janee

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  packages/create-gh-app/create-gh-app.mjs, line 207

  fs.rmSync(dir, { recursive: true, force: true });

  src/cli/config-yaml.test.ts, line 50

  fs.rmSync(testConfigDir, { recursive: true, force: true });

  src/cli/commands/sessions-revoke.test.ts, line 48

  fs.rmSync(TEST_DIR, { recursive: true, force: true });

  Show more

  src/core/audit.test.ts, line 24

  fs.rmSync(tempDir, { recursive: true, force: true });

  src/core/exec.ts, line 231

  if (askpassFile) try { fs.unlinkSync(askpassFile); } catch { /* best effort */ }

  src/core/exec.ts, line 256

  if (askpassFile) try { fs.unlinkSync(askpassFile); } catch { /* best effort */ }

  src/core/sessions-persistence.test.ts, line 17

  fs.rmSync(tmpDir, { recursive: true, force: true });

  src/core/sessions.test.ts, line 19

  fs.rmSync(tmpDir, { recursive: true, force: true });

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 20

  postinstall

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  packages/create-gh-app/create-gh-app.mjs, line 60

  const res = await fetch(`https://api.github.com${urlPath}`, {

  scripts/test-service-account.ts, line 137

  const response = await fetch(

  src/cli/commands/doctor.ts, line 17

  const res = await fetch(`${url}/v1/health`, {

  Show more

  src/cli/commands/doctor.ts, line 35

  const res = await fetch(`${url}/v1/exec/authorize`, {

  src/core/authority.test.ts, line 40

  const res = await fetch(`${baseUrl}/v1/exec/authorize`, {

  src/core/authority.test.ts, line 55

  const healthRes = await fetch(`${baseUrl}/v1/health`);

  src/core/authority.test.ts, line 73

  const res = await fetch(`${baseUrl}/v1/exec/authorize`, {

  src/core/authority.test.ts, line 105

  const res = await fetch(`${baseUrl}/v1/exec/authorize`, {

  src/core/authority.test.ts, line 126

  const res = await fetch(`${baseUrl}/v1/exec/authorize`, {

  src/core/github-app.ts, line 125

  const response = await fetch('https://api.github.com/app', {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

  src/cli/config-yaml.test.ts, line 2

  * Tests for config split (config.yaml + credentials.json)

  src/cli/config-yaml.test.ts, line 39

  testCredentialsFile = path.join(testJaneeDir, 'credentials.json');

  src/cli/config-yaml.test.ts, line 55

  it('should write secrets to credentials.json, not config.yaml', () => {

  Show more

  src/cli/config-yaml.test.ts, line 79

  // credentials.json should exist with masterKey and encrypted secret

  src/cli/config-yaml.test.ts, line 325

  // Replace encrypted value with plaintext in credentials.json

  src/cli/config-yaml.test.ts, line 370

  // credentials.json should exist

  src/cli/config-yaml.ts, line 6

  * credentials.json - encrypted secrets + master key (never hand-edited)

  src/cli/config-yaml.ts, line 100

  /** Shape of secrets stored per service in credentials.json */

  src/cli/commands/authority.ts, line 18

  const runnerKey = options.runnerKey || process.env.JANEE_RUNNER_KEY;

  src/cli/commands/doctor.test.ts, line 118

  const origEnv = process.env.JANEE_RUNNER_KEY;

  src/cli/commands/doctor.test.ts, line 119

  delete process.env.JANEE_RUNNER_KEY;

  src/cli/commands/doctor.test.ts, line 128

  process.env.JANEE_RUNNER_KEY = origEnv;

  src/cli/commands/doctor.ts, line 121

  const runnerKey = options.runnerKey || process.env.JANEE_RUNNER_KEY;

  src/cli/commands/serve-mcp.ts, line 143

  const runnerKey = options.runnerKey || process.env.JANEE_RUNNER_KEY;

  src/cli/commands/serve-mcp.ts, line 154

  const runnerKey = options.runnerKey || process.env.JANEE_RUNNER_KEY;

  src/cli/commands/serve-mcp.ts, line 311

  const runnerKey = options.runnerKey || process.env.JANEE_RUNNER_KEY;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 012344840216. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen