upload/index.tsx, line 99

  curl -X POST 'ENDPOINT' \\

  src/ui/src/components/Upload/index.tsx, line 114

  const res = await fetch(ENDPOINT, {

  src/ui/src/components/Upload/index.tsx, line 128

  await fetch(uploadUrl, { method: 'POST', body: form });

  src/ui/src/components/Upload/index.tsx, line 132

  const zipCurlExample = `curl -X POST 'ENDPOINT' \\

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  publish.py, line 786

  env_file = Path("src/ui/.env.production")

  lib/ragstack_common/key_library.py, line 101

  self.table_name = table_name or os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  scripts/configure_ui.sh, line 84

  # Create .env.local

  Show more

  scripts/configure_ui.sh, line 85

  ENV_FILE="src/ui/.env.local"

  src/lambda/appsync_resolvers/resolvers/shared.py, line 53

  METADATA_KEY_LIBRARY_TABLE = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/lambda/ingest_to_kb/index.py, line 66

  table_name = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/lambda/metadata_analyzer/index.py, line 63

  table_name = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/lambda/metadata_analyzer/index.py, line 358

  key_library_table = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/lambda/process_image/index.py, line 88

  table_name = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/lambda/reindex_kb/index.py, line 126

  table_name = os.environ.get("METADATA_KEY_LIBRARY_TABLE")

  src/ragstack-chat/vite.wc.config.ts, line 25

  'SAM_GRAPHQL_API_KEY': JSON.stringify(process.env.SAM_GRAPHQL_API_KEY || ''),

  src/ui/src/config.ts, line 12

  * Or manually create .env.local with these variables.

  .claude/skills/pipeline/doc-auditor.md, line 97

  - Every env var the code reads → should appear in `.env.example` AND README

  .claude/skills/pipeline/doc-auditor.md, line 137

  1. **Code reads `REDIS_URL`** (`src/cache.ts:8`) - not in `.env.example` or README

  .claude/skills/pipeline/doc-reviewer.md, line 49

  - [ ] `.env.example` matches code's env var reads

  .claude/skills/pipeline/eval-day2.md, line 72

  - Glob for `.env.example`, `.env.template` - are required vars documented?

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  ragstack-packaged.yaml, line 1

  AWSTemplateFormatVersion: '2010-09-09'

  src/ui/package-lock.json, line 1

  {

  src/ui/public/vite.svg, line 1

  <?xml version="1.0" encoding="UTF-8"?>

  Show more

  tests/sample-documents/generate_samples.py, line 1

  #!/usr/bin/env python3

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit a96d5943228c. can delete files. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 18 Oct 2026

Read how this letter is chosen