github HTML analyzed 3f8e0e6

davidtost5/sona

Sona — the creator studio that surfaces proven content ideas and helps you write in your own voice.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 3 tools

transport — counts 3 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3f8e0e6 · analyzer v33 · 5d ago

dynamic code execution new Function() davidtost5-sona-3f8e0e6/test/clerk-webhook.test.mjs :7 const verifySvix = new Function('createHmac', 'timingSafeEqual', 'Buffer', 'Date',
dynamic code execution new Function() davidtost5-sona-3f8e0e6/test/daily-order.test.mjs :4 const mk = (day) => new Function('FAKE_DAY', src + `

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 24

fs (weak) davidtost5-sona-3f8e0e6/scripts/preview-email.mjs :8 import { writeFileSync } from 'node:fs';
fs (weak) davidtost5-sona-3f8e0e6/test/clerk-webhook.test.mjs :2 import fs from 'node:fs';
fs (weak) davidtost5-sona-3f8e0e6/test/daily-order.test.mjs :1 import fs from 'node:fs';

net davidtost5-sona-3f8e0e6/api/_email.js :74 const r = await fetch(RESEND_ENDPOINT, {
net davidtost5-sona-3f8e0e6/api/ingest.js :38 const res = await fetch(url, { headers: { 'user-agent': UA }, signal: ctrl.signal });
net davidtost5-sona-3f8e0e6/api/mcp.js :200 const r = await fetch(`${proto}://${host}/api/decode`, {
net davidtost5-sona-3f8e0e6/public/auth.js :27 const res = await fetch('/api/auth-config', { cache: 'no-store' });
net davidtost5-sona-3f8e0e6/public/clerk-auth.js :40 var res = await fetch('/api/auth-config', { cache: 'no-store' });
net davidtost5-sona-3f8e0e6/public/data.js :61 const res = await fetch('/api/waitlist', {

secrets davidtost5-sona-3f8e0e6/api/_email.js :31 if (process.env.RESEND_API_KEY) return 'resend';
secrets davidtost5-sona-3f8e0e6/api/_supabase.js :16 const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
secrets davidtost5-sona-3f8e0e6/api/auth-config.js :14 const anonKey = process.env.SUPABASE_ANON_KEY || '';
secrets davidtost5-sona-3f8e0e6/api/clerk-webhook.js :75 const secret = process.env.CLERK_WEBHOOK_SECRET;
secrets davidtost5-sona-3f8e0e6/api/ingest.js :270 const cronSecret = process.env.CRON_SECRET;
secrets davidtost5-sona-3f8e0e6/api/mcp.js :127 const token = process.env.MCP_TOKEN;
secrets davidtost5-sona-3f8e0e6/api/outliers.js :55 const adminKey = process.env.ADMIN_KEY;
secrets davidtost5-sona-3f8e0e6/api/stripe-webhook.js :53 const secret = process.env.STRIPE_WEBHOOK_SECRET;