Warden Scheduled Scan Results
Run: 2026-08-03T07:43:04.781Z
Commit: e6ef59b
Summary
| Severity |
Count |
| Medium |
4 |
| Low |
1 |
Findings
QUJ-57G cp -R Frameworks/ aborts when Frameworks directory is empty* (L185-L186) · medium
The glob pattern Frameworks/* does not expand when the directory is empty, causing cp to exit with an error. Because set -e is active, the script terminates instead of continuing cleanly.37D-47H Downloaded release artifacts lack integrity verification before extraction (L130) · medium
The script downloads a release archive with curl and immediately extracts it with tar without verifying a checksum, signature, or other integrity metadata.
RPD-FUQ handleRestart silently swallows all errors during daemon stop (L253-L255) · medium
The bare catch block in handleRestart discards every error from client.stop(), not just the expected 'not running' case, hiding real failures from the user and making the restart command silently unreliable.VFA-BHM handleLogs loads entire log file into memory with readFileSync (L267) · medium
The logs command reads the full log file synchronously before tailing, which can exhaust memory or block the event loop when the file is large.
U6X-2EC GitHub repository name regex truncates at dots and includes query strings (L15) · low
The regex ([^/.]+) on line 15 truncates repository names at the first dot and can include URL query parameters or fragments in the capture, producing incorrect metadata for valid GitHub URLs.
Generated by Warden
Warden Scheduled Scan Results
Run: 2026-08-03T07:43:04.781Z
Commit:
e6ef59bSummary
Findings
scripts/bundle-axe.shQUJ-57Gcp -R Frameworks/ aborts when Frameworks directory is empty* (L185-L186) · mediumThe glob pattern
Frameworks/*does not expand when the directory is empty, causingcpto exit with an error. Becauseset -eis active, the script terminates instead of continuing cleanly.37D-47HDownloaded release artifacts lack integrity verification before extraction (L130) · mediumThe script downloads a release archive with
curland immediately extracts it withtarwithout verifying a checksum, signature, or other integrity metadata.src/cli/commands/daemon.tsRPD-FUQhandleRestart silently swallows all errors during daemon stop (L253-L255) · mediumThe bare catch block in
handleRestartdiscards every error fromclient.stop(), not just the expected 'not running' case, hiding real failures from the user and making the restart command silently unreliable.VFA-BHMhandleLogs loads entire log file into memory with readFileSync (L267) · mediumThe logs command reads the full log file synchronously before tailing, which can exhaust memory or block the event loop when the file is large.
scripts/generate-version.tsU6X-2ECGitHub repository name regex truncates at dots and includes query strings (L15) · lowThe regex
([^/.]+)on line 15 truncates repository names at the first dot and can include URL query parameters or fragments in the capture, producing incorrect metadata for valid GitHub URLs.Generated by Warden