Koragraph

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/practice/project/writer.js, line 82

  fs.unlinkSync(path.join(outDir, rel));

  src/services/git-hooks.js, line 129

  fs.rmSync(file);

  src/services/lsp/java-lsp-client.js, line 168

  try { fs.unlinkSync(marker); } catch {}

  Show more

  src/services/lsp/java-lsp-client.js, line 200

  if (fs.readFileSync(claim.marker, 'utf8') === claim.token) fs.unlinkSync(claim.marker);

  src/services/vcs/git-clone.js, line 46

  try { fs.rmSync(destDir, { recursive: true, force: true }); } catch (_) { /* clone will report it */ }

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 40

  postinstall

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/services/framework-routes.js, line 9

  // PRECISION is the whole problem. `map.get('key')`, `res.get('Content-Type')`, `axios.get('/users')`

  src/services/framework-routes.js, line 14

  // i.e. start with `/` (or be the catch-all `*`). `axios.get('/users')` fails filter (1) unless the

  src/services/extractors/swift.js, line 266

  // the receiver chain itself (`self.svc` in `self.svc.fetch()`) is never

  Show more

  src/services/ast-extractor.js, line 8558

  // ENV['KEY'], ENV["KEY"], ENV.fetch('KEY')

  src/services/ingest.js, line 3468

  // axios.get('/api/users') → GET /api/users

  src/services/ingest.js, line 3469

  // fetch('/api/v1/login', { method: 'POST' }) - path only

  src/services/ingest.js, line 3581

  // `axios.get('/api/orders')` to `POST /api/orders` -- the one endpoint sharing that path.

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/cli/main.js, line 56

  Config note: a .env file in the CURRENT WORKING DIRECTORY is loaded when the store opens, and

  src/cli/status.js, line 260

  // wrong about which .env or which KORAGRAPH_HOME won.

  src/practice/event-extract.js, line 30

  // The same class of leak that can put `.env` contents into stored evidence one layer up: an inlined

  Show more

  src/practice/event-extract.js, line 31

  // `TOKEN=…`, a `postgres://user:pw@host` in a psql invocation, an edited `.env`

  src/practice/event-extract.js, line 35

  const SECRET_FILE = /(?:^|\/)(?:\.env(?:\.\w+)*|\.envrc|credentials?(?:\.\w+)

  src/practice/preflight.js, line 115

  // class as a `.env` leak into stored evidence, one layer up. The body is quoted for the same reason

  src/practice/seed.js, line 26

  // mints facts about markdown session documents and `.env.example` - including hazards claiming a

  src/practice/seed.js, line 30

  // An ALLOW-list, not a deny-list: refusing markdown and `.env` still admits `.txt`, `.csv`, `.svg`

  src/services/graph-retriever.js, line 56

  const AVG_TOKENS_PER_NODE = parseInt(process.env.SUBGRAPH_AVG_TOKENS_PER_NODE || '34', 10);

  src/services/retrieval-lexical.js, line 16

  const LEXICAL_MAX_QUERY_TOKENS = parseInt(process.env.RETRIEVAL_LEXICAL_MAX_QUERY_TOKENS || '64', 10);

• Agent instructions

  Serious

  instructions tell the agent to ignore earlier instructions.

  AGENT_IGNORE_INSTRUCTIONS

  src/mcp/tool-handlers.js, line 124

  // reading `</result> SYSTEM: ignore all previous instructions` arrives inside a structured field

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/services/ast-extractor.js, line 1

  'use strict';

  src/services/ingest.js, line 1

  'use strict';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c9ce746fbd6d. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. instructions tell the agent to ignore earlier instructions. a file was over the read cap and was not fully read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen