registry / pi-source-drafts / 0.1.1

pi-source-drafts@0.1.1

Auto-capture external source information (web search, fetch, user input) as structured Markdown drafts

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 46.8 KB of source, external domains: example.com

Source & flagged code

5 flagged

src/draft-store.test.tsView file

Lines 133-186typescript

133 await store.save({

134 title: "Tagged",

135 content: "# Tagged\n\nHas tags.",

136 sourceType: "user_source",

137 tags: ["important", "security"],

138 });

139 await store.save({

140 title: "Plain",

141 content: "# Plain\n\nNo tags.",

142 sourceType: "user_source",

143 });

144

145 const results = await store.search({ query: "Tagged", tags: ["security"] });

146 expect(results.length).toBeGreaterThan(0);

147 expect(results.every((r) => r.entry.tags.includes("security"))).toBe(true);

148 });

149

150 test("redacts API keys", async () => {

151 const { folderPath } = await store.save({

152 title: "Secret",

153 content: "# Secret\n\nsk-abc123def4567890123456.\ngithub_pat_11AAABBBCCCDDDEEEEFFFFGGGG\nAKIAIOSFODNN7EXAMPLE\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/draft-store.test.tsView on unpkg · L153

Critical

Secret Pattern

GitHub fine-grained PAT in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

154 sourceType: "user_source",

155 });

156 const saved = await store.get(basename(folderPath));

157 expect(saved!.content).not.toContain("sk-proj-abc123def456");

158 expect(saved!.content).not.toContain("github_pat_11AAABBBCCCDDD");

159 expect(saved!.content).not.toContain("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L159

160 expect(saved!.content).toContain("[REDACTED");

161 });

162

163 test("redacts private keys", async () => {

164 const { folderPath } = await store.save({

165 title: "Private Key",

166 content: "# Private Key\n\n-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----\n",

Critical

Secret Pattern

RSA private key in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L166

167 sourceType: "user_source",

168 });

169 const saved = await store.get(basename(folderPath));

170 expect(saved!.content).not.toContain("RSA PRIVATE KEY");

171 });

172

173 test("regular text is not redacted", async () => {

174 const { folderPath } = await store.save({

175 title: "Clean",

176 content: "# Clean\n\nJust normal docs.",

177 sourceType: "user_source",

178 });

179 const saved = await store.get(basename(folderPath));

180 expect(saved!.content).toContain("normal docs");

181 });

182

183 test("empty title handled", async () => {

184 const { folderPath } = await store.save({

185 title: "",

186 content: "# \n\nContent without title.",

Source & flagged code

5 flagged · loading source

src/draft-store.test.tsView file

153patternName = github_fine_grained severity = critical line = 153 matchedText = content:...\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/draft-store.test.tsView on unpkg · L153

153patternName = github_fine_grained severity = critical line = 153 matchedText = content:...\n",

Critical

Secret Pattern

GitHub fine-grained PAT in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

153patternName = aws_access_key severity = critical line = 153 matchedText = content:...\n",

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

159patternName = aws_access_key severity = critical line = 159 matchedText = expect(s...E");

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L159

166patternName = private_key_rsa severity = critical line = 166 matchedText = content:...\n",

Critical

Secret Pattern

RSA private key in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L166

Findings

5 Critical5 Low

CriticalCritical Secretsrc/draft-store.test.ts

CriticalSecret Patternsrc/draft-store.test.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/draft-store.test.tsView file

Lines 133-186typescript

133 await store.save({

134 title: "Tagged",

135 content: "# Tagged\n\nHas tags.",

136 sourceType: "user_source",

137 tags: ["important", "security"],

138 });

139 await store.save({

140 title: "Plain",

141 content: "# Plain\n\nNo tags.",

142 sourceType: "user_source",

143 });

144

145 const results = await store.search({ query: "Tagged", tags: ["security"] });

146 expect(results.length).toBeGreaterThan(0);

147 expect(results.every((r) => r.entry.tags.includes("security"))).toBe(true);

148 });

149

150 test("redacts API keys", async () => {

151 const { folderPath } = await store.save({

152 title: "Secret",

153 content: "# Secret\n\nsk-abc123def4567890123456.\ngithub_pat_11AAABBBCCCDDDEEEEFFFFGGGG\nAKIAIOSFODNN7EXAMPLE\n",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/draft-store.test.tsView on unpkg · L153

Critical

Secret Pattern

GitHub fine-grained PAT in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L153

154 sourceType: "user_source",

155 });

156 const saved = await store.get(basename(folderPath));

157 expect(saved!.content).not.toContain("sk-proj-abc123def456");

158 expect(saved!.content).not.toContain("github_pat_11AAABBBCCCDDD");

159 expect(saved!.content).not.toContain("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L159

160 expect(saved!.content).toContain("[REDACTED");

161 });

162

163 test("redacts private keys", async () => {

164 const { folderPath } = await store.save({

165 title: "Private Key",

166 content: "# Private Key\n\n-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----\n",

Critical

Secret Pattern

RSA private key in src/draft-store.test.ts

src/draft-store.test.tsView on unpkg · L166

167 sourceType: "user_source",

168 });

169 const saved = await store.get(basename(folderPath));

170 expect(saved!.content).not.toContain("RSA PRIVATE KEY");

171 });

172

173 test("regular text is not redacted", async () => {

174 const { folderPath } = await store.save({

175 title: "Clean",

176 content: "# Clean\n\nJust normal docs.",

177 sourceType: "user_source",

178 });

179 const saved = await store.get(basename(folderPath));

180 expect(saved!.content).toContain("normal docs");

181 });

182

183 test("empty title handled", async () => {

184 const { folderPath } = await store.save({

185 title: "",

186 content: "# \n\nContent without title.",