github JavaScript analyzed 99beb18 deep scan · partial (351/1,478 files)

BaiGanio/aperio

github

One brain. Every AI agent. Nothing forgotten. — Self-hosted memory layer via MCP + Postgres + pgvector

maintainer: BaiGanio
licence: MIT
first seen: 2026-06-08
last seen: 2026-08-27
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-08-27 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-26 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-26 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-26 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-24 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-24 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-22 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-20 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-16 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-15 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-13 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-13 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-13 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-08-07 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-07-29 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-07-18 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-07-15 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-07-10 code analysis flagged dynamic code execution in BaiGanio/aperio
HIGH 2026-07-08 code analysis flagged dynamic code execution in BaiGanio/aperio

capabilities 24 tools

transport stdio · http counts 24 tools · 0 res · 0 prompts permission surface via code analysis

tools

append_file
create_github_issue
delete_file
describe_image
edit_file
fetch_github_issue
fetch_url
generate_docx
generate_xlsx
grep_files
list_github_issues
preprocess_image
read_docx
read_file
read_image
record_issue_triage
run_node_script
run_python_script
run_shell
scan_project
syntax_check
update_github_issue
web_search
write_file

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 99beb18 · analyzer v33 · 1w ago

skills & prompt files 36

danger signals9

dynamic code execution vm exec BaiGanio-aperio-99beb18/scripts/diff-locales.js :33 vm.runInNewContext(
suspicious endpoint 169.254.169.254 (cloud metadata) BaiGanio-aperio-99beb18/tests/unit/helpers/ssrfGuard.test.js :37 test("rejects cloud metadata endpoint", () => rejects("http://169.254.169.254/latest/meta-data/"));
suspicious endpoint 8.8.8.8 BaiGanio-aperio-99beb18/tests/unit/helpers/ssrfGuard.test.js :44 await assert.doesNotReject(() => assertPublicUrl("http://8.8.8.8/")));
suspicious endpoint 169.254.169.254 (cloud metadata) BaiGanio-aperio-99beb18/tests/unit/tools/web.test.js :125 const result = await fetchUrlHandler({ url: "http://169.254.169.254/latest/meta-data/" });
committed secret GitHub fine-grained PAT BaiGanio-aperio-99beb18/audit/tests/triage.test.js :1186 github…(80 chars, redacted)
committed secret GitHub token BaiGanio-aperio-99beb18/audit/tests/triage.test.js :1196 ghp_01…(40 chars, redacted)
committed secret Anthropic key BaiGanio-aperio-99beb18/audit/tests/triage.test.js :1589 sk-ant…(35 chars, redacted)
committed secret Anthropic key BaiGanio-aperio-99beb18/tests/integration/agent/providers/claude-code.test.js :320 sk-ant…(49 chars, redacted)
committed secret Anthropic key BaiGanio-aperio-99beb18/tests/unit/helpers/redactSecrets.test.js :10 sk-ant…(37 chars, redacted)

code evidence vv0.68.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 927

filesystem 278

fs (weak) BaiGanio-aperio-99beb18/.github/scripts/nuke.cjs :1 const fs = require('fs');
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/bootstrap-contract.js :20 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/config-contract.js :13 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/database-contract.js :13 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/inventory.js :11 import { readdirSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/ledger.js :12 } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/manifest.js :14 import { readFileSync, existsSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/memory-contract.js :12 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/provider-contract.js :24 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/registry-contract.js :36 import { readFileSync, readdirSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/routes-contract.js :13 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/scripts/slice-execution.js :30 import { readFileSync, realpathSync, statSync } from "node:fs";

show 28 more

fs (weak) BaiGanio-aperio-99beb18/audit/scripts/usage-accounting.js :128 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/tests/ledger.test.js :9 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/tests/registry-contract.test.js :18 import { readFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/tests/slice-execution.test.js :8 import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/tests/triage.test.js :13 import { readFileSync, readdirSync } from "node:fs";
fs (weak) BaiGanio-aperio-99beb18/audit/tests/usage-accounting.test.js :17 import { readFileSync } from "node:fs";
fs BaiGanio-aperio-99beb18/bootstrap.js :3 import { createWriteStream, existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
fs BaiGanio-aperio-99beb18/db/encrypt.js :23 import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync, statSync, renameSync } from 'node:fs';
fs BaiGanio-aperio-99beb18/db/migrate-sqlite.js :6 import { readdir, readFile } from 'fs/promises';
fs BaiGanio-aperio-99beb18/db/migrate.js :1 import { readdir, readFile } from 'fs/promises';
fs BaiGanio-aperio-99beb18/db/sqlite/encryption.js :7 import { copyFileSync, existsSync, renameSync, unlinkSync } from 'fs';
fs BaiGanio-aperio-99beb18/db/sqlite/store.js :32 import { mkdirSync, existsSync } from 'fs';
fs BaiGanio-aperio-99beb18/lib/agent/bundle.js :1 import { existsSync, readFileSync, statSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/agent/deliverables.js :11 import { writeFileSync, mkdirSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/agent/index.js :1 import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, readdirSync, copyFileSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/agent/providers/codex.js :2 import { mkdirSync, readdirSync, renameSync, statSync, writeFileSync, unlinkSync } from "node:fs";
fs BaiGanio-aperio-99beb18/lib/codegraph/backends/postgres.js :11 import { readFile, stat } from 'fs/promises';
fs BaiGanio-aperio-99beb18/lib/codegraph/backends/sqlite.js :14 import { readFile, stat } from 'fs/promises';
fs BaiGanio-aperio-99beb18/lib/codegraph/indexer.js :8 import { readdir, stat } from 'fs/promises';
fs BaiGanio-aperio-99beb18/lib/config-sync.js :16 import { readFileSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/context/artifactStore.js :20 } from "node:fs";
fs BaiGanio-aperio-99beb18/lib/db-connect/drivers/managed-sqlite.js :31 import { existsSync, unlinkSync, renameSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/db-connect/extraction.js :49 import { existsSync, mkdirSync, renameSync, unlinkSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/db-connect/file-lock.js :89 import { openSync, closeSync, writeSync, readFileSync, unlinkSync, renameSync, statSync, existsSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/db-connect/sample-db.js :16 import { existsSync, mkdirSync, rmSync } from "fs";
fs BaiGanio-aperio-99beb18/lib/db-connect/secrets.js :15 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
fs BaiGanio-aperio-99beb18/lib/docgraph/backends/postgres.js :9 import { readFile, stat } from 'fs/promises';
fs BaiGanio-aperio-99beb18/lib/docgraph/backends/sqlite.js :17 import { readFile, stat } from 'fs/promises';

238 more not shown — this panel samples each group; the count above is the real total.

shell / exec 89

shell (weak) BaiGanio-aperio-99beb18/.github/scripts/nuke.cjs :3 const { execSync, execFileSync } = require('child_process');
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/config-contract.js :14 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/inventory.js :10 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/manifest.js :16 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/memory-contract.js :13 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/provider-contract.js :25 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/scripts/routes-contract.js :14 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/audit/tests/manifest.test.js :11 import { execFileSync } from "node:child_process";
shell BaiGanio-aperio-99beb18/bootstrap.js :2 import { spawn, execSync, exec } from 'child_process';
shell BaiGanio-aperio-99beb18/db/encrypt.js :24 import { execSync, execFileSync } from 'node:child_process';
shell BaiGanio-aperio-99beb18/db/index.js :9 import { spawnSync } from "child_process";
shell BaiGanio-aperio-99beb18/db/postgres/store.js :489 // exact-match + `tags && $` array overlap), so a memory with a different

show 28 more

shell BaiGanio-aperio-99beb18/db/self-memory-seed.js :79 "bootstrap.js downloads a pinned, checksum-verified llama-server release per OS straight into ./vendor/llamacpp: macOS gets the arm64/Metal build, Windows and Linux both get Vulkan builds (broadest si
shell BaiGanio-aperio-99beb18/db/sqlite/search.js :25 // Tags is JSON array; require *any* match (matches Postgres `tags && $`).
shell BaiGanio-aperio-99beb18/db/wiki-seed.js :980 \`PATH\` so the app's own \`spawn('llama-server')\` finds it. Models are separate: the engine
shell BaiGanio-aperio-99beb18/lib/agent/providers/codex.js :1 import { spawn as nodeSpawn } from "node:child_process";
shell BaiGanio-aperio-99beb18/lib/db-connect/file-lock.js :92 import { execFileSync } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/artifactActions.js :1 import { execFile } from "node:child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/capabilities.js :13 import { execFileSync, execFile } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/completion.js :8 import { execFile } from 'node:child_process';
shell BaiGanio-aperio-99beb18/lib/helpers/ensurePort.js :11 import { execSync } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/hardware.js :8 import { execFileSync } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/metricsSampler.js :11 import { exec } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/selfRestart.js :19 import { spawn } from "child_process";
shell BaiGanio-aperio-99beb18/lib/helpers/startLlamaCpp.js :13 import { spawn, execFileSync } from "child_process";
shell BaiGanio-aperio-99beb18/lib/routes/api-meta.js :6 import { exec } from "child_process";
shell BaiGanio-aperio-99beb18/lib/server/browser.js :6 import { execFile } from "child_process";
shell BaiGanio-aperio-99beb18/lib/terminal/signals.js :8 import { spawn } from "child_process";
shell BaiGanio-aperio-99beb18/lib/tools/validateWrittenFile.js :19 import { spawn } from "child_process";
shell BaiGanio-aperio-99beb18/lib/utils/chat-utils.js :202 const out = execSync("lsof", ["-ti", `tcp:${port}`], {
shell BaiGanio-aperio-99beb18/mcp/tools/github.js :5 import { execFile } from "child_process";
shell BaiGanio-aperio-99beb18/mcp/tools/shell.js :2 import { spawn } from "child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-all-dashboards-ci.js :10 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-all-dashboards.js :9 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-browser-dashboard.js :4 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-e2e-dashboard.js :9 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-harness-dashboard.js :8 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-integration-dashboard.js :7 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/generate-unit-dashboard.js :7 import { execFileSync } from "node:child_process";
shell (weak) BaiGanio-aperio-99beb18/scripts/model-tier-bench.js :3 import { spawn, execFileSync } from "node:child_process";

49 more not shown — this panel samples each group; the count above is the real total.

network 74

net BaiGanio-aperio-99beb18/bootstrap.js :6 import net from 'net';
net (weak) BaiGanio-aperio-99beb18/docs/translations.js :5 * (including file:// where fetch() is blocked by CORS).
net BaiGanio-aperio-99beb18/lib/agent/providers/deepseek.js :20 const response = await fetch(`${provider.baseURL}/chat/completions`, {
net BaiGanio-aperio-99beb18/lib/agent/providers/llamacpp.js :133 const h = await fetch(`${provider.llamacppBaseURL}/health`, { signal: AbortSignal.any([c.signal, AbortSignal.timeout(timeout)]) });
net BaiGanio-aperio-99beb18/lib/handlers/wiki/regenerate.js :68 const r = await fetch(`${base}/v1/chat/completions`, {
net BaiGanio-aperio-99beb18/lib/helpers/completion.js :119 const res = await fetch(`${provider.baseURL}/chat/completions`, {
net BaiGanio-aperio-99beb18/lib/helpers/embeddings.js :318 const res = await fetch("https://api.voyageai.com/v1/embeddings", {
net BaiGanio-aperio-99beb18/lib/helpers/ensurePort.js :10 import { createServer } from "net";
net BaiGanio-aperio-99beb18/lib/helpers/llamacpp/models.js :12 const r = await fetch(`${LLAMACPP_BASE_URL}/models`, { signal: AbortSignal.timeout(3000) });
net BaiGanio-aperio-99beb18/lib/helpers/modelProgress.js :102 const r = await fetch(`${routerBaseURL}/models`, { signal: AbortSignal.timeout(STATUS_TIMEOUT) });
net BaiGanio-aperio-99beb18/lib/helpers/ssrfGuard.js :17 import net from "node:net";
net BaiGanio-aperio-99beb18/lib/helpers/startLlamaCpp.js :54 const r = await fetch(`${LLAMACPP_BASE_URL}/health`, { signal: AbortSignal.timeout(1000) });

show 28 more

net BaiGanio-aperio-99beb18/lib/helpers/tlsServer.js :8 import { createServer as createHttpServer } from "http";
net BaiGanio-aperio-99beb18/lib/pricing.js :66 const res = await fetch(url);
net BaiGanio-aperio-99beb18/lib/routes/api-meta.js :206 const r = await fetch(`${llamacppBase}/v1/models`, { signal: AbortSignal.timeout(3000) });
net BaiGanio-aperio-99beb18/lib/terminal/ui.js :251 const schema = await fetch(`http://localhost:${port}/api/config/schema`).then((r) => r.json());
net BaiGanio-aperio-99beb18/lib/utils/chat-utils.js :1 import net from "net";
net BaiGanio-aperio-99beb18/mcp/tools/github.js :105 const resp = await fetch(`${API_BASE}/repos/${owner}/${repo}/issues/${number}`, {
net BaiGanio-aperio-99beb18/mcp/tools/image.js :132 const r = await fetch(`${LLAMACPP_BASE_URL}/v1/chat/completions`, {
net BaiGanio-aperio-99beb18/mcp/tools/web.js :109 const response = await fetch(endpoint, {
net (weak) BaiGanio-aperio-99beb18/public/scripts/agents-panel.js :30 const res = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/api.js :2 fetch('/api/version')
net (weak) BaiGanio-aperio-99beb18/public/scripts/autocomplete.js :102 var resp = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/capabilities-panel.js :20 const res = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/chat.js :64 fetch("/api/sessions?page=1&limit=1")
net (weak) BaiGanio-aperio-99beb18/public/scripts/codegraph-atlas.js :32 const res = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/codegraph-map.js :14 const GRAPH_LIMIT = 300; // default bounded fetch (server hard-caps at 1000)
net (weak) BaiGanio-aperio-99beb18/public/scripts/codegraph-panel.js :40 const res = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/dataset-lab-panel.js :24 const response = await fetch("/api/datasets/catalog");
net (weak) BaiGanio-aperio-99beb18/public/scripts/db-connections-panel.js :23 const r = await fetch(`/api/database/connections${path}`, {
net (weak) BaiGanio-aperio-99beb18/public/scripts/db-panel.js :56 const r = await fetch("/api/database/connections");
net (weak) BaiGanio-aperio-99beb18/public/scripts/docgraph-panel.js :50 const res = await fetch(url);
net (weak) BaiGanio-aperio-99beb18/public/scripts/github-triage-panel.js :14 const r = await fetch(`/api/settings/${encodeURIComponent(key)}`);
net (weak) BaiGanio-aperio-99beb18/public/scripts/i18n.js :574 const res = await fetch(`/locales/${lang}.json`);
net (weak) BaiGanio-aperio-99beb18/public/scripts/identity-info-modal.js :82 const res = await fetch("/api/identity/whoami", {
net (weak) BaiGanio-aperio-99beb18/public/scripts/lite.js :30 fetch("/api/config/client")
net (weak) BaiGanio-aperio-99beb18/public/scripts/memories.js :183 const res = await fetch(`/api/memories/${m.id}/pin`, {
net (weak) BaiGanio-aperio-99beb18/public/scripts/memory-table.js :30 const res = await fetch('/api/memories');
net (weak) BaiGanio-aperio-99beb18/public/scripts/paths-panel.js :10 const d = await fetch("/api/codegraph/repos").then(r => r.json());
net (weak) BaiGanio-aperio-99beb18/public/scripts/rendering.js :382 const res = await fetch("/api/artifact/reveal", {

34 more not shown — this panel samples each group; the count above is the real total.

secrets 26

secrets (weak) BaiGanio-aperio-99beb18/.github/scripts/nuke.cjs :46 const pat = process.env.INPUT_GITHUB_TOKEN || process.env.GITHUB_TOKEN;
secrets BaiGanio-aperio-99beb18/db/postgres/store.js :49 export function assertNonDefaultDbUrl(url, allow = process.env.APERIO_ALLOW_DEFAULT_DB_PASSWORD) {
secrets BaiGanio-aperio-99beb18/lib/agent/providers/codex.js :357 ...(process.env.CODEX_API_KEY ? { OPENAI_API_KEY: process.env.CODEX_API_KEY } : {}),
secrets BaiGanio-aperio-99beb18/lib/handlers/wiki/regenerate.js :84 if (!process.env.DEEPSEEK_API_KEY) throw new Error("DEEPSEEK_API_KEY missing");
secrets BaiGanio-aperio-99beb18/lib/helpers/authGuard.js :15 const t = process.env.APERIO_AUTH_TOKEN;
secrets BaiGanio-aperio-99beb18/lib/helpers/embeddings.js :291 if (!process.env.VOYAGE_API_KEY) {
secrets BaiGanio-aperio-99beb18/lib/helpers/sessionCrypto.js :25 const secret = process.env.APERIO_SESSION_KEY;
secrets BaiGanio-aperio-99beb18/lib/helpers/staticAuth.js :26 if (process.env.APERIO_AUTH_TOKEN && isAuthorized(req)) return next();
secrets BaiGanio-aperio-99beb18/lib/providers/index.js :319 if (PROVIDER === "deepseek") { const model = overrides.model || process.env.DEEPSEEK_MODEL; return { name: "deepseek", model, baseURL: "https://api.deepseek.com/v1", apiKey: process.env.DEEPSEEK_API_K
secrets BaiGanio-aperio-99beb18/lib/routes/api-github-webhook.js :31 const secret = (fromSettings != null && String(fromSettings).trim()) || process.env.GITHUB_WEBHOOK_SECRET;
secrets BaiGanio-aperio-99beb18/lib/routes/api-meta.js :212 if (process.env.ANTHROPIC_API_KEY) {
secrets BaiGanio-aperio-99beb18/mcp/tools/github.js :21 function githubHeaders(token = process.env.GITHUB_TOKEN) {

show 14 more

secrets (weak) BaiGanio-aperio-99beb18/tests/docint/harness/document-intelligence-skill-harness.mjs :475 if (evaluationIsDeepSeek && !process.env.DEEPSEEK_API_KEY?.trim()) {
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/agent.test.js :178 delete process.env.ANTHROPIC_API_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/agent/providers/codex.test.js :175 delete process.env.CODEX_API_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/provider-not-configured.test.js :51 process.env.ANTHROPIC_API_KEY= "[redacted]"
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/routes/api-meta.test.js :574 const origAnthropic = process.env.ANTHROPIC_API_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/routes/api-wiki.test.js :26 delete process.env.VOYAGE_API_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/routes/github-webhook.test.js :77 process.env.GITHUB_WEBHOOK_SECRET = SECRET;
secrets (weak) BaiGanio-aperio-99beb18/tests/integration/server/ws.test.js :124 delete process.env.APERIO_AUTH_TOKEN;
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/helpers/authGuard.test.js :9 delete process.env.APERIO_AUTH_TOKEN;
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/helpers/sessionCrypto.test.js :11 delete process.env.APERIO_SESSION_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/helpers/setupPending.test.js :27 delete process.env.ANTHROPIC_API_KEY;
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/helpers/staticAuth.test.js :8 afterEach(() => { delete process.env.APERIO_AUTH_TOKEN; });
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/tools/github.test.js :254 const previous = process.env.GITHUB_TOKEN;
secrets (weak) BaiGanio-aperio-99beb18/tests/unit/wiki/regenerate.test.js :415 process.env.DEEPSEEK_API_KEY = "test-key";

database 21

db BaiGanio-aperio-99beb18/db/migrate.js :4 import pg from 'pg';
db BaiGanio-aperio-99beb18/db/postgres/store.js :5 import pg from 'pg';
db BaiGanio-aperio-99beb18/db/sqlite/encryption.js :6 import Database from 'better-sqlite3';
db BaiGanio-aperio-99beb18/db/sqlite/store.js :29 import Database from 'better-sqlite3';
db BaiGanio-aperio-99beb18/db/sqlite/vecSupport.js :23 import Database from 'better-sqlite3';
db BaiGanio-aperio-99beb18/lib/db-connect/drivers/managed-sqlite.js :30 import Database from "better-sqlite3";
db BaiGanio-aperio-99beb18/lib/db-connect/drivers/postgres.js :14 import pg from "pg";
db BaiGanio-aperio-99beb18/lib/db-connect/drivers/sqlite.js :13 import Database from "better-sqlite3";
db BaiGanio-aperio-99beb18/lib/db-connect/sample-db.js :15 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/integration/codegraph/backends/sqlite.test.js :10 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/integration/db-connect/sqlite-driver.test.js :10 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/integration/db/contract/backends.js :38 import pg from "pg";

show 9 more

db (weak) BaiGanio-aperio-99beb18/tests/integration/db/postgres-vec-meta.test.js :18 import pg from "pg";
db (weak) BaiGanio-aperio-99beb18/tests/integration/db/postgres-vector-dims.test.js :28 import pg from "pg";
db (weak) BaiGanio-aperio-99beb18/tests/integration/db/reconcile-decrypt.test.js :14 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/integration/handlers/database-confirm.test.js :10 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/integration/handlers/extraction/extractionHandlers.postgres.test.js :20 import pg from "pg";
db (weak) BaiGanio-aperio-99beb18/tests/integration/handlers/extraction/wsG5-2-e2e.postgres.test.js :26 import pg from "pg";
db (weak) BaiGanio-aperio-99beb18/tests/unit/db/postgres.test.js :10 const pg = require("pg");
db (weak) BaiGanio-aperio-99beb18/tests/unit/db/sqlite-file-mode.test.js :19 import Database from "better-sqlite3";
db (weak) BaiGanio-aperio-99beb18/tests/unit/db/vec-fallback.test.js :20 import Database from "better-sqlite3";

tool registrations 24

read_file BaiGanio-aperio-99beb18/mcp/tools/files.js :32
grep_files BaiGanio-aperio-99beb18/mcp/tools/files.js :45
write_file BaiGanio-aperio-99beb18/mcp/tools/files.js :59
append_file BaiGanio-aperio-99beb18/mcp/tools/files.js :73
edit_file BaiGanio-aperio-99beb18/mcp/tools/files.js :86
read_docx BaiGanio-aperio-99beb18/mcp/tools/files.js :104
scan_project BaiGanio-aperio-99beb18/mcp/tools/files.js :115
delete_file BaiGanio-aperio-99beb18/mcp/tools/files.js :127
generate_xlsx BaiGanio-aperio-99beb18/mcp/tools/files.js :141
generate_docx BaiGanio-aperio-99beb18/mcp/tools/files.js :161
fetch_github_issue BaiGanio-aperio-99beb18/mcp/tools/github.js :568
create_github_issue BaiGanio-aperio-99beb18/mcp/tools/github.js :594

show 12 more

update_github_issue BaiGanio-aperio-99beb18/mcp/tools/github.js :626
list_github_issues BaiGanio-aperio-99beb18/mcp/tools/github.js :660
record_issue_triage BaiGanio-aperio-99beb18/mcp/tools/github.js :684
read_image BaiGanio-aperio-99beb18/mcp/tools/image.js :373
preprocess_image BaiGanio-aperio-99beb18/mcp/tools/image.js :402
describe_image BaiGanio-aperio-99beb18/mcp/tools/image.js :436
run_node_script BaiGanio-aperio-99beb18/mcp/tools/shell.js :631
run_python_script BaiGanio-aperio-99beb18/mcp/tools/shell.js :643
syntax_check BaiGanio-aperio-99beb18/mcp/tools/shell.js :655
run_shell BaiGanio-aperio-99beb18/mcp/tools/shell.js :666
fetch_url BaiGanio-aperio-99beb18/mcp/tools/web.js :131
web_search BaiGanio-aperio-99beb18/mcp/tools/web.js :144

declared dependencies 42

@modelcontextprotocol/sdk@^1.30.0
@anthropic-ai/claude-agent-sdk@^0.3.239
@anthropic-ai/sdk@^0.120.0
@google/generative-ai@^0.24.1
@huggingface/transformers@^4.2.0
adm-zip@^0.6.0
better-sqlite3@^13.0.3
bootstrap-icons@1.11.3
chokidar@^5.0.0
d3@7.9.0
docx@^9.7.1
dotenv@^17.4.2

show 28 more

emphasize@^7.0.0
exceljs@^4.4.0
express@^5.2.1
express-rate-limit@^8.6.2
fast-xml-parser@^5.11.0
gpt-tokenizer@^4.0.0
graphology@^0.26.0
graphology-communities-louvain@^2.0.2
helmet@^8.3.0
mammoth@^1.12.1
mssql@^12.7.0
mysql2@^3.23.4
open@^11.0.1
pdf-lib@^1.17.1
pdfjs-dist@^6.2.108
pg@^8.23.0
pptxgenjs@^4.0.1
prismjs@1.30.0
sanitize-html@^2.17.7
sharp@^0.35.3
sqlite-vec@^0.1.9
tree-sitter-wasms@^0.1.13
uuid@^14.0.2
web-tree-sitter@^0.24.7
winston@^3.19.0
winston-daily-rotate-file@^5.0.0
ws@^8.21.3
zod@^4.4.3

2 more not shown — this panel samples each group; the count above is the real total.

obfuscation 7

dynamic require()/import() BaiGanio-aperio-99beb18/audit/scripts/registry-contract.js :124 const mod = await import(`${ROOT}/${TOOLS_DIR}/${file}`);
dynamic require()/import() BaiGanio-aperio-99beb18/lib/server/graphWatchers.js :24 const { [AVAILABILITY_CHECK[kind]]: isAvailable } = await import(`../${kind}/indexer.js`);
dynamic require()/import() BaiGanio-aperio-99beb18/lib/workers/skills/execution.js :142 const module = await import(`file://${scriptPath}`);
dynamic require()/import() BaiGanio-aperio-99beb18/tests/integration/mcp/index.test.js :165 const { startServer } = await import(${JSON.stringify(mcpIndexUrl)});
dynamic require()/import() BaiGanio-aperio-99beb18/tests/integration/terminal/runtime.test.js :205 await import(${JSON.stringify(moduleUrl("lib/terminal/standalone.js"))});
dynamic require()/import() BaiGanio-aperio-99beb18/tests/unit/agent/tool-profiles.test.js :484 import(`../../../lib/agent/tool-profiles.js?t=${Date.now()}_${Math.random().toString(36).slice(2)}`);
dynamic require()/import() BaiGanio-aperio-99beb18/tests/unit/db-connect/extraction.test.js :599 const cacheBustImport = () => import(`../../../lib/db-connect/extraction.js?t=${Date.now()}_${Math.random().toString(36).slice(2)}`);

perm:untrusted 3

untrusted BaiGanio-aperio-99beb18/lib/terminal/ui.js :251 const schema = await fetch(`http://localhost:${port}/api/config/schema`).then((r) => r.json());
untrusted (weak) BaiGanio-aperio-99beb18/tests/e2e/ui/ui-config-panel.test.js :23 return fetch(`http://127.0.0.1:${port}${path}`).then((r) => r.json());
untrusted (weak) BaiGanio-aperio-99beb18/tests/integration/server/vendor-assets.test.js :72 const css = await (await fetch(`${base}/vendor/bootstrap-icons/bootstrap-icons.min.css`)).text();

BaiGanio/aperio

Drift inferred · capture-to-capture

tools

skills & prompt files 36

danger signals9

filesystem 278

shell / exec 89

network 74

secrets 26

database 21

tool registrations 24

declared dependencies 42

obfuscation 7

perm:untrusted 3

Navigate

Stream

Features

Display