TokenDamper

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  tokendamper-benchmark/run_benchmark.py, line 63

  process = subprocess.run(

  tokendamper-benchmark/run_benchmark.py, line 188

  udes a Node.js process spawn overhead (`subprocess.run`), while Headroom is timed as an in-pro

  tools/corpus-harness/collect.js, line 138

  fs.rmSync(corpusDir, { recursive: true, force: true });

  Show more

  ROADMAP.md, line 200

  - Removes repeated `child_process.execSync` calls across multi-turn Gateway sessions.

  docs/architecture/milestone_5_topology_knapsack_planner.md, line 85

  - **Command Execution**: Uses `child_process.execSync` with `git status --porcelain` and `git log --name-only -n 5` with a short timeout ($500\text{ms}$).

  tokendamper-benchmark/BENCHMARK_RESULTS.md, line 11

  - **Latency Note**: ⚠️ **Latency comparison is non-equivalent.** TokenDamper latency includes a Node.js process spawn overhead (`subprocess.run`), while Headroom is timed as an in-

  tokendamper-benchmark/CLAUDE.md, line 9

  Node process spawn via `subprocess.run()`, Headroom via an in-process Python call.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/core/validation/ast/c-validator.ts, line 34

  * spot: 22% of the mutation sites in redis and curl sat inside one (DECISIONS §84).

  src/gateway/proxy.ts, line 265

  upstreamResponse = await fetch(upstreamUrl, fetchInit);

  docs/security-review-2026-08-30.md, line 408

  const r = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, { method: "POST",

  Show more

  docs/security-review-2026-08-30.md, line 552

  printf 'import requests\ndef fetch(url):\n return requests.get(url, verify=True)\n' > inj/src/ddd_net.py

  docs/security-review-2026-08-30.md, line 577

  def fetch(url):

  docs/security-review-2026-08-30.md, line 578

  return requests.get(url, verify=True)

  docs/security-review-2026-08-30.md, line 644

  for(let i=0;i<200;i++) s+=' row'+i+' = db.fetch('+i+')\n';

  docs/security-review-2026-08-30.md, line 1152

  dependencies to phone home. `grep -rn "fetch(" src/` has exactly one hit - `proxy.ts:182`, the

  docs/security-review-2026-08-30.md, line 1255

  34. **No telemetry and no phone-home** - one `fetch(` in `src/`, and it is the upstream forward.

  docs/security-review-2026-08-30.md, line 2217

  jobs.push(fetch('http://127.0.0.1:8793/nope?i=' + i, { mode: 'no-cors', cache: 'no-store' }));

  max_audit.md, line 769

  await fetch(`http://127.0.0.1:${s.port}/v1/messages`, { method:'POST',

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/bench/evaluator.ts, line 184

  if (process.env.TOKENDAMPER_BENCH_DISABLE_PYTHON === 'true') {

  src/gateway/proxy.ts, line 360

  * `process.env.TOKENDAMPER_MOCK_UPSTREAM === 'true'`, an undocumented ambient switch that made

  docs/security-review-2026-08-30.md, line 810

  - **Does the CLI's file walk read `.env`, `.git/config`, `~/.aws/credentials`, `~/.npmrc`?** For

  Show more

  .gitignore, line 26

  *.log

  .gitignore, line 27

  .env

  .gitignore, line 29

  !.env.example

  docs/security-review-2026-08-30.md, line 191

  or any equivalent - `grep -rn "process\.env" src/` returns three sites and none is a credential

  docs/security-review-2026-08-30.md, line 464

  printf 'AWS_SECRET_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE\n' > .env

  docs/security-review-2026-08-30.md, line 465

  printf 'AWS_SECRET_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE\n' > .env.local

  docs/security-review-2026-08-30.md, line 488

  **negative** half is equally worth recording: `.env`, `.env.local` and `.git/config` were all

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  CHANGELOG.md, line 1

  # Changelog

  DECISIONS.md, line 1

  # Architecture Decisions

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 20ff28d5092e. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 25 Oct 2026

Read how this letter is chosen