[sh1pt-actions-fleet]

terms <domain|link> finds the terms, privacy policy and the policies they
pull in, reads them and prints the verdict, what you agree to, key terms,
where your data goes, red flags with the clause quoted and what to push back
on. Runs @profullstack/fineprint on the stored anthropic, openai or openrouter
key (openrouter + jina join the credential store); with none it asks
fineprint.agent. moshcode runs it for /terms.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Opened by riotcoder (threatcrush-nightly-report session) on 2026-10-28: this branch was pushed over SSH while the gh token was revoked during the dev2 incident, so no PR was opened at the time. Contents are unchanged from the original commit.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:151
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1062
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1800
HIGH	sh-remote-script-execution	root-ubuntu.sh:3262
HIGH	sh-remote-script-execution	root-ubuntu.sh:3263
HIGH	sh-remote-script-execution	root-ubuntu.sh:5168
HIGH	sh-remote-script-execution	root-ubuntu.sh:5172
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3639
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3640
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5569
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5579
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5586
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5602
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5607
HIGH	sh-plaintext-download	root-w3bs-os.sh:6289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1366
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5376
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1047
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:41
LOW	secret-generic-credential	src/credentials.ts:58
LOW	secret-generic-credential	src/credentials.ts:61
LOW	secret-generic-credential	src/credentials.ts:66
LOW	secret-generic-credential	src/user-export.ts:689
LOW	secret-generic-credential	src/user-export.ts:695
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:69
LOW	secret-generic-credential	test/proxy.test.ts:85
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​fineprint@​0.1.1

View full report