noted

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  bench/index-scale.bench.ts, line 24

  afterAll(() => { fs.rmSync(dir, { recursive: true, force: true }); });

  e2e/agent-activity.e2e.ts, line 11

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

  e2e/agent-activity.e2e.ts, line 15

  string | null) => { if (text === null) fs.rmSync(path.join(v, name), { force: true }); el

  Show more

  e2e/aliases.e2e.ts, line 13

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

  e2e/capture.e2e.ts, line 14

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

  e2e/capture.e2e.ts, line 52

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

  e2e/capture.e2e.ts, line 94

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

  e2e/capture.e2e.ts, line 121

  for (const [name] of SEED_NOTES) fs.rmSync(path.join(noted.vault, name), { force: true });

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  e2e/attachments.e2e.ts, line 60

  const status = (p: string) => win.evaluate(async (u) => (await fetch(u)).status, `app://./${p}`);

  e2e/mcp-http.e2e.ts, line 23

  await expect.poll(async () => (await fetch(url('/mcp'), { method: 'POST', headers: ACCEPT, body: JSON.stringify(INIT) }).catch(() => null))?.status, { timeout: 30_000 }).toBe(401);

  e2e/mcp-http.e2e.ts, line 24

  const init = await fetch(url('/mcp'), { method: 'POST', headers: { ...ACCEPT, Authorization: `Bearer ${token}` }, body: JSON.stringify(INIT) });

  Show more

  e2e/mcp-http.e2e.ts, line 27

  const withHeader = await fetch(url('/mcp'), { method: 'POST', headers: { ...ACCEPT, 'X-MCP-Token': token }, body: JSON.stringify(INIT) });

  e2e/mcp-http.e2e.ts, line 31

  expect((await fetch(url('/mcp'), { method: 'POST', headers:

  e2e/mcp-http.e2e.ts, line 34

  expect((await fetch(url('/sse'), { headers: { 'X-MCP-Token': token } })).status).toBe(404);

  e2e/mcp-http.e2e.ts, line 40

  await expect.poll(async () => (await fetch(url('/sse'), { signal: AbortSignal.timeout(3000) }).catch(() => null))?.status, { timeout: 30_000 }).toBe(401);

  electron/git-ops.ts, line 432

  * All network I/O is done with Node's built-in fetch (Electron 42 / Node 22+).

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  mcp-server/index.ts, line 2614

  const auth = resolveHttpToken(process.env.NOTED_MCP_AUTH_TOKEN || getArgValue('--auth-token'), NOTES_DIR);

  scripts/release.sh, line 5

  # read from .env.local (gitignored) so they never touch the repo or CI. Point at

  scripts/release.sh, line 40

  CREDS="${APPLE_CREDS_ENV:-.env.local}"

  Show more

  scripts/release.sh, line 53

  echo "✗ Missing $v - set it in .env.local (copy from .env.local.example) or the environment." >&2

  .env.local.example, line 2

  # Copy to .env.local (gitignored) and fill in. Never commit real values.

  .gitignore, line 26

  # Local secrets (Apple notarization credentials, etc.) - never commit

  .gitignore, line 27

  .env.local

  .gitignore, line 28

  .env.*.local

  README.md, line 110

  For a **signed + notarized** release, add your Apple credentials to `.env.local`

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  package-lock.json, line 1

  {

  public/icon.icns, line 1

  icns

  shared/vault/pending.test.ts, line 1

  // @vitest-environment node

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 6aa570b11c0c. can delete files. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 24 Oct 2026

Read how this letter is chosen