kilotest

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  apiIntegration.test.ts, line 51

  await fs.rm(path.dirname(featureRequestsPath), {recursive: true, force: true});

  index.test.ts, line 68

  await fs.unlink(path.join(dir, file)).catch(() => {});

  index.test.ts, line 98

  await fs.unlink(path.join(dir, file)).catch(() => {});

  Show more

  index.test.ts, line 423

  await fs.unlink(imgPath).catch(() => {});

  index.test.ts, line 444

  await fs.unlink(imgPath).catch(() => {});

  index.test.ts, line 590

  await fs.unlink(path.join(fixtureDBDir, 'jobs', 'queue', `${reportIdentifier}.json`));

  index.test.ts, line 604

  await fs.unlink(path.join(fixtureDBDir, 'jobs', 'queue', `${reportIdentifier}.json`));

  index.test.ts, line 673

  await fs.unlink(path.join(claimedDir, file)).catch(() => {});

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  alerts.ts, line 29

  const req = https.request({

  apiIntegration.test.ts, line 77

  const req = http.request(options, response => {

  index.test.ts, line 122

  const req = http.request(options, response => {

  Show more

  index.test.ts, line 146

  const req = http.request(options, response => {

  indexBalances.test.ts, line 85

  const req = http.request(options, response => {

  linkValidation.test.ts, line 156

  // Find all fetch paths (JavaScript: fetch('/path', ...))

  mcp.test.ts, line 276

  const req = http.request({

  mcp.test.ts, line 404

  const req = http.request({

  routing.test.ts, line 52

  http.request({method: 'GET', host: 'localhost', port, path: requestPath}, response => {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  alerts.test.ts, line 63

  process.env.ALERT_API_KEY = '

  alerts.ts, line 18

  const ALERT_API_KEY = process.env['ALERT_API_KEY'];

  scripts/postPR.ts, line 3

  re run explicitly because the project's .npmrc sets ignore-scripts=true, which disable

  Show more

  index.test.ts, line 31

  // imported, prevents a real .env file's alert credentials from ever taking effect.

  index.test.ts, line 2205

  const savedKey = process.env.KEY;

  index.test.ts, line 2211

  process.env.KEY = keyPath;

  index.test.ts, line 2239

  process.env.KEY = savedKey;

  index.test.ts, line 2242

  delete process.env.KEY;

  index.ts, line 1469

  const key = await fs.readFile(process.env.KEY as string, 'utf8');

  util.ts, line 995

  // so a variable set (e.g. in .env) after this module first loads still takes effect. Used

  scripts/prePR.ts, line 3

  is run explicitly because the project's .npmrc sets ignore-scripts=true, which disable

  .gitignore, line 19

  # Secrets and environment-specific configurations

  .gitignore, line 20

  .env

  README.md, line 38

  1. Copy the `env.testaro` file from the `kilotest` directory to `.env` in the `testaro` directory and replace the `__placeholder__` values in `.env` with actual values.

  README.md, line 39

  1. Copy the `env.example` file in the `kilotest` directory to a new `.env` file in the same directory and replace the `__placeholder__` values in `.env` with actual values. `TESTAR

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  package-lock.json, line 1

  {

  docs/SERVICE.md, line 190

  kilotest.com,resend._domainkey.kilotest.com,TXT,"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWjPkYLQ+xYcmMRODdXoXl7QTXK5TkhNQXjl5HcPvk1D5A5eqtjuw17lgZOQy1wiUq8BGId+Iq3BWO32kYTJo+lWMQJ

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c8df7d316414. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen