registry / vibecarbon / 0.9.0

vibecarbon@0.9.0

Create and manage production-ready Vibecarbon applications

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 329 file(s), 2.47 MB of source, external domains: 1.1.1.1, aider.chat, analytics.yourdomain.com, antigravityai.org, api.cloudflare.com, api.github.com, api.hetzner.cloud, api.ipify.org, api.paddle.com, api.polar.sh, api.stripe.com, bolt.new, bun.sh, charts.hetzner.cloud, cli.github.com, cloudflareinsights.com, console.cloud.google.com, console.hetzner.cloud, cursor.com, dashboard.stripe.com, docs.anthropic.com, entra.microsoft.com, fsn1.your-objectstorage.com, ghcr.io, github.com, hel1.your-objectstorage.com, hono.dev, hyperformant.co, icanhazip.com, images.unsplash.com, index.docker.io, learn.microsoft.com, lovable.dev, nbg1.your-objectstorage.com, openai.com, plausible.io, polar.sh, portal.azure.com, raw.githubusercontent.com, resend.com, sandbox-api.paddle.com, spam.example, static.cloudflareinsights.com, studio.localhost, supabase-community.github.io, supabase.com, supabase.test, traefik.localhost, v0.dev, vendors.paddle.com

Source & flagged code

10 flagged

carbon/k8s/values/supabase.values.yamlView file

Lines 25-65yaml

25# supabase-jwt/supabase-dashboard secrets with random values (hit on

26# 2026-04-19 run #3 — Kong rejected our app's SERVICE_ROLE_KEY because

27# it was signed with our JWT_SECRET while the chart-generated

28# supabase-jwt.secret was a different string).

29secret:

30 jwt:

31 secretRef: vibecarbon-secrets

32 secretRefKey:

33 anonKey: ANON_KEY

34 serviceKey: SERVICE_ROLE_KEY

35 secret: JWT_SECRET

36 dashboard:

37 # Inline values — dashboard.openAiApiKey is chart-required and we don't

38 # ship one in vibecarbon-secrets. Using secretRef here would force the

39 # chart to read EVERY dashboard field from the secret (including

40 # openAiApiKey), and kubelet would fail the studio StatefulSet with

41 # "couldn't find key openAiApiKey in Secret vibecarbon/vibecarbon-secrets".

42 # Inline values are rendered into the chart's own supabase-dashboard

43 # secret at install time — still secure, just not deduped into ours.

44 username: "{{ADMIN_EMAIL}}"

45 password: "{{ADMIN_PASSWORD}}"

Medium

Secret Pattern

Package contains a possible secret pattern.

carbon/k8s/values/supabase.values.yamlView on unpkg · L45

46 openAiApiKey: ""

47 db:

48 secretRef: vibecarbon-secrets

49 # When secretRef is set, the chart uses secret keys for every db.* value

50 # (inline values are ignored). Maps the chart's lowercase field names to

51 # the uppercase keys vibecarbon-secrets ships (DB_NAME defaulted to

52 # "postgres" by applyVibecarbonSecrets).

53 secretRefKey:

54 password: DB_PASSWORD

55 database: DB_NAME

57# Override the db image with vibecarbon's wal-g-equipped build (carbon/db/

58# Dockerfile: FROM supabase/postgres + wal-g v3.0.5). The stock chart image

59# has no wal-g, which is why k8s historically had no WAL archiving / PITR.

60# Built + sideloaded to the supabase node by deployK3s (k3s-db-build /

61# k3s-db-sideload); IfNotPresent so the sideloaded image is used, not pulled.

62# {{DB_IMAGE}}/{{DB_IMAGE_TAG}} substituted at deploy time in installSupabase.

63image:

64 db:

65 repository: "{{DB_IMAGE}}"

carbon/scripts/k8s-delete.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * Delete Kubernetes manifests using Kustomize

4 *

5 * Usage:

6 * node scripts/k8s-delete.js # Delete local overlay

7 * node scripts/k8s-delete.js production-nbg1 # Delete specific overlay

8 * node scripts/k8s-delete.js --dry-run # Show what would be deleted

9 */

11import { execSync } from 'node:child_process';

carbon/src/server/routes/_internal/services-status.tsView file

Lines 1-28typescript

1import { exec } from 'node:child_process';

2import fs from 'node:fs';

3import https from 'node:https';

4import net from 'node:net';

5import { promisify } from 'node:util';

src/shell.jsView file

Lines 1-40javascript

1/**

2 * `vibecarbon shell [env]`

3 *

4 * Drops the operator into an interactive bash with KUBECONFIG,

5 * HCLOUD_TOKEN, and HCLOUD_NETWORK exported so kubectl + hcloud

6 * "just work" against the named environment. Use SSH directly for

7 * per-node debug (the master IP + ssh key path are in the welcome

8 * banner). Companion to `vibecarbon deploy` — once the cluster is up

9 * the operator can iterate against it interactively.

10 *

11 * Defaults: env = first non-flag arg, falling back to `prod`. The

src/status.jsView file

Lines 1-29javascript

1/**

2 * Vibecarbon Status Command

3 * Shows project and deployment status (read-only, non-interactive)

4 *

5 * Usage:

6 * vibecarbon status # Show all status info

7 * vibecarbon status -env prod # Show specific environment

8 * vibecarbon status -json # Machine-readable output

9 *

10 * Local-dev checks are context-sensitive: skipped when stdout is not a

11 * TTY OR when `-json` is set (CI / scripting paths don't want them),

High

carbon/scripts/dev.jsView file

Lines 133-173javascript

133 const deadline = Date.now() + 30_000; // print anyway after 30s, don't hang

134 while (Date.now() < deadline) {

135 if (shuttingDown) return;

136 const free = await

carbon/k8s/test-local.shView file

•path = carbon/k8s/test-local.sh kind = build_helper sizeBytes = 10906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

carbon/k8s/test-local.shView on unpkg

carbon/.claude/hooks/task-completed-gate.shView file

•path = carbon/.claude/hooks/task-completed-gate.sh kind = payload_in_excluded_dir sizeBytes = 414 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

carbon/.claude/hooks/task-completed-gate.shView on unpkg

carbon/.github/workflows/deploy.ymlView file

222patternName = generic_password severity = medium line = 222 matchedText = --from-l...N" \

Medium

Secret Pattern

Hardcoded password in carbon/.github/workflows/deploy.yml

carbon/.github/workflows/deploy.ymlView on unpkg · L222

carbon/volumes/n8n/scripts/setup.shView file

Lines 29-67shell

29log "Waiting for n8n user table..."

30for i in $(seq 1 60); do

31 if PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d

Source & flagged code

10 flagged · loading source

carbon/k8s/values/supabase.values.yamlView file

45patternName = generic_password severity = medium line = 45 matchedText = password...D}}"

Medium

Secret Pattern

Package contains a possible secret pattern.

carbon/k8s/values/supabase.values.yamlView on unpkg · L45

carbon/scripts/k8s-delete.jsView file

10L11: import { execSync } from 'node:child_process'; L12: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

carbon/scripts/k8s-delete.jsView on unpkg · L10

carbon/src/server/routes/_internal/services-status.tsView file

8L9: const execAsync = promisify(exec); L10:

High

Shell

Package source references shell execution.

carbon/src/server/routes/_internal/services-status.tsView on unpkg · L8

src/shell.jsView file

20L21: import { spawn } from 'node:child_process'; L22: import { existsSync, readFileSync } from 'node:fs'; ... L59: function loadCredentialsHcloudToken() { L60: const credPath = join(homedir(), '.vibecarbon', 'credentials.json'); L61: if (!existsSync(credPath)) return null; L62: try { L63: const data = JSON.parse(readFileSync(credPath, 'utf-8')); L64: return data?.hetzner?.apiToken ?? data?.hetznerApiToken ?? null; ... L85: for (const e of errors) { L86: process.stderr.write(`${c.error('✗')} ${e}\n`); L87: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/shell.jsView on unpkg · L20

src/status.jsView file

9* L10: * Local-dev checks are context-sensitive: skipped when stdout is not a L11: * TTY OR when `-json` is set (CI / scripting paths don't want them), ... L91: const timeoutId = setTimeout(() => controller.abort(), timeout); L92: const response = await fetch(url, { method: 'GET', signal: controller.signal }); L93: clearTimeout(timeoutId); ... L97: try { L98: data = await response.json(); L99: } catch { ... L307: return { L308: api: { running: api.ok, latencyMs: api.latencyMs, port: ports.api, data: api.data }, L309: vite: { running: vite.ok, port: ports.vite },

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

src/status.jsView on unpkg · L9

carbon/scripts/dev.jsView file

153// Spawn server process with its own process group for clean shutdown L154: const server = spawn('npx', ['tsx', 'watch', '--env-file=.env.local', 'src/server/index.ts'], { L155: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

carbon/scripts/dev.jsView on unpkg · L153

carbon/k8s/test-local.shView file

•path = carbon/k8s/test-local.sh kind = build_helper sizeBytes = 10906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

carbon/k8s/test-local.shView on unpkg

carbon/.claude/hooks/task-completed-gate.shView file

•path = carbon/.claude/hooks/task-completed-gate.sh kind = payload_in_excluded_dir sizeBytes = 414 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

carbon/.claude/hooks/task-completed-gate.shView on unpkg

carbon/.github/workflows/deploy.ymlView file

222patternName = generic_password severity = medium line = 222 matchedText = --from-l...N" \

Medium

Secret Pattern

Hardcoded password in carbon/.github/workflows/deploy.yml

carbon/.github/workflows/deploy.ymlView on unpkg · L222

carbon/volumes/n8n/scripts/setup.shView file

49patternName = generic_password severity = medium line = 49 matchedText = password...H}',

Medium

Secret Pattern

Hardcoded password in carbon/volumes/n8n/scripts/setup.sh

carbon/volumes/n8n/scripts/setup.shView on unpkg · L49

Findings

5 High8 Medium6 Low

HighChild Processcarbon/scripts/k8s-delete.js

HighShellcarbon/src/server/routes/_internal/services-status.ts

HighCredential Exfiltrationsrc/status.js

HighRuntime Package Installcarbon/scripts/dev.js

HighPayload In Excluded Dircarbon/.claude/hooks/task-completed-gate.sh

MediumSecret Patterncarbon/k8s/values/supabase.values.yaml

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/shell.js

MediumShips Build Helpercarbon/k8s/test-local.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterncarbon/.github/workflows/deploy.yml

MediumSecret Patterncarbon/volumes/n8n/scripts/setup.sh

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

10 flagged

carbon/k8s/values/supabase.values.yamlView file

Lines 25-65yaml

25# supabase-jwt/supabase-dashboard secrets with random values (hit on

26# 2026-04-19 run #3 — Kong rejected our app's SERVICE_ROLE_KEY because

27# it was signed with our JWT_SECRET while the chart-generated

28# supabase-jwt.secret was a different string).

29secret:

30 jwt:

31 secretRef: vibecarbon-secrets

32 secretRefKey:

33 anonKey: ANON_KEY

34 serviceKey: SERVICE_ROLE_KEY

35 secret: JWT_SECRET

36 dashboard:

37 # Inline values — dashboard.openAiApiKey is chart-required and we don't

38 # ship one in vibecarbon-secrets. Using secretRef here would force the

39 # chart to read EVERY dashboard field from the secret (including

40 # openAiApiKey), and kubelet would fail the studio StatefulSet with

41 # "couldn't find key openAiApiKey in Secret vibecarbon/vibecarbon-secrets".

42 # Inline values are rendered into the chart's own supabase-dashboard

43 # secret at install time — still secure, just not deduped into ours.

44 username: "{{ADMIN_EMAIL}}"

45 password: "{{ADMIN_PASSWORD}}"

Medium

Secret Pattern

Package contains a possible secret pattern.

carbon/k8s/values/supabase.values.yamlView on unpkg · L45

46 openAiApiKey: ""

47 db:

48 secretRef: vibecarbon-secrets

49 # When secretRef is set, the chart uses secret keys for every db.* value

50 # (inline values are ignored). Maps the chart's lowercase field names to

51 # the uppercase keys vibecarbon-secrets ships (DB_NAME defaulted to

52 # "postgres" by applyVibecarbonSecrets).

53 secretRefKey:

54 password: DB_PASSWORD

55 database: DB_NAME

57# Override the db image with vibecarbon's wal-g-equipped build (carbon/db/

58# Dockerfile: FROM supabase/postgres + wal-g v3.0.5). The stock chart image

59# has no wal-g, which is why k8s historically had no WAL archiving / PITR.

60# Built + sideloaded to the supabase node by deployK3s (k3s-db-build /

61# k3s-db-sideload); IfNotPresent so the sideloaded image is used, not pulled.

62# {{DB_IMAGE}}/{{DB_IMAGE_TAG}} substituted at deploy time in installSupabase.

63image:

64 db:

65 repository: "{{DB_IMAGE}}"

carbon/scripts/k8s-delete.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * Delete Kubernetes manifests using Kustomize

4 *

5 * Usage:

6 * node scripts/k8s-delete.js # Delete local overlay

7 * node scripts/k8s-delete.js production-nbg1 # Delete specific overlay

8 * node scripts/k8s-delete.js --dry-run # Show what would be deleted

9 */

11import { execSync } from 'node:child_process';

carbon/src/server/routes/_internal/services-status.tsView file

Lines 1-28typescript

1import { exec } from 'node:child_process';

2import fs from 'node:fs';

3import https from 'node:https';

4import net from 'node:net';

5import { promisify } from 'node:util';

src/shell.jsView file

Lines 1-40javascript

1/**

2 * `vibecarbon shell [env]`

3 *

4 * Drops the operator into an interactive bash with KUBECONFIG,

5 * HCLOUD_TOKEN, and HCLOUD_NETWORK exported so kubectl + hcloud

6 * "just work" against the named environment. Use SSH directly for

7 * per-node debug (the master IP + ssh key path are in the welcome

8 * banner). Companion to `vibecarbon deploy` — once the cluster is up

9 * the operator can iterate against it interactively.

10 *

11 * Defaults: env = first non-flag arg, falling back to `prod`. The

src/status.jsView file

Lines 1-29javascript

1/**

2 * Vibecarbon Status Command

3 * Shows project and deployment status (read-only, non-interactive)

4 *

5 * Usage:

6 * vibecarbon status # Show all status info

7 * vibecarbon status -env prod # Show specific environment

8 * vibecarbon status -json # Machine-readable output

9 *

10 * Local-dev checks are context-sensitive: skipped when stdout is not a

11 * TTY OR when `-json` is set (CI / scripting paths don't want them),

High

carbon/scripts/dev.jsView file

Lines 133-173javascript

133 const deadline = Date.now() + 30_000; // print anyway after 30s, don't hang

134 while (Date.now() < deadline) {

135 if (shuttingDown) return;

136 const free = await

carbon/k8s/test-local.shView file

•path = carbon/k8s/test-local.sh kind = build_helper sizeBytes = 10906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

carbon/k8s/test-local.shView on unpkg

carbon/.claude/hooks/task-completed-gate.shView file

•path = carbon/.claude/hooks/task-completed-gate.sh kind = payload_in_excluded_dir sizeBytes = 414 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

carbon/.claude/hooks/task-completed-gate.shView on unpkg

carbon/.github/workflows/deploy.ymlView file

222patternName = generic_password severity = medium line = 222 matchedText = --from-l...N" \

Medium

Secret Pattern

Hardcoded password in carbon/.github/workflows/deploy.yml

carbon/.github/workflows/deploy.ymlView on unpkg · L222

carbon/volumes/n8n/scripts/setup.shView file

Lines 29-67shell

29log "Waiting for n8n user table..."

30for i in $(seq 1 60); do

31 if PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d