The Sealed Lighthouse Passed 52 Checks Without Proving Fun
A D-074 audit separates engine conformance from player claims: 52/52 core checks and a 4/4 extension passed, while player benefit remains unmeasured.
Fodev JEO
LATEST INVESTIGATIONS
Source audits & field notes
MEX on macOS Broke Before Project Memory Even Loaded
A Source Audit of a real mex command collision, the resolver that fixed it, and a stale graph coordinate that only a clean rebuild exposed.
open-code-review protects Octave only if you type a space
Alibaba’s open-code-review sniffs .m files to separate Objective-C from MATLAB. Five of its twelve signals begin with #, which Octave also treats as a comment character.
Orca's privacy page survives 82 of its 83 telemetry events
Source Audit of stablyai/orca at 0d23ea6: the telemetry page’s enum-only claim holds across every event schema except one free-form field that can carry home-directory paths.
Moli's efficiency map blends two runs its own bench keeps apart
Source Audit of lexmount/moli at d56bbd7: the README’s Lexbench figures describe Moli 0.1.1 in a 1.1.7 tree, and its efficiency map joins two runs the benchmark keeps apart.
CodeBurn's $15 hard cap denies tools when it could stop Claude
Source Audit of getagentseal/codeburn at 3684f1d: the README says the hard cap stops the session; Claude Code hooks offer continue:false for that, the guard sends a per-tool deny.
OpenOcta's LICENSE is GPL-3.0 again, its README says Apache-2.0
Source Audit of openocta/openocta at 0c7dac2: the LICENSE file went GPL-3.0, Apache-2.0, then GPL-3.0 again on 16 Sep 2026, while both READMEs still say Apache-2.0.
AIO Sandbox Asks Docker to Drop Seccomp Before It Sandboxes
Source Audit of agent-infra/sandbox: its quick starts and compose file drop Docker’s seccomp filter, shipped API contracts declare zero auth, and the runtime is a prebuilt image.
LLM Space guards plugin settings with 0600 but not its API keys
Source Audit of deer-flow/llm-space 4.19.0: the telemetry contract holds in code, but provider API keys land in a models.json written without the 0600 mode the plugin store uses.
OpenConnector Declares Its Own Defaults Out of Scope
Source Audit of oomol-lab/open-connector: the security policy’s do-not-report list names the defaults its quickstart ships, and anonymous proxy calls outrank scoped tokens.
인기 태그
Search article titles, categories, and tags. Full text is searched when needed.
Type to search articles.