github Rust analyzed 9304d02 deep scan · partial (228/2,363 files)

brambleworks/SiteCMD-app

github

Desktop website health scanner and command center

maintainer
brambleworks
licence
Apache-2.0
first seen
2026-09-10
last seen
2026-09-17
releases · 30d
4
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  2. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  3. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  4. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  5. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  6. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  7. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  8. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  9. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
  10. HIGH code analysis flagged committed secret ×3 in brambleworks/SiteCMD-app
capabilities 23 tools
transport stdio · http counts 23 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • compare_scans
  • get_active_correlations
  • get_causal_graph
  • get_dismissed_issues
  • get_fix_brief
  • get_fix_prompts
  • get_fix_status
  • get_issue
  • get_issues
  • get_likely_causes
  • get_projects
  • get_recent_events
  • get_scan_history
  • get_scan_score
  • get_scan_status
  • how_to_rescan
  • list_fix_attempts
  • preview_deploy_risk
  • request_scan
  • request_verification
  • run_scan
  • start_fix
  • whatif_resolve
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 9304d02 · analyzer v33 · 1h ago

skills & prompt files 8

danger signals11

code evidence vv1.3.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1998

filesystem 112

  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/e2e/fixtures/tauri-stub.ts :3 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/events/events-toolbar-labels.test.ts :3 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/issues/DossierStandardSections.test.tsx :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/reports/report-pdf-colors.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/settings/settings-card-title.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/ui/progress-bar.test.tsx :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/cwv-observer.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/cwv-scripts.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/first-screen-copy.test.ts :3 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/fix-guide-coverage.test.ts :4 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/privileged-command-bridge.test.ts :1 import { existsSync, readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/query/page-cache-contract.test.ts :1 import { readFileSync } from "node:fs";
show 28 more
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/title-bridge.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/webrtc-lockdown.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/styles/focus-visible.test.ts :1 import { readFileSync, readdirSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/styles/link-cursor.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/styles/list-row-hover.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/styles/reduced-motion.test.ts :3 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/styles/visually-hidden.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/vite.config.ts :4 import fs from "fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/scripts/bundle.mjs :2 import { copyFileSync, mkdirSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/scripts/lib/schema-contract.mjs :1 import { readFileSync } from "node:fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/causal_graph.ts :3 import { readFileSync } from "fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/db_connection.ts :3 import { existsSync } from "node:fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/db_manifests.ts :5 import { readFileSync } from "node:fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/heartbeat.ts :3 import { existsSync, readFileSync } from "node:fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/suppressions.ts :7 import { closeSync, constants, fstatSync, openSync, readFileSync } from "node:fs";
  • fs brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/workspace.ts :1 import { existsSync, readFileSync } from "fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/agent_loop.test.mjs :4 import { existsSync, unlinkSync, writeFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/db.test.mjs :3 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/health_check.test.mjs :3 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/heartbeat_parity.test.mjs :2 import { readFile } from "node:fs/promises";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/helpers/schema-fixture.mjs :4 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/regressions_missing_tables.test.mjs :3 import { mkdtempSync, rmSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/rescan_guidance.test.mjs :4 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/start_fix_target.test.mjs :3 import { mkdirSync, writeFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/suppressions.test.mjs :3 import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/tool_output_boundaries.test.mjs :3 import { readFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/tools_list_snapshot.test.mjs :3 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/untrusted_boundary.test.mjs :4 import { writeFileSync } from "node:fs";

72 more not shown — this panel samples each group; the count above is the real total.

shell / exec 42

  • shell (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/vite.config.ts :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/busy_read.test.mjs :3 import { spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/health_check.test.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/rescan_guidance.test.mjs :3 import { spawnSync } from "node:child_process";
  • shell brambleworks-SiteCMD-Local-9304d02/packaging/npm/cli/bin/sitecmd.js :9 const { spawnSync } = require("node:child_process");
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/audit-rust-deps.mjs :2 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/audit/check-codeql.mjs :15 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/audit/check-codeql.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/audit/check-rust-toolchain.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-budget-ratchet.mjs :2 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-budget-ratchet.test.mjs :1 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-commit-message.test.mjs :1 import { execFileSync, spawnSync } from "node:child_process";
show 28 more
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-google-oauth-config.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-knip-export-budget.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-publication-history.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-publication-hygiene.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-release-bump.mjs :2 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-release-bump.test.mjs :1 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-repository-labels.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-repository-protection.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/check-workflows.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/cli-smoke.mjs :3 import { spawn, spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/generate-third-party-artifacts.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/guardrail-test-support.mjs :4 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/installers.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/guardrail-test-wiring-rules.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/native-webdriver.mjs :1 import { spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/wasm-vendor.mjs :1 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/naming-audit.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/prepare-public-history.mjs :3 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/prepare-public-history.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/release-payload-scripts.test.mjs :1 import { spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/release-workflow-scripts.test.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/release.mjs :3 import { execFileSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/repo-guardrail-test-architecture.test.mjs :25 expect(source).not.toContain("spawnSync(");
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/sitecmd.mjs :3 import { spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/tag-release.mjs :3 import { execFileSync, spawnSync } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/tauri-attach.mjs :3 import { spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/tauri-dev.mjs :3 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/verify-push-lib.mjs :1 import { execFileSync } from "node:child_process";

2 more not shown — this panel samples each group; the count above is the real total.

network 10

  • net brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/components/dashboard/useAnalyticsQuery.ts :37 /** A fetch (initial or background) is in flight. */
  • net brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/code-fix-guides/quality.ts :81 "Inventory retries already performed by the SDK, gateway, messaging layer, and caller first; a documented fail-fast policy is valid. Where retries are justified, retry only transient failures (eligibl
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/cli-smoke.mjs :5 import { createServer } from "node:http";
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/guardrail-telemetry-disclosure-rules.mjs :19 !wrapper.includes("fetch(") &&
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/guardrail-telemetry-rules.mjs :60 !wrapper.includes("fetch("),
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/lib/native-webdriver.mjs :3 import { createServer } from "node:net";
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/native-webdriver.test.mjs :1 import { createServer } from "node:http";
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/repo-guardrail-coverage-product.test.mjs :314 mustMutate(source, "sendTelemetryRequest({ args })", "fetch(endpoint)"),
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/tauri-attach-lib.mjs :30 const response = await fetch(url, {
  • net (weak) brambleworks-SiteCMD-Local-9304d02/tools/scripts/verify-push.mjs :13 import net from "node:net";

secrets 2

  • secrets brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/lib/code-fix-guides/security.ts :458 "Delete the placeholder fallback (for example `process.env.SECRET || 'changeme'`) so the value can only come from the environment, and fail fast at startup when the variable is missing instead of runn
  • secrets (weak) brambleworks-SiteCMD-Local-9304d02/apps/desktop/src/pages/IssuesPage.behavior.test.tsx :137 sourceExcerpt: "export const OPENAI_KEY = process.env.OPENAI_KEY;",

database 3

  • db (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/health_check.test.mjs :8 import Database from "better-sqlite3";
  • db (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/helpers/schema-fixture.mjs :8 import Database from "better-sqlite3";
  • db (weak) brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/test/regressions_missing_tables.test.mjs :6 import Database from "better-sqlite3";

tool registrations 23

  • get_active_correlations brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :22
  • get_recent_events brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :49
  • get_likely_causes brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :75
  • get_causal_graph brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :110
  • preview_deploy_risk brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :136
  • whatif_resolve brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/correlation_tools.ts :163
  • get_projects brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :374
  • get_scan_score brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :405
  • get_issues brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :446
  • get_issue brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :546
  • get_fix_prompts brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :610
  • get_scan_history brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :698
show 11 more
  • get_dismissed_issues brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :736
  • compare_scans brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :786
  • how_to_rescan brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :896
  • request_scan brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :907
  • get_fix_brief brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :920
  • start_fix brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :950
  • get_fix_status brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :1037
  • run_scan brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :1110
  • get_scan_status brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :1173
  • request_verification brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :1208
  • list_fix_attempts brambleworks-SiteCMD-Local-9304d02/apps/mcp-server/src/server.ts :1238

install hooks 1

  • prepare brambleworks-SiteCMD-Local-9304d02/package.json :81 lefthook install

declared dependencies 18

  • @eslint/js@^10.0.1
  • @types/node@^26.4.0
  • eslint@^10.9.1
  • eslint-config-prettier@^10.1.8
  • eslint-plugin-check-file@^3.3.2
  • eslint-plugin-react-compiler@19.1.0-rc.2
  • eslint-plugin-react-hooks@^7.1.1
  • eslint-plugin-react-refresh@^0.5.5
  • globals@^17.12.0
  • knip@^6.34.0
  • lefthook@^2.1.12
  • prettier@^3.9.6
show 6 more
  • prettier-plugin-astro@^0.14.1
  • safe-regex@^2.1.1
  • typescript@~6.0.3
  • typescript-eslint@^8.69.0
  • vitest@^4.1.11
  • minisign-verify@=0.2.5