juror

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  qa/finalize-fallback.mjs, line 314

  fs.rmSync(reportPath, { force: true });

  qa/finalize-fallback.mjs, line 315

  fs.rmSync(summaryPath, { force: true });

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  cloud/src/app.tsx, line 15

  fetch('/api/onboarding/status', { credentials: '

  cloud/src/pages.tsx, line 124

  const response = await fetch(`/api/findings/${finding.id}/diff`, { credentials: '

  cloud/src/pages.tsx, line 285

  const manageInstallation = async () => { const response = await fetch('/api/github/manage-url', { credentials: '

  Show more

  cloud/src/pages.tsx, line 365

  const response = await fetch('/api/auth/oauth2/consent', {

  cloud/src/pages.tsx, line 422

  const response = await fetch('/api/onboarding/installations', { credentials: '

  cloud/src/pages.tsx, line 430

  const response = await fetch('/api/repositories', { credentials: '

  cloud/src/pages.tsx, line 442

  fetch('/api/onboarding/status', { credentials: '

  cloud/src/pages.tsx, line 474

  const result = await fetch('/api/github/install-url', { credentials: '

  src/qa/browser.ts, line 2039

  response = await fetch(bootstrap.url, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  cloud/runner/runner.mjs, line 31

  const githubPlaceholder = encodeURIComponent(process.env.GITHUB_TOKEN || 'juror-outbound-token');

  qa/finalize-fallback.mjs, line 377

  secrets = configuredSecrets(process.env.JUROR_QA_SECRETS_B64);

  qa/stage-evidence.mjs, line 349

  const canaries = decodeCanaries(options.secretsB64 ?? process.env.JUROR_QA_SECRETS_B64);

  Show more

  src/cli.ts, line 300

  * Minimal `.env` loader. A dependency for this would be silly, and keeping it in-tree means

  src/cli.ts, line 401

  const loaded = loadEnvFile(args.envFile ?? path.join(initRepoDir, '.env'));

  src/cli.ts, line 430

  const loaded = loadEnvFile(args.envFile ?? path.join(repoDir, '.env'));

  src/cli.ts, line 444

  githubAccessToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? null;

  src/cli.ts, line 514

  // `.env`) are neither part of the collected diff nor copied into the model read root.

  src/cli.ts, line 705

  const direct = process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim();

  src/cli.ts, line 868

  return Object.values(decodeQaSecrets(process.env.JUROR_QA_SECRETS_B64));

  src/cli.ts, line 1051

  // therefore never auto-loads repoDir/.env and accepts only credential names from an explicit,

  src/init.ts, line 553

  ? `--set-secrets found no provider keys or ${QA_SECRETS_BUNDLE}; add them to the environment or repo .env first`

  src/init.ts, line 554

  : '--set-secrets found no provider keys; add them to the environment or repo .env first',

  src/github/publish.ts, line 201

  // it can echo back a key it found in a fixture or a .env. A second regex pass is cheap;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  apps/marketing/package-lock.json, line 1

  {

  apps/marketing/public/demos/juror-chatgpt-plugin-demo.webm, line 1

  Eߣ�B��
  B��
  B�B�B��webmB��B��S�g
  

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0742ebb365e3. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen