io.github.Ranork/remnus

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  cli/src/lib/map.js, line 96

  try { fs.unlinkSync(tmp); } catch { /* already gone */ }

  mcpb/server/index.js, line 150

  try { fs.unlinkSync(LOCK_PATH); } catch { /* raced with the owner's own cleanup */ }

  mcpb/server/index.js, line 160

  try { fs.unlinkSync(LOCK_PATH); } catch { /* already gone */ }

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  cli/src/commands/doctor.js, line 46

  const res = await fetch('https://registry.npmjs.org/remnus/latest', { signal: controller.signal });

  cli/src/commands/doctor.js, line 62

  const res = await fetch(config.mcpUrl, {

  cli/src/commands/doctor.js, line 103

  const res = await fetch(config.mcpUrl, {

  Show more

  cli/src/commands/init.js, line 68

  const res = await fetch(raw, { signal: controller.signal });

  cli/src/commands/mcp.js, line 152

  const res = await fetch(config.mcpUrl, {

  cli/src/lib/install.js, line 39

  const res = await fetch(`${serverUrl}/api/install/poll?device_id=${encodeURIComponent(deviceId)}`, {

  cli/src/lib/install.js, line 231

  const res = await fetch(url, {

  cli/src/lib/rpc.js, line 42

  const res = await fetch(mcpUrl, {

  src/app/api/upload/download/route.ts, line 42

  const upstream = await fetch(url, { redirect: 'manual' });

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  next.config.ts, line 88

  // alone are not sufficient because Next loads .env during local production

  next.config.ts, line 91

  const phApiKey = process.env.POSTHOG_API_KEY;

  cli/src/commands/doctor.js, line 213

  // is committed and `credentials.json` is not, so everyone after the first person

  Show more

  cli/src/commands/doctor.js, line 230

  if (!ignoreText.includes('.remnus/credentials.json')) {

  cli/src/commands/doctor.js, line 232

  warn('.remnus/credentials.json is not listed in .gitignore.');

  cli/src/commands/init.js, line 169

  detail('.remnus/credentials.json (git-ignored)');

  cli/src/commands/join.js, line 21

  // committed `.remnus/config.json`; `.remnus/credentials.json` is git-ignored and

  cli/src/commands/join.js, line 26

  // **This command writes exactly one file: `.remnus/credentials.json`.** It does

  cli/src/commands/join.js, line 151

  detail('.remnus/credentials.json (git-ignored)');

  src/auth.ts, line 69

  const secret = new TextEncoder().encode(process.env.AUTH_SECRET);

  src/app/[locale]/oauth/authorize/page.tsx, line 18

  const secret = process.env.AUTH_SECRET;

  src/app/[locale]/oauth/authorized/page.tsx, line 11

  const secret = process.env.AUTH_SECRET;

  src/app/api/auth/client-bridge/route.ts, line 18

  const secret = new TextEncoder().encode(process.env.AUTH_SECRET);

  src/app/api/cron/emails/route.ts, line 148

  const secret = process.env.CRON_SECRET;

  src/app/api/cron/prospect-gifts/route.ts, line 27

  const secret = process.env.CRON_SECRET;

  src/app/api/cron/recurrence/route.ts, line 37

  const secret = process.env.CRON_SECRET;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  AGENTS.md, line 1

  # Codex project instructions

  package-lock.json, line 1

  {

  messages/hi.json, line 1

  {

  Show more

  messages/ru.json, line 1

  {

  src/components/features/ViewsBar.tsx, line 1

  'use client';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 6b927de6aca9. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen