The browser control plane for AI agents. One API over Oya Cloud, Browserbase, Steel, Anchor, Browser Use and your own Chrome, with persistent personas, CAPTCHA and MFA handling, and live human takeover.
Drift inferred · capture-to-capture
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
- HIGH code analysis flagged hidden prompt content in OyadotAI/oya-browser
transport streamable-http · http
verified
reported
listed in the official MCP registry counts 3 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
pool_status
-
start_browser
-
stop_browser
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 36ddac6 · analyzer v33 · 6h ago
skills & prompt files 7
- hidden: skill: skill-exfil OyadotAI-oya-browser-36ddac6/skills/oya-browser/SKILL.md :16
auto-triggered secret→sink: `claude mcp add --transport http oya https://browser.getoya.ai/mcp/pool --header "Authorization: Bearer $OYA_API_KEY"`
- skill OyadotAI-oya-browser-36ddac6/.agents/skills/browser-agent/SKILL.md
- skill OyadotAI-oya-browser-36ddac6/.agents/skills/frontend-design/SKILL.md
- agent-rules OyadotAI-oya-browser-36ddac6/AGENTS.md
- agent-rules OyadotAI-oya-browser-36ddac6/CLAUDE.md
- agent-rules OyadotAI-oya-browser-36ddac6/ui/AGENTS.md
- agent-rules OyadotAI-oya-browser-36ddac6/ui/CLAUDE.md
danger signals20
- dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/browser/tests/integration/regressions.js :130
assert.doesNotThrow(() => new Function(body), 'renderer inline script does not parse'); - dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/actions/scripts.test.cjs :35
assert.doesNotThrow(() => new Function(js), js.slice(0, 60)); - dynamic code execution eval() OyadotAI-oya-browser-36ddac6/browser/tests/unit/scripts/page-queries.test.js :41
return eval(js); - dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/server/tests/integration/playbook.test.js :94
await new Function(code.replace('export default ', 'return '))()(fake, { - dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/server/tests/integration/recording-playwright.test.js :112
const run = new Function(code.replace('export default ', 'return '))(); - dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/agent/page-scripts.test.ts :37
assert.doesNotThrow(() => new Function(`return ${expression}`)); - dynamic code execution new Function() OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/playbooks/playwright.test.ts :149
const v = new Function(`${helpers}; return v;`)(); - suspicious endpoint 169.254.169.254 (cloud metadata) OyadotAI-oya-browser-36ddac6/server/tests/integration/sandbox.test.js :228
'http://169.254.169.254/latest/meta-data', // cloud metadata - suspicious endpoint 169.254.169.254 (cloud metadata) OyadotAI-oya-browser-36ddac6/server/tests/integration/security.test.js :500
'https://169.254.169.254/v1', - suspicious endpoint 93.184.216.34 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/challenges/mfa-code.test.ts :22
const RELAY = 'https://93.184.216.34/sms'; - suspicious endpoint 93.184.216.34 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/challenges/mfa-factors.test.ts :19
const RELAY = 'https://93.184.216.34/sms'; - suspicious endpoint 8.8.8.8 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/config/service.test.ts :115
await assert.rejects(keyConfig.set(KEY, { openai_base_url: 'http://8.8.8.8/v1' }), { - suspicious endpoint 93.184.216.34 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/control/routes.test.ts :140
for (const url of ['http://93.184.216.34/hook', 'https://127.0.0.1/hook']) - suspicious endpoint 169.254.169.254 (cloud metadata) OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/control/worker/webhook.test.ts :39
await assert.rejects(sendWebhook('https://169.254.169.254/latest', '{}', {}), { status: 400 }); - suspicious endpoint 8.8.8.8 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/gateway/provider-registration.test.ts :42
await assert.rejects(registerProvider(KEY, OWNER, { name: 'x', wsUrl: 'http://8.8.8.8' }), { status: 400 }); - suspicious endpoint 8.8.8.8 OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/proxies/service.test.ts :43
assert.deepEqual(proxies.credentials(p), { url: 'http://8.8.8.8:3128', username: 'user', password: 'secret' }); - suspicious endpoint 169.254.169.254 (cloud metadata) OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/proxies/service.test.ts :94
await assert.rejects(proxies.register({ url: 'http://169.254.169.254:80' } as any), { status: 400 }); - suspicious endpoint 8.8.8.8 OyadotAI-oya-browser-36ddac6/server/tests/unit/platform/net-guard.test.ts :104
await assert.rejects(assertSafeTarget('http://8.8.8.8/'), { status: 400, message: 'URL must use ws: or wss:' }); - suspicious endpoint 8.8.8.8 OyadotAI-oya-browser-36ddac6/server/tests/unit/platform/runtime-config.test.ts :48
await runtimeConfig.set({ openai_base_url: 'https://8.8.8.8/v1/' }); - credential in logs credential in log OyadotAI-oya-browser-36ddac6/packages/cli/src/install/report.ts :44
console.log(`\n ${style.bold('API key')} ${style.green(apiKey)}\n`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 1361
filesystem 120
- fs OyadotAI-oya-browser-36ddac6/browser/anonymity/profile-store.js :6
const fs = require('fs'); - fs OyadotAI-oya-browser-36ddac6/browser/launch.cjs :9
const fs = require('node:fs'); - fs OyadotAI-oya-browser-36ddac6/browser/main.js :16
const fs = require('fs'); - fs OyadotAI-oya-browser-36ddac6/browser/main/app/config-store.cjs :6
const fs = require('fs'); - fs OyadotAI-oya-browser-36ddac6/browser/main/ipc/files.cjs :5
const fs = require('fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/scripts/draft-store.cjs :6
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/scripts/validation.cjs :8
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/scripts/worker/run.cjs :7
const { writeFile, rm } = require('node:fs/promises'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/cdp-front-door.mjs :13
import fs from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/control.mjs :8
import { mkdtemp, rm } from 'node:fs/promises'; - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/recording-electron.cjs :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/regressions.js :9
const fs = require('fs');
show 28 more
- fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/release.cjs :6
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/shell.mjs :9
import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'; - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/workflow-electron.cjs :8
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/workflow.cjs :6
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/anonymity/profile-store.test.js :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/image-contents.test.cjs :8
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/app/config-store.test.cjs :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/app/lifecycle.test.cjs :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/ipc/handle.test.cjs :26
const preload = require('node:fs').readFileSync(require.resolve('../../../../preload.js'), 'utf8'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/ipc/handlers.test.cjs :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/scripts/draft-store.test.js :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/scripts/validation.test.js :8
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/scripts/workflow-worker.test.js :8
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/scripts/workflow/generate.test.js :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/support/renderer-harness.cjs :7
const fs = require('node:fs'); - fs (weak) OyadotAI-oya-browser-36ddac6/examples/playwright/reddit/scrape.ts :3
import { writeFileSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/examples/sdk/demo.ts :11
import { mkdir, writeFile } from 'node:fs/promises'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/config.ts :5
import { readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/install.ts :15
import { readFileSync, writeFileSync } from 'node:fs'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/install/env-file.ts :5
import { existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/install/k8s.ts :5
import { mkdirSync, writeFileSync } from 'node:fs'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/install/preflight.ts :6
import { existsSync, statSync } from 'node:fs'; - fs OyadotAI-oya-browser-36ddac6/packages/cli/src/install/repo.ts :5
import { existsSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/integration/install.mjs :11
import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/config.test.ts :8
import { statSync, writeFileSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/install/env-file.test.ts :6
import { mkdtempSync, statSync, writeFileSync, readFileSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/install/preflight.test.ts :7
import { mkdtempSync, writeFileSync } from 'node:fs'; - fs (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/support/harness.ts :7
import { mkdtempSync } from 'node:fs';
80 more not shown — this panel samples each group; the count above is the real total.
shell / exec 28
- shell OyadotAI-oya-browser-36ddac6/browser/launch.cjs :11
const { spawn, execFileSync } = require('node:child_process'); - shell (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/release.cjs :9
const { spawnSync } = require('node:child_process'); - shell OyadotAI-oya-browser-36ddac6/packages/cli/src/commands/browsers.ts :4
import { spawn } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/packages/cli/src/commands/stealth.ts :5
import { spawn } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/packages/cli/src/install/migrate.ts :5
import { spawn } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/packages/cli/src/install/shell.ts :4
import { spawn } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/integration/install.mjs :10
import { execFileSync } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/integration/prompt.mjs :15
import { spawnSync } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/scripts/record-walkthrough.mjs :17
import { spawn } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/server/migrations/run.mjs :19
import { execFile } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/server/src/app/frontend.ts :2
import { spawn } from 'node:child_process'; - shell OyadotAI-oya-browser-36ddac6/server/src/modules/control/fleet/docker.ts :7
import { execFile } from 'node:child_process';
show 16 more
- shell OyadotAI-oya-browser-36ddac6/server/src/modules/control/fleet/kubectl.ts :5
import { spawn, type ChildProcess } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/anonymity.test.js :12
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/cdp.test.js :13
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/challenges.test.js :11
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-cluster.test.js :3
import { fork } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-postgres.test.js :3
import { execFile } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/dialog.test.js :17
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/gateway.test.js :13
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/login-auto.test.js :15
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/login-flow.test.js :7
import { spawn } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/managed-runtime.test.js :3
import { execFile } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/mcp-lifecycle.test.js :12
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/recording-playwright.test.js :6
import { spawn } from 'node:child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/sandbox.test.js :360
const { spawnSync } = await import('node:child_process'); - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/stealth.test.js :19
import { spawn } from 'child_process'; - shell (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/upload.test.js :20
import { spawn } from 'child_process';
network 72
- net OyadotAI-oya-browser-36ddac6/browser/anonymity/proxy.js :5
const net = require('net'); - net OyadotAI-oya-browser-36ddac6/browser/cdp-front-door.js :15
const http = require('http'); - net OyadotAI-oya-browser-36ddac6/browser/front-door/door.cjs :38
const list = await (await fetch(`http://${this.up}/json/list`)).json(); - net OyadotAI-oya-browser-36ddac6/browser/main/cdp-relay.cjs :27
const { webSocketDebuggerUrl } = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json(); - net OyadotAI-oya-browser-36ddac6/browser/main/connection/server-api.cjs :22
return fetch(`${serverHttpBase(config.serverUrl)}/api/browsers/${ctx.socket.browserId}/${route}`, { - net OyadotAI-oya-browser-36ddac6/browser/main/pairing.cjs :73
const res = await fetch(claimUrl, pairingClaimRequest(code)); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/cdp-front-door.mjs :22
const version = await (await fetch(`${base}/json/version`)).json(); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/control.mjs :13
import { createServer } from 'node:http'; - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/recording-electron.cjs :10
const { createServer } = require('node:http'); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/regressions.js :313
const net = require('net'); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/shell.mjs :12
import { createServer } from 'node:http'; - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/workflow-electron.cjs :7
const http = require('node:http');
show 28 more
- net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/anonymity/proxy.test.js :7
const net = require('node:net'); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/cdp-front-door.test.cjs :8
const http = require('node:http'); - net (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/cdp-relay.test.cjs :8
const http = require('node:http'); - net OyadotAI-oya-browser-36ddac6/packages/cli/src/commands/login.ts :37
const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body) }); - net OyadotAI-oya-browser-36ddac6/packages/cli/src/install/docker.ts :32
return (await fetch(`${url}/readyz`)).ok; - net OyadotAI-oya-browser-36ddac6/packages/cli/src/install/llm.ts :114
return fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }); - net OyadotAI-oya-browser-36ddac6/packages/cli/src/install/shell.ts :5
import { createConnection, type Socket } from 'node:net'; - net (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/install/shell.test.ts :7
import { createServer } from 'node:net'; - net (weak) OyadotAI-oya-browser-36ddac6/scripts/record-walkthrough.mjs :35
const res = await fetch(`${BASE}/api${path}`, { - net OyadotAI-oya-browser-36ddac6/server/src/app/frontend.ts :3
import { request } from 'node:http'; - net OyadotAI-oya-browser-36ddac6/server/src/drivers/providers.ts :116
const response = await fetch(url, { ...options, redirect: 'error', signal }); - net OyadotAI-oya-browser-36ddac6/server/src/drivers/providers/vendor-session.ts :53
return fetch(cfg.createUrl, { - net OyadotAI-oya-browser-36ddac6/server/src/index.ts :35
import { createServer } from 'http'; - net OyadotAI-oya-browser-36ddac6/server/src/mcp/self-api.ts :27
const res = await fetch(`${self.origin}/api${path}`, { ...init, signal: AbortSignal.timeout(SELF_API_TIMEOUT_MS) }); - net OyadotAI-oya-browser-36ddac6/server/src/modules/challenges/captcha-solver.ts :93
const res = await fetch(endpoint, { - net OyadotAI-oya-browser-36ddac6/server/src/modules/challenges/inbox.ts :87
const list = await fetch(url, { headers, signal: AbortSignal.timeout(MAILBOX_REQUEST_TIMEOUT_MS) }); - net OyadotAI-oya-browser-36ddac6/server/src/modules/challenges/mailbox-token.ts :39
const res = await fetch(tokenUrl(kind, config), { - net OyadotAI-oya-browser-36ddac6/server/src/modules/challenges/mfa-code.ts :130
const res = await fetch(config.url, { - net OyadotAI-oya-browser-36ddac6/server/src/modules/control/cluster/forward-http.ts :75
return fetch(target, requestInit(req, headers, abort.signal)).finally(() => clearTimeout(headerTimeout)); - net OyadotAI-oya-browser-36ddac6/server/src/modules/control/egress.ts :2
import http from 'node:http'; - net OyadotAI-oya-browser-36ddac6/server/src/modules/control/worker/webhook.ts :5
import https from 'node:https'; - net OyadotAI-oya-browser-36ddac6/server/src/modules/proxies/tunnel.ts :7
import http from 'http'; - net OyadotAI-oya-browser-36ddac6/server/src/modules/slack/actions.ts :32
fetch(url, { - net OyadotAI-oya-browser-36ddac6/server/src/modules/slack/client.ts :41
const response = await fetch(`${API}/${method}`, { - net OyadotAI-oya-browser-36ddac6/server/src/platform/llm.ts :48
return fetch(endpointFor(request, native), { - net OyadotAI-oya-browser-36ddac6/server/src/platform/net-guard.ts :16
import { isIP } from 'net'; - net (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/cdp.test.js :12
import { createServer } from 'http'; - net (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/challenges.test.js :10
import { createServer } from 'http';
32 more not shown — this panel samples each group; the count above is the real total.
secrets 68
- secrets OyadotAI-oya-browser-36ddac6/browser/main/connection/socket.cjs :62
const offer = { provider, enrollment_token: process.env.OYA_ENROLLMENT_TOKEN, cdp: !!cdpPort }; - secrets (weak) OyadotAI-oya-browser-36ddac6/browser/tests/unit/main/connection/socket.test.cjs :81
enrollment_token: process.env.OYA_ENROLLMENT_TOKEN, - secrets (weak) OyadotAI-oya-browser-36ddac6/examples/.readme-test/root-portal-login.ts :6
await oya.personas.setCredentials(persona.id, { domain: "portal.example.com", username: "alice", password: process.env.PORTAL_PASSWORD! }); - secrets (weak) OyadotAI-oya-browser-36ddac6/examples/.readme-test/sdk-mfa.ts :5
await oya.personas.setMfa(persona.id, { type: 'totp', secret: process.env.TOTP_SECRET! }); // sealed, never read back - secrets (weak) OyadotAI-oya-browser-36ddac6/examples/sdk/03-mfa.ts :7
if (!persona.mfa.configured) await oya.personas.setMfa(persona.id, { type: 'totp', secret: process.env.TOTP_SECRET! }); - secrets (weak) OyadotAI-oya-browser-36ddac6/examples/sdk/demo.ts :115
if (!process.env.TOTP_SECRET || !process.env.MFA_URL) { - secrets OyadotAI-oya-browser-36ddac6/packages/cli/src/config.ts :45
apiKey: process.env.OYA_API_KEY || saved.apiKey || '', - secrets OyadotAI-oya-browser-36ddac6/packages/cli/src/install/interview.ts :201
? { answers: s.preset.llm, key: s.replay ? process.env.OPENAI_API_KEY || '' : '' } - secrets (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/config.test.ts :13
delete process.env.OYA_API_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/packages/cli/tests/unit/support/harness.ts :13
delete process.env.OYA_API_KEY; - secrets OyadotAI-oya-browser-36ddac6/packages/sdk/src/index.ts :70
* await oya.config.set({ llm_provider: 'gemini', openai_api_key: process.env.GEMINI_API_KEY }); - secrets (weak) OyadotAI-oya-browser-36ddac6/packages/sdk/tests/unit/client.test.ts :11
const saved = { key: process.env.OYA_API_KEY, url: process.env.OYA_BASE_URL };
show 28 more
- secrets (weak) OyadotAI-oya-browser-36ddac6/scripts/record-walkthrough.mjs :27
const KEY = process.env.OYA_RECORD_KEY; - secrets OyadotAI-oya-browser-36ddac6/server/publish-snapshot.js :28
const apiKey = process.env.DAYTONA_API_KEY; - secrets OyadotAI-oya-browser-36ddac6/server/src/app/http.ts :31
const token = process.env.OYA_OPERATOR_TOKEN || process.env.OYA_METRICS_TOKEN; - secrets OyadotAI-oya-browser-36ddac6/server/src/modules/auth/keys.ts :23
const fleetToken = (process.env.FLEET_TOKEN || '').trim() || null; - secrets OyadotAI-oya-browser-36ddac6/server/src/modules/control/cluster.ts :13
if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || !process.env.OYA_CLUSTER_SECRET) - secrets OyadotAI-oya-browser-36ddac6/server/src/modules/control/cluster/hop.ts :12
if (!process.env.OYA_CLUSTER_SECRET) - secrets OyadotAI-oya-browser-36ddac6/server/src/modules/slack/client.ts :18
export const oauthConfigured = () => !!(process.env.SLACK_CLIENT_ID && process.env.SLACK_CLIENT_SECRET); - secrets OyadotAI-oya-browser-36ddac6/server/src/modules/slack/signature.ts :19
export function verifySignature(rawBody, headers, secret = process.env.SLACK_SIGNING_SECRET) { - secrets OyadotAI-oya-browser-36ddac6/server/src/platform/db.ts :8
const supabaseKey = process.env.SUPABASE_SERVICE_KEY || ''; - secrets OyadotAI-oya-browser-36ddac6/server/src/platform/runtime-config.ts :113
const key = config.openai_api_key || process.env.OPENAI_API_KEY; - secrets OyadotAI-oya-browser-36ddac6/server/src/platform/secrets.ts :68
const SECRET = process.env.OYA_PROFILE_SECRET || ''; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/challenges.test.js :17
process.env.OYA_PROFILE_SECRET = 'd'.repeat(64); - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-api.test.js :21
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-lock.test.js :17
process.env.OYA_PROFILE_SECRET ||= 'control-lock-tests'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-pg-client.test.js :12
process.env.OYA_PROFILE_SECRET ||= 'pg-client-contract-tests'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-plane.test.js :15
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-postgres.test.js :6
process.env.OYA_PROFILE_SECRET ||= 'postgres-control-contract-tests'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/control-worker.test.js :21
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/desktop-control.test.js :19
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/durable-control.test.js :11
process.env.OYA_PROFILE_SECRET = 'control-test-secret'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/fleet-k8s.test.js :75
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/gateway.test.js :35
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/key-storage.test.js :92
process.env.SUPABASE_SERVICE_KEY = 'stub-service-key'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/llm.test.js :243
const express = process.env.VERTEX_EXPRESS_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/login-flow.test.js :22
process.env.OYA_PROFILE_SECRET = 'local-login-test-secret'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/managed-runtime.test.js :30
delete process.env.SUPABASE_SERVICE_KEY; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/persona-persistence.test.js :13
process.env.SUPABASE_SERVICE_KEY = 'isolated-test-key'; - secrets (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/playbook-cleanup.test.js :74
process.env.OYA_PROFILE_SECRET = 'playbook-cleanup-test-secret';
28 more not shown — this panel samples each group; the count above is the real total.
database 1
- db (weak) OyadotAI-oya-browser-36ddac6/server/tests/unit/modules/control/pg-client.test.ts :8
import pg from 'pg';
tool registrations 3
- start_browser OyadotAI-oya-browser-36ddac6/server/src/mcp/pool-lifecycle.ts :39
- stop_browser OyadotAI-oya-browser-36ddac6/server/src/mcp/pool-lifecycle.ts :42
- pool_status OyadotAI-oya-browser-36ddac6/server/src/mcp/pool-lifecycle.ts :43
install hooks 3
- postinstall OyadotAI-oya-browser-36ddac6/examples/package.json :7
npm install --prefix .. --no-audit --no-fund && npm run build:sdk --prefix .. - prepublishOnly OyadotAI-oya-browser-36ddac6/packages/cli/package.json :33
npm run build - prepublishOnly OyadotAI-oya-browser-36ddac6/packages/sdk/package.json :49
npm run build
declared dependencies 7
- @eslint/js@^9.39.5
- eslint@^9.39.5
- eslint-config-prettier@^10.1.8
- eslint-plugin-jsdoc@^64.5.3
- globals@^17.12.0
- prettier@^3.9.8
- typescript-eslint@^8.70.0
obfuscation 1
- dynamic require()/import() OyadotAI-oya-browser-36ddac6/server/tests/integration/login-flow.test.js :102
const reloaded = await import(`../../src/modules/personas/cookies.ts?reload=${Date.now()}`);
perm:untrusted 7
- untrusted OyadotAI-oya-browser-36ddac6/browser/front-door/door.cjs :38
const list = await (await fetch(`http://${this.up}/json/list`)).json(); - untrusted OyadotAI-oya-browser-36ddac6/browser/main/cdp-relay.cjs :27
const { webSocketDebuggerUrl } = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json(); - untrusted (weak) OyadotAI-oya-browser-36ddac6/browser/tests/integration/cdp-front-door.mjs :22
const version = await (await fetch(`${base}/json/version`)).json(); - untrusted OyadotAI-oya-browser-36ddac6/server/src/modules/slack/client.ts :62
return fetch(`${API}/oauth.v2.access`, init).then((r) => r.json()); - untrusted (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/gateway.test.js :141
const version = await (await fetch(`http://${origin}/json/version`)).json(); - untrusted (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/mcp-lifecycle.test.js :122
await fetch(`${base}/health`).then( - untrusted (weak) OyadotAI-oya-browser-36ddac6/server/tests/integration/slack.test.js :225
await fetch(`${base}/api/slack/install?json=1`, { headers: auth }).then((r) => r.headers.get('set-cookie')),
transport_posture 1
- binds all interfaces (0.0.0.0) OyadotAI-oya-browser-36ddac6/server/tests/integration/managed-runtime.test.js :44
const listen = (server) => new Promise((resolve) => server.listen(0, '0.0.0.0', resolve));