🕸️ A self-healing scraper that abstains when it is not sure — and measures how often its heals are wrong.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 434db57 · analyzer v33 · 3w ago
danger signals39
- suspicious endpoint discord.com Vaibhav91one-assay-434db57/test/connectors.test.ts :26
const DISCORD_URL = ['https://discord.com/api/webhooks', '123456789012345678', 'abcdefghijklmnopqrstuvwxyz'].join('/'); - suspicious endpoint 169.254.169.254 (cloud metadata) Vaibhav91one-assay-434db57/test/ssrf.test.ts :33
['http://169.254.169.254/latest/meta-data/', /link-local|metadata/], - suspicious endpoint 93.184.216.34 Vaibhav91one-assay-434db57/test/ssrf.test.ts :95
const { html, via } = await fetchHtml('http://93.184.216.34/', []); - committed secret Google API key Vaibhav91one-assay-434db57/corpus-live/ikea/2026-08-23.html :8
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240114015349.html :1258
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240215094921.html :1256
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240307021544.html :1262
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240406142237.html :1272
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240509141204.html :1276
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240613054549.html :835
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240704111454.html :839
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240811220042.html :849
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20240902055523.html :858
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20241004030603.html :820
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20241106212610.html :792
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20241205040641.html :794
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250108195220.html :796
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250202201033.html :800
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250304113257.html :802
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250426213004.html :802
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250502095953.html :802
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250731185326.html :771
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250801145132.html :771
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20250906092348.html :1109
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20251005125020.html :1102
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20251111222002.html :1090
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20251218005806.html :1091
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260117092041.html :1091
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260228015134.html :1102
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260306022836.html :1102
AIzaSy…(39 chars, redacted) - committed secret OpenAI key Vaibhav91one-assay-434db57/corpus/ikea/20260409043832.html :102
sk-d01…(35 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260409043832.html :1102
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260505195241.html :3
AIzaSy…(39 chars, redacted) - committed secret OpenAI key Vaibhav91one-assay-434db57/corpus/ikea/20260505195241.html :42
sk-d01…(35 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260601173910.html :3
AIzaSy…(39 chars, redacted) - committed secret OpenAI key Vaibhav91one-assay-434db57/corpus/ikea/20260601173910.html :42
sk-d01…(35 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260703035005.html :3
AIzaSy…(39 chars, redacted) - committed secret Google API key Vaibhav91one-assay-434db57/corpus/ikea/20260804061950.html :3
AIzaSy…(39 chars, redacted) - committed secret Anthropic key Vaibhav91one-assay-434db57/test/signin-keys.test.ts :36
sk-ant…(50 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 372
filesystem 53
- fs Vaibhav91one-assay-434db57/src/connectors/config.ts :23
import { readFile, writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/src/mcp/server.ts :24
import { readdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/src/skills/page.ts :39
import { readFile, readdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/src/skills/store.ts :27
import { readFile } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/src/store/captures.ts :12
import { mkdir, writeFile, readFile, stat } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/actions-auth.test.ts :25
import { readdirSync, readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/api-scopes.test.ts :9
import { readdirSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/assay-score.test.ts :28
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/auth.test.ts :5
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/baseline.test.ts :20
import { readFile, readdir } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/bd-diffgate.test.ts :14
import { readFile } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/bd-verify.test.ts :11
import { readFile } from 'node:fs/promises';
show 28 more
- fs (weak) Vaibhav91one-assay-434db57/test/bench-live.test.ts :23
import { readFileSync, existsSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/blocked.test.ts :12
import { readFile, readdir } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/brand-mark.test.ts :14
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/button-recipe.test.ts :18
import { readFileSync, readdirSync, statSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/chat-surface.test.ts :28
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/cli.test.ts :11
import { mkdtemp, rm, writeFile, mkdir } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/composer-commands.test.ts :15
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/connectors.test.ts :11
import { mkdtemp, rm, readFile } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/consensus.test.ts :16
import { readFile, readdir } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/test/contracts.test.ts :8
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/env-names.test.ts :26
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/fingerprint-artifact.test.ts :15
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/library.test.ts :15
import { readFileSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/settings-docs.test.ts :18
import { readFileSync, existsSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/signin-keys.test.ts :26
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) Vaibhav91one-assay-434db57/test/skills.test.ts :25
import { mkdtemp, rm } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/audit.ts :10
import { readFile } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bd-create.ts :41
import { writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bd-heal.ts :26
import { writeFile, readFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bench-consensus.ts :31
import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bench-live.ts :27
import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bench-model.ts :31
import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/bench.ts :14
import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/cli/blast.ts :10
import { writeFile } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/cli/contracts.ts :12
import { readFileSync, realpathSync } from 'node:fs'; - fs Vaibhav91one-assay-434db57/tools/cli/incident.ts :14
import { writeFile } from 'node:fs/promises'; - fs Vaibhav91one-assay-434db57/tools/cli/index.ts :53
import { readdir } from 'node:fs/promises'; - fs (weak) Vaibhav91one-assay-434db57/tools/demo.ts :9
import { readFile, readdir } from 'node:fs/promises';
13 more not shown — this panel samples each group; the count above is the real total.
shell / exec 4
- shell Vaibhav91one-assay-434db57/bin/assay.ts :22
import { spawnSync } from 'node:child_process'; - shell Vaibhav91one-assay-434db57/src/ai/model.ts :34
import { execFileSync } from 'node:child_process'; - shell (weak) Vaibhav91one-assay-434db57/test/cli.test.ts :10
import { spawnSync } from 'node:child_process'; - shell (weak) Vaibhav91one-assay-434db57/test/fingerprint-artifact.test.ts :14
import { execFileSync } from 'node:child_process';
network 11
- net Vaibhav91one-assay-434db57/src/bd/verify.ts :90
({ html, via } = await fetch(url)); - net Vaibhav91one-assay-434db57/src/connectors/scrapers.ts :866
res = await fetch(url, { - net Vaibhav91one-assay-434db57/src/skills/page.ts :41
import { BlockList, isIP } from 'node:net'; - net Vaibhav91one-assay-434db57/tools/bd-create.ts :145
const res = await fetch(`${API}${path}`, { - net Vaibhav91one-assay-434db57/tools/bd-heal.ts :125
const res = await fetch(`${API}/${COLLECTOR}/${path}`, { - net Vaibhav91one-assay-434db57/tools/bench-live.ts :75
const res = await fetch(UNLOCKER, { - net Vaibhav91one-assay-434db57/tools/fetch-corpus.ts :37
const res = await fetch(url, { - net Vaibhav91one-assay-434db57/tools/selfheal.ts :121
const res = await fetch(url, { - net Vaibhav91one-assay-434db57/web/app/(app)/connect/actions.ts :58
res = await fetch('https://api.brightdata.com/zone/get_all_zones', { - net Vaibhav91one-assay-434db57/web/app/(app)/export-menu.tsx :48
const res = await fetch(`/api/conversations/${id}/export`, { cache: 'no-store' }); - net Vaibhav91one-assay-434db57/web/lib/chat-stream.ts :80
const res = await fetch('/api/chat', {
secrets 21
- secrets Vaibhav91one-assay-434db57/src/ai/model.ts :166
process.env.ANTHROPIC_API_KEY ? 'api-key' - secrets Vaibhav91one-assay-434db57/src/blast/index.ts :403
secret: process.env.ASSAY_WEBHOOK_SECRET || '', - secrets Vaibhav91one-assay-434db57/src/connectors/resend-bounce.ts :135
secret: process.env.ASSAY_WEBHOOK_SECRET || '', - secrets Vaibhav91one-assay-434db57/src/connectors/scrapers.ts :806
const t = process.env.BRIGHTDATA_API_TOKEN; - secrets Vaibhav91one-assay-434db57/src/notify.ts :101
apiKey = process.env.ASSAY_RESEND_KEY, - secrets Vaibhav91one-assay-434db57/src/skills/page.ts :349
const key = process.env.FIRECRAWL_API_KEY; - secrets (weak) Vaibhav91one-assay-434db57/test/ai.test.ts :115
process.env.ANTHROPIC_API_KEY = 'x'; - secrets (weak) Vaibhav91one-assay-434db57/test/bd-catalogue.test.ts :28
const TOKEN = process.env.BRIGHTDATA_API_TOKEN; - secrets (weak) Vaibhav91one-assay-434db57/test/connectors.test.ts :71
const saved = process.env.BRIGHTDATA_API_TOKEN; - secrets (weak) Vaibhav91one-assay-434db57/test/env-names.test.ts :140
expect(notify).toContain('process.env.ASSAY_RESEND_KEY'); - secrets (weak) Vaibhav91one-assay-434db57/test/scrapers.test.ts :60
process.env.BRIGHTDATA_API_TOKEN = 'test-token'; - secrets (weak) Vaibhav91one-assay-434db57/test/signin-keys.test.ts :183
process.env.ANTHROPIC_API_KEY = SECRET;
show 9 more
- secrets (weak) Vaibhav91one-assay-434db57/test/skills.test.ts :48
const saved = { store: process.env.ASSAY_SKILLS, key: process.env.FIRECRAWL_API_KEY }; - secrets (weak) Vaibhav91one-assay-434db57/test/ssrf.test.ts :79
process.env.FIRECRAWL_API_KEY = 'sk-test'; - secrets Vaibhav91one-assay-434db57/tools/bd-create.ts :99
const TOKEN = process.env.BRIGHTDATA_API_TOKEN; - secrets Vaibhav91one-assay-434db57/tools/bd-heal.ts :92
const TOKEN = process.env.BRIGHTDATA_API_TOKEN; - secrets Vaibhav91one-assay-434db57/tools/bench-live.ts :130
const token = process.env.BRIGHTDATA_API_TOKEN; - secrets Vaibhav91one-assay-434db57/tools/worker.ts :75
url: hook, secret: process.env.ASSAY_WEBHOOK_SECRET || '', - secrets Vaibhav91one-assay-434db57/web/app/(app)/connect/actions.ts :53
const token = process.env.BRIGHTDATA_API_TOKEN; - secrets Vaibhav91one-assay-434db57/web/app/api/v1/connectors/resend/bounce/route.ts :12
const secret = process.env.RESEND_WEBHOOK_SECRET; - secrets Vaibhav91one-assay-434db57/web/app/sign-in/keys.ts :140
set: Boolean(process.env.BRIGHTDATA_API_TOKEN),
database 1
- db Vaibhav91one-assay-434db57/src/store/index.ts :4
import pg from 'pg';
declared dependencies 18
- @modelcontextprotocol/sdk@^1.30.0
- @anthropic-ai/claude-agent-sdk@^0.3.239
- cheerio@^1.2.0
- commander@^15.0.0
- drizzle-orm@^0.45.2
- drizzle-zod@^0.8.3
- fastest-levenshtein@^1.0.16
- pg@^8.23.0
- yaml@^2.9.0
- zod@^4.4.3
- @types/node@^26.2.0
- @types/pg@^8.23.1
show 6 more
- dotenv@^17.4.2
- drizzle-kit@^0.31.10
- marked@^18.0.10
- tsx@^4.23.12
- typescript@^7.0.2
- vitest@^4.1.11