Yolo Data

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  requirements.txt, line 3

  openpyxl>=3.1,<4

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  .start-test.sh, line 163

  if printf '%s' "$(curl --silent --noproxy '*' --max-time 2 "$url/api/health" 2>/dev/null || true)" \

  .start-test.sh, line 179

  health_body="$(curl --silent --noproxy '*' --fail --max-time 2 "$url/api/health" 2>/dev/null || true)"

  start.sh, line 164

  if printf '%s' "$(curl --silent --noproxy '*' --max-time 2 "$url/api/health" 2>/dev/null || true)" \

  Show more

  start.sh, line 180

  health_body="$(curl --silent --noproxy '*' --fail --max-time 2 "$url/api/health" 2>/dev/null || true)"

  public/js/components/authGate.js, line 39

  const response = await fetch('/api/auth/me', { headers: { Accept: 'application/json' } });

  public/js/components/authGate.js, line 106

  const response = await fetch('/api/auth/login', {

  public/js/components/authGate.js, line 140

  await fetch('/api/auth/logout', { method: 'POST' });

  public/js/components/authGate.js, line 194

  const response = await fetch('/api/auth/password', {

  public/js/pages/help.js, line 64

  const response = await fetch(HELP_BASE + article.file, { headers: { Accept: 'text/markdown' } });

  Dockerfile, line 41

  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8088)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/run-eval.mjs, line 251

  const apiKey = process.env.EVAL_JUDGE_API_KEY;

  src/auth.js, line 69

  const fallback = String(defaultPassword ?? process.env.DEFAULT_USER_PASSWORD ?? '').trim()

  src/auth.js, line 96

  const configured = String(process.env.DEFAULT_USER_PASSWORD ?? '').trim();

  Show more

  src/config.js, line 41

  // 配置面：yolo-conf.yaml 提供结构与默认值，真实环境变量覆盖；平台不读取 .env 文件。

  src/configFile.js, line 7

  // 平台不再读取 .env 文件：配置写在 yolo-conf.yaml，机密用真实环境变量提供

  src/envFile.js, line 26

  // Existing process environment always wins; .env fills only unset/empty keys.

  src/envFile.js, line 29

  filePath = path.join(projectRoot, '.env'),

  .dockerignore, line 14

  # 机密不要在构建上下文里携带，运行时用 environment 覆盖。

  .dockerignore, line 15

  .env

  .env.example, line 1

  # Copy to .env for machine-local settings. .env is ignored by Git.

  .env.example, line 2

  # Process environment variables override .env; .env overrides yolo-conf.yaml.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  src/agent.js, line 1

  import { suggestChart } from './chart.js';

  tests/evalJudge.test.mjs, line 1

  import assert from 'node:assert/strict';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 89652da912b3. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen