registry / @querygraph/verdun / 0.5.0

@querygraph/verdun@0.5.0

Verdun is the reusable core for database-backed collection/review workbenches. This repository carries the generic core plus a neutral bundled demo instance. Product apps extend Verdun through public package, API, database, deploy, and crawler contracts w

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 401 KB of source, external domains: 127.0.0.1, api.resend.com, api.vercel.com, app.example.test, example.com, example.test, oauth2.googleapis.com

Source & flagged code

15 flagged

scripts/smoke-email-auth.mjsView file

Lines 58-98javascript

58 name: null,

59 picture_url: null,

60 provider: 'email',

61 provider_subject: 'person@example.test',

62 tier: 'free',

63 status: 'active',

64 created_at: '2026-07-14T00:00:00.000Z',

65 updated_at: '2026-07-14T00:00:00.000Z',

66 last_login_at: '2026-07-14T00:00:00.000Z',

67}

69if (normalizeVerdunEmail(' Person@Example.Test ') !== 'person@example.test') {

70 throw new Error('email normalization must trim and lowercase without provider-specific rewriting')

71}

72for (const invalidEmail of ['', 'missing-at.example.test', 'person@localhost', 'two words@example.test', 'two@ats@example.test']) {

73 await expectError(() => normalizeVerdunEmail(invalidEmail), 'invalid_email')

74}

75if (assertVerdunAuthPepper(` ${pepper} `) !== pepper) throw new Error('auth pepper should be trimmed')

76await expectError(() => assertVerdunAuthPepper('too-short'), 'auth_pepper_not_configured')

78const password = 'correct horse battery staple'

Medium

Secret Pattern

Package contains a possible secret pattern.

scripts/smoke-email-auth.mjsView on unpkg · L78

79const passwordHash = await hashVerdunPassword(password)

80if (!passwordHash.startsWith('scrypt$32768$8$1$') || passwordHash.includes(password)) {

81 throw new Error(`password hash uses an unexpected or unsafe representation: ${passwordHash}`)

82}

83if (!await verifyVerdunPassword(password, passwordHash)) throw new Error('password verifier rejected the correct password')

84if (await verifyVerdunPassword('wrong-password', passwordHash)) throw new Error('password verifier accepted an incorrect password')

85if (await verifyVerdunPassword(password, 'not-a-password-hash')) throw new Error('password verifier accepted an invalid hash')

87const linkToken = 'raw-link-token'

88const tokenHash = hashVerdunEmailLinkToken(linkToken)

89if (tokenHash === linkToken || tokenHash.length !== 64) throw new Error('link tokens must be stored as SHA-256 hashes')

90const codeHash = hashVerdunEmailCode(accountRow.id, '001234', pepper)

91if (codeHash.includes('001234') || codeHash === hashVerdunEmailCode(accountRow.id, '001234', `${pepper}-different`)) {

92 throw new Error('six-digit codes must be stored as challenge-bound, peppered HMACs')

93}

95const sql = fakeSql({ accountRow, passwordHash })

96const challenge = await requestVerdunEmailChallenge(sql, {

97 purpose: 'verify_email',

98 email: ' Person@Example.Test ',

Lines 144-184javascript

144})

145if (completed.account.id !== accountRow.id || completed.sessionToken.length < 40) {

146 throw new Error(`challenge completion returned an invalid account/session: ${JSON.stringify(completed)}`)

scripts/smoke-account-store.mjsView file

Lines 1-63javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process'

3import { mkdir, mkdtemp, readFile } from 'node:fs/promises'

High

Child Process

Package source references child process execution.

scripts/smoke-account-store.mjsView on unpkg · L1

4import { join } from 'node:path'

scripts/deploy-workbench-database.mjsView file

Lines 141-181javascript

141 ? 'generic workbench database load applied and deployed database gate passed'

142 : 'generic workbench database deployment preflight passed (dry run only; add --apply to load external Postgres)')

143}

144

145function optionValue(args, name) {

146

scripts/smoke-email-auth-postgres.mjsView file

Lines 28-115javascript

28await admin.connect()

29try {

30 await admin.query(`create database ${databaseName}`)

31 client = new Client({ database: databaseName, host: '/tmp'

Source & flagged code

15 flagged · loading source

scripts/smoke-email-auth.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code