Peta Core

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  scripts/release-main.js, line 221

  fs.rmSync(tempRoot, { force: true, recursive: true });

  scripts/release-main.js, line 664

  fs.rmSync(tempRoot, { force: true, recursive: true });

  src/services/CloudflaredService.ts, line 681

  await fs.unlink(file);

  Show more

  src/services/SkillsService.ts, line 409

  await fs.rm(targetDir, { recursive: true, force: true });

  src/services/SkillsService.ts, line 438

  await fs.rm(tempDir, { recursive: true, force: true });

  src/services/SkillsService.ts, line 470

  await fs.rm(targetDir, { recursive: true, force: true });

  src/services/SkillsService.ts, line 507

  await fs.rm(serverSkillsDir, { recursive: true, force: true });

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 36

  postinstall

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  CLAUDE.md, line 345

  curl http://localhost:3002/health

  CLAUDE.md, line 357

  curl -O https://raw.githubusercontent.com/dunialabs/peta-core/main/docs/docker-deploy.sh

  CLAUDE.md, line 429

  curl http://localhost:3002/health

  Show more

  docs/docker-deploy.sh, line 91

  if curl -sf $url > /dev/null 2>&1; then

  docs/docker-deploy.sh, line 258

  test: ['CMD-SHELL', 'curl -f http://localhost:\${BACKEND_PORT}/health']

  docs/docker-deploy.sh, line 545

  echo -e " 1. Verify service by accessing health check endpoint: ${BLUE}curl http://localhost:${BACKEND_PORT}/health${NC}"

  scripts/start-app.js, line 217

  const response = await fetch(petaAuthHealthUrl, { signal: controller.signal });

  scripts/compat-smoke/run.mjs, line 547

  const response = await fetch(`${BASE_URL}/mcp`, {

  scripts/compat-smoke/run.mjs, line 592

  const response = await fetch(url, {

  scripts/compat-smoke/run.mjs, line 887

  const response = await fetch(url);

  scripts/compat-smoke/run.mjs, line 901

  const response = await fetch(url);

  src/controllers/handlers/ServerHandler.ts, line 323

  const response = await fetch(`${PETA_AUTH_CONFIG.BASE_URL}/v1/oauth/exchange`, {

  src/mcp/core/ModernHttpDownstreamClient.ts, line 219

  const response = await fetch(options.url, {

  docs/api/ADMIN_API.md, line 144

  const response = await fetch('http://localhost:3002/admin', {

  docs/api/USER_API.md, line 68

  const response = await fetch('http://localhost:3002/user', {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  CLAUDE.md, line 364

  # 3. Create docker-compose.yml and .env

  docs/docker-deploy.sh, line 340

  # Create .env file

  docs/docker-deploy.sh, line 341

  log_step "Creating .env file"

  Show more

  docs/docker-deploy.sh, line 343

  cat > .env <<EOF

  docs/docker-deploy.sh, line 396

  log_success ".env file created successfully"

  docs/docker-deploy.sh, line 397

  log_warn "Please keep the .env file secure, it contains sensitive information"

  docs/docker-deploy.sh, line 452

  echo -e " 1. Edit the .env file and modify database configuration to match existing database password:"

  docs/docker-deploy.sh, line 453

  echo -e " ${BLUE}vi $(pwd)/.env${NC}"

  scripts/compat-smoke/run.mjs, line 29

  const OWNER_TOKEN = getArg('--owner-token') || process.env.PETA_COMPAT_OWNER_TOKEN;

  scripts/compat-smoke/run.mjs, line 38

  const JWT_SECRET = process.env.JWT_SECRET;

  src/index.ts, line 625

  const keyPath = process.env.SSL_KEY_PATH || '/Users/tataufo/cert/localhost+2-key.pem';

  src/config/resultCacheConfig.ts, line 110

  process.env.RESULT_CACHE_KEY_PREFIX?.trim() || `peta:${process.env.NODE_ENV || 'dev'}`;

  src/controllers/handlers/ServerHandler.ts, line 810

  const key = process.env.JWT_SECRET;

  src/oauth/services/OAuthService.ts, line 14

  this.jwtSecret = process.env.JWT_SECRET || '';

  src/security/OAuthTokenValidator.ts, line 39

  const jwtSecret = process.env.JWT_SECRET;

  src/user/UserRequestHandler.ts, line 265

  const key = process.env.JWT_SECRET;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  package-lock.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 7dd6e247d0b5. can delete files. runs a script at install time. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen