github JavaScript re-analysis due

jaapstronks/deckyard

The open-source, end-to-end presentation platform - build, present, publish, and collaborate. Self-hosted, MCP-native, fully themeable.

maintainer: jaapstronks
license: MIT
first seen: 2026-07-22
last seen: 2026-09-05
releases · 30d: 17
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 27 tools

transport stdio · http counts 27 tools · 0 res · 0 prompts permission surface via code analysis

tools

add_comment
add_slide
analyze_presentation
append_slides
compress_presentation
convert_slide
create_presentation
create_presentation_from_slides
delete_presentation
duplicate_presentation
export_presentation
get_presentation
get_presentation_url
get_slide_types
iterate_presentation
list_comments
list_presentations
list_recent_comments
list_themes
preview_presentation
preview_slide
remove_slide
reorder_slides
reply_to_comment
set_comment_status
update_slide
validate_presentation

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 930dc02 · analyzer v33 · 1d ago

skills & prompt files 4

agent-rules jaapstronks-deckyard-930dc02/AGENTS.md
agent-rules jaapstronks-deckyard-930dc02/CLAUDE.md
skill jaapstronks-deckyard-930dc02/skills/agent-install/SKILL.md
skill jaapstronks-deckyard-930dc02/skills/openclaw-skill/SKILL.md

danger signals21

suspicious endpoint 203.0.114.1 jaapstronks-deckyard-930dc02/tests/data-source-refresh-no-sse-broadcast.test.js :31 const PUBLIC_CSV_URL = 'http://203.0.114.1/data.csv';
suspicious endpoint 203.0.114.1 jaapstronks-deckyard-930dc02/tests/data-sources-behavior.test.js :32 const PUBLIC_CSV_URL = 'http://203.0.114.1/data.csv';
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/data-sources-behavior.test.js :201 'http://169.254.169.254/latest/meta-data',
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/export-local-css-url-embed.test.js :101 const html = '<img src="http://169.254.169.254/gone.jpg" alt="Someone">';
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/export-ssrf-strip.test.js :27 image: 'http://169.254.169.254/latest/meta-data/iam/',
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/export-theme-var-assets.test.js :97 'url(http://169.254.169.254/latest/meta-data/), #000',
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/imagekit-url-ssrf-guard.test.js :35 const METADATA_URL = 'http://169.254.169.254/latest/meta-data/img.jpg';
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/notion-image-media-library-fallback.test.js :114 const METADATA_URL = 'http://169.254.169.254/latest/meta-data/img.jpg';
suspicious endpoint 203.0.114.9 jaapstronks-deckyard-930dc02/tests/publish-convergence.test.js :40 const WEBHOOK_URL = 'http://203.0.114.9/published';
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/security-low-severity-hardening.test.js :96 const dirty = `@import url('http://169.254.169.254/');
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/security-resource-authz-and-ssrf.test.js :340 'http://169.254.169.254/latest/meta-data/',
suspicious endpoint 169.254.169.254 (cloud metadata) jaapstronks-deckyard-930dc02/tests/ssrf-guard.test.js :83 'http://169.254.169.254/latest/meta-data/',
suspicious endpoint 8.8.8.8 jaapstronks-deckyard-930dc02/tests/ssrf-guard.test.js :114 const url = await assertPublicHttpUrl('https://8.8.8.8/logo.png');
suspicious endpoint 203.0.114.1 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :43 presentationMovedToOrganizationUrl: 'http://203.0.114.1/moved',
suspicious endpoint 203.0.114.2 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :44 slideAddedToOrganizationLibraryUrl: 'http://203.0.114.2/library',
suspicious endpoint 203.0.114.3 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :45 presentationPublishedUrl: 'http://203.0.114.3/published',
suspicious endpoint 203.0.114.4 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :46 commentCreatedUrl: 'http://203.0.114.4/comment',
suspicious endpoint 203.0.114.5 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :47 interactionPollClosedUrl: 'http://203.0.114.5/poll',
suspicious endpoint 203.0.114.6 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :48 interactionLikertClosedUrl: 'http://203.0.114.6/likert',
suspicious endpoint 203.0.114.7 jaapstronks-deckyard-930dc02/tests/webhook-payload-contracts.test.js :49 interactionFeedbackSubmittedUrl: 'http://203.0.114.7/feedback',
credential in logs credential in log jaapstronks-deckyard-930dc02/server/jobs/auth-cleanup.js :46 log.info(`Deleted ${passwordResetTokens} expired password reset tokens`);

code evidence vv1.30.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 2052

filesystem 240

fs jaapstronks-deckyard-930dc02/capture/lib/recipe.js :66 import fs from 'node:fs';
fs jaapstronks-deckyard-930dc02/capture/run.js :36 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/audit-codebase.js :1 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/download-google-fonts.js :32 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-bundled-gradients.js :14 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-slide-ai-aggregator.js :28 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-slide-authoring-aggregator.js :26 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-slide-css-aggregators.js :27 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-slide-inline-edit-aggregator.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/generate-slide-type-docs.js :31 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/i18n-anchor-report.js :24 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/i18n-audit.js :31 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/i18n-fill.js :23 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/lib/i18n-fs.js :21 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/lib/i18n-keys.js :38 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/lib/i18n-locales.js :30 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/lint-dead-css.js :68 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/lint-dead-exports.js :46 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/migrate-data-to-postgres.js :31 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/migrate-legacy-bg-image.js :72 import { readdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/migrate-lijstje-slide.js :63 import { readdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/migrate-slides.js :32 import { readdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/new-slide-type.js :37 import { existsSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/scripts/prune-legacy-data.js :35 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/restore-orphaned-presentations.js :1 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/scan-slide-type.js :29 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/seed-bg-contrast-demo.js :21 import { writeFile, mkdir } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/setup.js :12 import { readFile, writeFile, access } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/theme-preview.js :39 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/vendor-dompurify.js :14 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/vendor-hls.js :26 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/vendor-lucide.js :1 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/vendor-pdfjs.js :28 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/scripts/vendor-prism-katex.js :20 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/config/env.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/db/migrate.js :18 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/db/migrations/053_import_file_versions_to_table.js :26 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/db/migrations/058_email_templates_to_table.js :30 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/db/migrations/059_settings_to_tables.js :40 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/export/bulk-export.js :21 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/export/deck-bundle.js :20 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/i18n/index.js :10 import { readFileSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/jobs/queue/workers/bulk-export-worker.js :10 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/mcp/custom-tools-loader.js :22 import { existsSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/media/bundled-gradients.js :25 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/media/local.js :6 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/render/deck-thumbnail.js :2 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/render/pdf-to-images.js :2 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/routes/api/assets.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/routes/api/jobs.js :11 import { createReadStream } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/routes/public-api/v1/index.js :6 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/routes/static/app-shell.js :2 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/server/sandbox/examples.js :13 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/server.js :2 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/storage/boot-check.js :14 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/storage/uploads.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/ai/logging.js :12 import fs from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/ai/prompts/custom-loader.js :27 import { existsSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/ai/slide-catalog/custom-catalog-loader.js :36 import { existsSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/ai/slide-catalog/custom-loader.js :18 import { readdirSync, existsSync, statSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/ai/validation-logging.js :11 import fs from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/css-chain.js :25 import { existsSync, readFileSync, readdirSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/curated-font-embed.js :1 import fs from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/embed-fonts.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/html-utils.js :7 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/http.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/llm/vision.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/prism-katex.js :28 import fs from 'node:fs';
fs jaapstronks-deckyard-930dc02/server/utils/puppeteer-browser.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/read-css-with-imports.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/server/utils/themes.js :1 import fs from 'node:fs/promises';
fs jaapstronks-deckyard-930dc02/shared/custom-fonts-loader.js :29 import { existsSync } from 'node:fs';
fs jaapstronks-deckyard-930dc02/shared/slide-types/custom-loader.js :16 import { readdirSync, existsSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/eval/report.js :6 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/lib/cases.js :9 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/lib/prompt-version.js :12 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/runner/run.js :21 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/runner/stage.js :36 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/scripts/fetch-cases.js :14 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/scripts/parse-reference.js :11 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/test-suite/scripts/rebuild-report.js :13 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/app-shell-csp-header.test.js :24 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/app-shell-self-hosted-dompurify.test.js :14 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/app-shell-third-party-cdn.test.js :14 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/aside-inset.test.js :32 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/authz-401-403-split.test.js :43 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/authz-matrix-pin.test.js :949 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/bundled-gradients.test.js :19 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/capture-join-code-pin.test.js :22 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/capture-recipe-graph-hash.test.js :18 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/client-authz-mirror-coverage.test.js :29 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/collab-deck-ydoc.test.js :15 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/collaborator-cross-org-endpoints.test.js :55 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/comparison-slide.test.js :25 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/css-breakpoints.test.js :21 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/css-spacing-tokens.test.js :45 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/custom-imports-resolvable.test.js :50 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/custom-slide-type-validity.test.js :31 } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-bundle.test.js :13 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-card-fields.test.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-format-spec.test.js :21 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-language-axis.test.js :18 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-thumbnail.test.js :16 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/deck-translation-langs.test.js :12 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/default-org-fallback-guard.test.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/docs-paths-resolvable.test.js :21 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/docs-prose-claims.test.js :30 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/email-preview-sandboxed.test.js :33 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/email-templates-import-migration.test.js :17 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/empty-state-single-vocabulary.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/env-manifest.test.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/error-details-register-guard.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/error-envelope-stragglers-guard.test.js :29 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/export-font-embed.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/export-pdf-image-compression-wired.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/export-structural-metrics.test.js :40 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/export-worker-theme.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/feedback-surfaces-guard.test.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/field-behaviour-declarations.test.js :22 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/field-types.test.js :3 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/follow-audience-smoke.test.js :48 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/fork-css-seam.test.js :32 import { mkdtempSync, mkdirSync, symlinkSync, writeFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/form-input-size-ladder.test.js :25 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/getstorage-strip-burndown.test.js :26 import { readdirSync, readFileSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/google-fonts-lock.test.js :32 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/helpers/call-sites.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/helpers/slide-type-companions.js :29 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/helpers/slide-type-name-branching.js :32 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-audit.test.js :27 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-cli-vocabulary-gate.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-coverage.test.js :36 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-duplicate-keys.test.js :27 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-locales.test.js :16 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/i18n-sync-plan.test.js :34 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/images-field-extension-point.test.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/import-deck.test.js :17 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/inline-svg-single-source.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/jobs-interval-lifecycle-gate.test.js :20 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/json-body-entry-guard.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/json-body-object-guard.test.js :4 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/labeled-checkbox-single-builder.test.js :22 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/legacy-bg-image-migration.test.js :26 import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/lijstje-slide-migration.test.js :21 import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/list-alignment.test.js :19 import { readFileSync, readdirSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/listing-filter-vocabulary.test.js :42 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/live-session-vocabulary.test.js :28 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/live-sessions-deck-updated.test.js :3 import { mkdtempSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/llm-app-error.test.js :21 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-slide-lock.test.js :24 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-sse.test.js :254 const content = await fs.readFile(path.join(MCP_DIR, 'sse.js'), 'utf8');
fs (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-stdio-stdout-protocol.test.js :25 } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/media-app-error.test.js :16 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/media-key-traversal.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/media-upload-routes-contract.test.js :46 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/migrate-data-import.test.js :17 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/nested-surface-contrast.test.js :20 import { readFileSync, readdirSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/new-slide-type-scaffold.test.js :14 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-direct-object-url.test.js :20 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-escape-markdown-aliases.test.js :27 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-formatnumber-alias.test.js :20 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-raw-console.test.js :29 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-raw-create-element.test.js :26 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-raw-eventsource.test.js :18 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-third-party-origins.test.js :30 import { readdir, readFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-time-formatter-aliases.test.js :25 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/no-unsanitized-innerhtml.test.js :37 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/notion-datasource-app-error.test.js :13 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/notion-image-media-library-fallback.test.js :17 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/openai-ai-app-error.test.js :16 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/openapi-route-diff.test.js :31 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/organization-vocabulary.test.js :41 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/pagination-params-single-parser.test.js :21 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/pdf-image-compression.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/pdf-image-display-aware.test.js :19 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/pdf-import-self-hosted.test.js :23 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-error-envelope.test.js :18 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/qa-single-owner.test.js :25 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/removed-slide-types.test.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/render-path-registry.test.js :28 import { existsSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/response-identity-shape.test.js :60 import { readdirSync, readFileSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/route-dispatch-guard.test.js :37 import { readdirSync, readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/route-error-handlers-no-leak.test.js :15 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/route-error-wrapper-gate.test.js :23 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/route-field-validation-guard.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/router-query-ownership.test.js :19 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/sandbox-playground.test.js :17 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/sanitizer-fallback-path.test.js :20 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/schema-version.test.js :4 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/script-chain.test.js :25 import { readFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/scripts-reachable-gate.test.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-client-ip-and-code-entropy.test.js :20 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-error-leaks-and-response-headers.test.js :20 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-low-severity-hardening.test.js :21 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-owner-scoping-and-path-traversal.test.js :19 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-password-hashing-and-auth-secret.test.js :27 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/security-resource-authz-and-ssrf.test.js :33 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/served-surface-csp-header.test.js :24 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/server-module-layout.test.js :54 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/settings-import-migration.test.js :20 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/share-guest-verify-error-notice.test.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/share-link-access-log-scope.test.js :39 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/shelf-vocabulary.test.js :61 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-ai-aggregator.test.js :21 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-authoring-aggregator.test.js :20 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-bg-luminance-contract.test.js :32 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-copy-language.test.js :18 import { readFileSync, readdirSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-css-aggregators.test.js :3 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-css-tokens.test.js :43 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-id-columns-text.test.js :17 import { readdir, readFile } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-inline-edit-aggregator.test.js :27 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-partials.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-photo-scrim.test.js :30 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-shadow-token-guardrail.test.js :33 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-count-prose-guard.test.js :4 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-css-contract.test.js :35 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-directory-boundary.test.js :32 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-docs.test.js :3 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-groups.test.js :22 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-i18n-orphans.test.js :3 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-type-shared-copy-gate.test.js :33 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/slide-typography-scale.test.js :24 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/snapshot-identity-backfill-coverage.test.js :25 import { readdir } from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/sse-error-event-shape.test.js :20 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/sse-hub-single-registry.test.js :23 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/sse-single-writer-gate.test.js :23 import { readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/storage-boot-check.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/storage-call-convention.test.js :57 import { readdirSync, readFileSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/storage-caller-convention.test.js :29 import { readdirSync, readFileSync, statSync, existsSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/storage-collab-app-error.test.js :15 import { mkdtempSync, readFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/storage-reason-vocabulary.test.js :77 import { readdirSync, readFileSync, statSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/svg-serve-headers.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/teardown-vocabulary-gate.test.js :29 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/text-field-vocabulary-gate.test.js :24 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/theme-builtin-ids.test.js :28 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/theme-embed-fonts.test.js :25 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/theme-surface-tokens.test.js :15 import { readFileSync } from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/thumbnail-warm-on-save.test.js :28 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/toast-call-shape.test.js :25 import fs from 'node:fs';
fs (weak) jaapstronks-deckyard-930dc02/tests/vendor-manifests.test.js :3 import fs from 'node:fs/promises';
fs (weak) jaapstronks-deckyard-930dc02/tests/vendored-icons-tree.test.js :23 import fs from 'node:fs';

shell / exec 14

shell jaapstronks-deckyard-930dc02/client/views/editor/inline-edit/selection-toolbar.js :99 exec('bold'),
shell (weak) jaapstronks-deckyard-930dc02/scripts/lint-dead-css.js :67 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/scripts/lint-dead-exports.js :45 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/dead-css-gate.test.js :25 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/docs-paths-resolvable.test.js :23 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/docs-prose-claims.test.js :32 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/error-details-register-guard.test.js :24 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/helpers/slide-type-name-branching.js :31 import { execSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/i18n-cli-vocabulary-gate.test.js :26 import { spawnSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/i18n-sync-plan.test.js :37 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-stdio-stdout-protocol.test.js :18 import { spawn } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/removed-slide-types.test.js :21 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/server-module-layout.test.js :56 import { execFileSync } from 'node:child_process';
shell (weak) jaapstronks-deckyard-930dc02/tests/slide-type-count-prose-guard.test.js :3 import { execFileSync } from 'node:child_process';

network 54

net jaapstronks-deckyard-930dc02/capture/lib/api.js :30 const res = await fetch(`${base}${pathname}`, {
net jaapstronks-deckyard-930dc02/capture/lib/marketing.js :126 const res = await fetch(
net jaapstronks-deckyard-930dc02/client/lib/api.js :4 * Every request to our own `/api/*` surface goes through `api()`; raw `fetch(`
net jaapstronks-deckyard-930dc02/client/lib/net/ai-stream.js :59 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/client/lib/theme/theme.js :129 const resp = await fetch(urlPath, { cache: 'no-store' });
net jaapstronks-deckyard-930dc02/client/lib/ui-i18n.js :184 const res = await fetch(url, { cache: 'no-store' });
net jaapstronks-deckyard-930dc02/client/lib/user/organization-switcher.js :72 * @param {Function} [options.load] - Override for the list fetch (tests).
net jaapstronks-deckyard-930dc02/client/views/editor/export-modal.js :196 const res = await fetch(url, {
net jaapstronks-deckyard-930dc02/client/views/editor/fields/icon-picker-modal.js :35 const res = await fetch('/client/vendor/lucide-icons/tags.json');
net jaapstronks-deckyard-930dc02/client/views/editor/image-library/upload.js :53 const uploadResp = await fetch(presign.uploadUrl, {
net jaapstronks-deckyard-930dc02/client/views/editor/modals/analyze-modal.js :114 const response = await fetch(`/api/presentations/${id}/analyze`, {
net jaapstronks-deckyard-930dc02/client/views/editor/modals/import-slides-tab.js :190 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/client/views/follow/i18n.js :49 const res = await fetch(
net jaapstronks-deckyard-930dc02/client/views/list/modals/new-presentation/handlers.js :238 const response = await fetch('/api/convert/stream', {
net jaapstronks-deckyard-930dc02/client/views/list/views/home-view.js :295 // Home they're redundant with the work you already see. We over-fetch (raw
net jaapstronks-deckyard-930dc02/client/views/settings/organization-members/panel.js :45 * @param {Function} [options.load] - Override for the members fetch (tests).
net jaapstronks-deckyard-930dc02/client/views/settings/organization-profile/panel.js :47 * @param {Function} [options.load] - Override for the organization fetch (tests).
net jaapstronks-deckyard-930dc02/client/views/settings/theme-editor/upload-image.js :50 const uploadResp = await fetch(presign.uploadUrl, {
net jaapstronks-deckyard-930dc02/eslint.config.js :28 // silently un-gate t()/fetch()/control-class for those files.
net (weak) jaapstronks-deckyard-930dc02/scripts/download-google-fonts.js :130 const response = await fetch(url, { headers: { 'User-Agent': USER_AGENT } });
net (weak) jaapstronks-deckyard-930dc02/scripts/seed-bg-contrast-demo.js :55 const res = await fetch(`${BASE}${pathname}`, {
net (weak) jaapstronks-deckyard-930dc02/scripts/test-concurrent-votes.js :16 import http from 'node:http';
net jaapstronks-deckyard-930dc02/server/analytics/tracking-script.js :59 fetch(endpoint, {
net jaapstronks-deckyard-930dc02/server/export/bulk-export.js :170 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/server/export/video-helpers.js :183 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/server/export/video-thumbnail.js :114 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/server/integrations/email/core.js :105 const resp = await fetch(BREVO_API_URL, {
net jaapstronks-deckyard-930dc02/server/integrations/giphy.js :118 const resp = await fetch(url);
net jaapstronks-deckyard-930dc02/server/integrations/unsplash.js :99 const resp = await fetch(downloadLocation, {
net jaapstronks-deckyard-930dc02/server/media/imagekit.js :64 const res = await fetch(url, opts);
net jaapstronks-deckyard-930dc02/server/routes/api/font-families.js :135 const resp = await fetch(cssUrl);
net jaapstronks-deckyard-930dc02/server/server.js :1 import http from 'node:http';
net jaapstronks-deckyard-930dc02/server/storage/api-usage.js :112 * @param {number} [options.days] - Number of days to fetch (default 30)
net jaapstronks-deckyard-930dc02/server/utils/api-fetch.js :16 const resp = await fetch(url, options);
net jaapstronks-deckyard-930dc02/server/utils/author-overlay.js :222 const response = await fetch(url, {
net jaapstronks-deckyard-930dc02/server/utils/data-source/index.js :74 return provider.fetch(config);
net jaapstronks-deckyard-930dc02/server/utils/data-source/provider-base.js :30 async fetch(providerConfig) {
net jaapstronks-deckyard-930dc02/server/utils/embed-fonts.js :54 const resp = await fetch(url, {
net jaapstronks-deckyard-930dc02/server/utils/html-utils.js :273 // headless Chrome at setContent → server-side fetch (SSRF). Inline remote
net jaapstronks-deckyard-930dc02/server/utils/llm/provider-base.js :48 const resp = await fetch(endpoint, {
net jaapstronks-deckyard-930dc02/server/utils/llm/providers/openai-compat.js :30 const resp = await fetch(endpoint, {
net jaapstronks-deckyard-930dc02/server/utils/notion/client.js :80 const res = await fetch(`https://api.notion.com/v1${path}`, {
net jaapstronks-deckyard-930dc02/server/utils/ssrf-guard.js :15 * public address here and a private one on the real fetch (TOCTOU). Closing
net jaapstronks-deckyard-930dc02/server/utils/webhooks.js :89 const resp = await fetch(u, {
net (weak) jaapstronks-deckyard-930dc02/test-suite/scripts/fetch-cases.js :89 const response = await fetch(url, {
net (weak) jaapstronks-deckyard-930dc02/tests/collab-editor-binder.test.js :14 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/collab-live-edits.test.js :12 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/collab-presence.test.js :3 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/collab-server-apply.test.js :17 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/export-gradient-raster.test.js :29 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/notion-routes-contract.test.js :22 * network seam (`notionFetchJson` → `fetch('https://api.notion.com/v1…')`, the
net (weak) jaapstronks-deckyard-930dc02/tests/pg/tags-storage.pgtest.js :10 * - bulk fetch (list views)
net (weak) jaapstronks-deckyard-930dc02/tests/server-boot-smoke.test.js :33 import http from 'node:http';
net (weak) jaapstronks-deckyard-930dc02/tests/viewer-chrome-smoke.test.js :49 import http from 'node:http';

secrets 53

secrets jaapstronks-deckyard-930dc02/server/config/database.js :147 password: process.env.DATABASE_PASSWORD || '',
secrets (weak) jaapstronks-deckyard-930dc02/test-suite/lib/anthropic.js :17 const apiKey = process.env.ANTHROPIC_API_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/test-suite/runner/run.js :128 if (!process.env.CLAUDE_API && process.env.ANTHROPIC_API_KEY) {
secrets (weak) jaapstronks-deckyard-930dc02/test-suite/runner/stage.js :120 if (!process.env.CLAUDE_API && process.env.ANTHROPIC_API_KEY) {
secrets (weak) jaapstronks-deckyard-930dc02/tests/admin-users-organization-scope.test.js :30 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/analytics-session-device-label.test.js :60 process.env.AUTH_SECRET = 'test-secret-for-device-labels-0123456789';
secrets (weak) jaapstronks-deckyard-930dc02/tests/auth-identity-multi-org.test.js :32 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/auth-identity-resolution.test.js :26 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/auth-routes-reset-and-magic-link.test.js :48 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/auth-routes-rest.test.js :353 .createHmac('sha256', String(process.env.AUTH_SECRET || ''))
secrets (weak) jaapstronks-deckyard-930dc02/tests/authz-organization-scope-multi-org.test.js :42 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/authz-organization-scope.test.js :31 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/collab-editor-binder.test.js :21 delete process.env.AUTH_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/collab-live-edits.test.js :21 delete process.env.AUTH_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/collab-presence.test.js :11 delete process.env.AUTH_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/collab-server-apply.test.js :25 delete process.env.AUTH_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/collaborators-permission-model.test.js :47 delete process.env.BREVO_API_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/comment-recipients-scope.test.js :22 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/comments-routes-authz.test.js :50 delete process.env.BREVO_API_KEY; // the notify path is fire-and-forget; keep it off the network
secrets (weak) jaapstronks-deckyard-930dc02/tests/custom-slide-type-write-seam.test.js :32 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/data-sources-behavior.test.js :79 delete process.env.NOTION_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/email-send-failure-typing.test.js :17 const savedKey = process.env.BREVO_API_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/email-senders.test.js :25 process.env.BREVO_API_KEY = 'test-key-not-a-secret';
secrets (weak) jaapstronks-deckyard-930dc02/tests/identity-api-contract.test.js :32 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/imagekit-url-ssrf-guard.test.js :17 process.env.IMAGEKIT_PRIVATE_KEY = 'private_test';
secrets (weak) jaapstronks-deckyard-930dc02/tests/invitation-send-reporting.test.js :34 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/invitation-status-date-shape.test.js :21 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-sse-tenancy.test.js :27 process.env.AUTH_SECRET = ['amethyst', 'test', 'sse', 'tenancy']
secrets (weak) jaapstronks-deckyard-930dc02/tests/mcp/mcp-tool-permissions.test.js :27 process.env.AUTH_SECRET = ['amethyst', 'test', 'permissions']
secrets (weak) jaapstronks-deckyard-930dc02/tests/media-app-error.test.js :62 delete process.env.IMAGEKIT_PRIVATE_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/media-config-s3.test.js :63 process.env.S3_ACCESS_KEY = 'ak';
secrets (weak) jaapstronks-deckyard-930dc02/tests/media-upload-routes-contract.test.js :54 delete process.env.UNSPLASH_ACCESS_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/notion-datasource-app-error.test.js :36 delete process.env.NOTION_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/notion-routes-contract.test.js :42 delete process.env.NOTION_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/organization-host-independence.test.js :44 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-partial-write.test.js :29 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-slide-type-validation.test.js :29 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-ai.test.js :28 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-comments.test.js :30 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-exports.test.js :30 process.env.AUTH_SECRET = ['amethyst', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-publishing.test.js :32 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-resources.test.js :25 process.env.AUTH_SECRET = ['amethyst', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-router.test.js :28 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-slide-library.test.js :26 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/public-api-v1-translate.test.js :31 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/publish-convergence.test.js :27 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/request-organization-binding-multi-org.test.js :42 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/request-organization-binding.test.js :30 process.env.AUTH_SECRET = ['deckyard', 'test', 'auth']
secrets (weak) jaapstronks-deckyard-930dc02/tests/s3-upload-maxbytes.test.js :27 process.env.S3_ACCESS_KEY = 'ak-test';
secrets (weak) jaapstronks-deckyard-930dc02/tests/share-link-guest-management-authz.test.js :34 delete process.env.BREVO_API_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/share-links-public-path.test.js :47 delete process.env.BREVO_API_KEY;
secrets (weak) jaapstronks-deckyard-930dc02/tests/viewer-chrome-smoke.test.js :56 delete process.env.AUTH_SECRET;
secrets (weak) jaapstronks-deckyard-930dc02/tests/viewer-email-routes-contract.test.js :53 delete process.env.BREVO_API_KEY;

database 4

db (weak) jaapstronks-deckyard-930dc02/scripts/migrate-data-to-postgres.js :35 import pg from 'pg';
db jaapstronks-deckyard-930dc02/server/db/client.js :6 import pg from 'pg';
db jaapstronks-deckyard-930dc02/server/db/migrate.js :23 import pg from 'pg';
db (weak) jaapstronks-deckyard-930dc02/tests/pg/helpers/harness.js :55 import pg from 'pg';

tool registrations 27

get_slide_types jaapstronks-deckyard-930dc02/server/mcp/tools.js :253
list_presentations jaapstronks-deckyard-930dc02/server/mcp/tools.js :302
get_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :390
create_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :426
create_presentation_from_slides jaapstronks-deckyard-930dc02/server/mcp/tools.js :543
update_slide jaapstronks-deckyard-930dc02/server/mcp/tools.js :739
add_slide jaapstronks-deckyard-930dc02/server/mcp/tools.js :801
convert_slide jaapstronks-deckyard-930dc02/server/mcp/tools.js :864
iterate_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :925
validate_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :987
list_themes jaapstronks-deckyard-930dc02/server/mcp/tools.js :1035
delete_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1067
remove_slide jaapstronks-deckyard-930dc02/server/mcp/tools.js :1108
reorder_slides jaapstronks-deckyard-930dc02/server/mcp/tools.js :1153
append_slides jaapstronks-deckyard-930dc02/server/mcp/tools.js :1199
compress_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1284
analyze_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1348
duplicate_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1394
get_presentation_url jaapstronks-deckyard-930dc02/server/mcp/tools.js :1434
export_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1473
preview_slide jaapstronks-deckyard-930dc02/server/mcp/tools.js :1543
preview_presentation jaapstronks-deckyard-930dc02/server/mcp/tools.js :1584
list_comments jaapstronks-deckyard-930dc02/server/mcp/tools.js :1639
list_recent_comments jaapstronks-deckyard-930dc02/server/mcp/tools.js :1727
add_comment jaapstronks-deckyard-930dc02/server/mcp/tools.js :1940
reply_to_comment jaapstronks-deckyard-930dc02/server/mcp/tools.js :1968
set_comment_status jaapstronks-deckyard-930dc02/server/mcp/tools.js :2008

install hooks 1

postinstall jaapstronks-deckyard-930dc02/package.json :53 node scripts/vendor-lucide.js && node scripts/vendor-dompurify.js && node scripts/vendor-prism-katex.js && node scripts/vendor-pdfjs.js && node scripts/vendor-hls.js && node scripts/download-google-fo

declared dependencies 37

@hocuspocus/provider@^4.6.0
dompurify@^3.4.14
feed@^6.0.0
hls.js@^1.7.1
jsdom@^30.0.1
jszip@^3.10.1
katex@0.18.4
kysely@^0.29.5
lucide-static@^1.33.0
mammoth@^1.12.1
openid-client@^6.8.7
pdfjs-dist@5.4.296
pg@^8.23.0
prismjs@1.30.0
sharp@^0.35.3
yaml@^2.8.2
yjs@^13.6.32
zod@^4.4.3
@anthropic-ai/sdk@^0.120.0
@eslint/js@^10.0.1
acorn@^8.18.0
es-module-lexer@^2.3.2
esbuild@0.28.2
eslint@^10.9.0
eslint-plugin-import-x@^4.17.1
globals@^17.11.0
image-size@file:./vendor/image-size-stub
prettier@3.9.6
@aws-sdk/client-s3@^3.1116.0
@aws-sdk/s3-request-presigner@^3.1116.0
@hocuspocus/server@^4.6.0
bullmq@^6.2.0
crossws@^0.4.12
ioredis@^6.0.0
pdf-parse@^2.4.5
pptxgenjs@^4.0.1
puppeteer-core@^25.8.0

obfuscation 4

dynamic require()/import() jaapstronks-deckyard-930dc02/tests/ai-route-dispatch.test.js :77 const mod = await import(`../server/routes/api/ai/${file}`);
dynamic require()/import() jaapstronks-deckyard-930dc02/tests/cross-repo-consumer-exports.test.js :73 const module = await import(`../${file}`);
dynamic require()/import() jaapstronks-deckyard-930dc02/tests/static-route-dispatch.test.js :80 const mod = await import(`../server/routes/static/${file}`);
dynamic require()/import() jaapstronks-deckyard-930dc02/tests/storage-scope-contract.test.js :393 const mod = await import(`../server/storage/${file}`);