{"owner":"pcmarts","slug":"acl-recovery-tracker","channel":"pcmarts/acl-recovery-tracker","version":"1.0.3","artifact_sha256":"73afc3c52d0fae60616ca57755b823e2435ee9916155fff7bd357277f7de0700","published_at":"2026-09-01T19:34:02.533Z","price_micro":"1000000","update_price_micro":"200000","resource_endpoint":"https://x402git.com/api/r/pcmarts/acl-recovery-tracker","version_url":"https://x402git.com/api/v/pcmarts/acl-recovery-tracker","computed":{"artifact_class":"Pack","component_inventory":[{"kind":"hooks","count":3},{"kind":"source","count":29},{"kind":"docs","count":2},{"kind":"ci","count":2},{"kind":"config","count":5},{"kind":"assets","count":4},{"kind":"other","count":5}],"file_count":50,"dir_depth":2,"bytes_text":513288,"bytes_binary":48091,"languages":{"CSS":7885,"HTML":2941,"PLpgSQL":5083,"JavaScript":1587,"TypeScript":185632},"tree":[{"path":".env.example","size":621,"binary":true},{"path":".gitattributes","size":66,"binary":false},{"path":".github/workflows/audit.yml","size":805,"binary":false},{"path":".github/workflows/deploy.yml","size":1334,"binary":false},{"path":".gitignore","size":374,"binary":false},{"path":"LICENSE","size":1068,"binary":false},{"path":"README.md","size":6956,"binary":false},{"path":"eslint.config.js","size":1587,"binary":false},{"path":"index.html","size":1645,"binary":false},{"path":"package-lock.json","size":296016,"binary":false},{"path":"package.json","size":1132,"binary":false},{"path":"public/404.html","size":1296,"binary":false},{"path":"public/favicon.svg","size":588,"binary":false},{"path":"public/icons/icon-192x192.png","size":12198,"binary":true},{"path":"public/icons/icon-512x512.png","size":35272,"binary":true},{"path":"src/App.tsx","size":1324,"binary":false},{"path":"src/components/ExerciseCard.tsx","size":6925,"binary":false},{"path":"src/components/Layout.tsx","size":1628,"binary":false},{"path":"src/components/MilestoneTimeline.tsx","size":3985,"binary":false},{"path":"src/components/NavBar.tsx","size":2379,"binary":false},{"path":"src/components/PhaseIndicator.tsx","size":2520,"binary":false},{"path":"src/components/ProgressRing.tsx","size":2070,"binary":false},{"path":"src/components/Timer.tsx","size":4997,"binary":false},{"path":"src/config.ts","size":370,"binary":false},{"path":"src/context/SettingsProvider.tsx","size":3756,"binary":false},{"path":"src/context/settingsContext.ts","size":1286,"binary":false},{"path":"src/data/emsProtocol.ts","size":4077,"binary":false},{"path":"src/data/milestones.ts","size":1894,"binary":false},{"path":"src/data/recoveryPlan.ts","size":36153,"binary":false},{"path":"src/db/database.ts","size":9461,"binary":false},{"path":"src/hooks/useDailyExercises.ts","size":6519,"binary":false},{"path":"src/hooks/usePhase.ts","size":1608,"binary":false},{"path":"src/hooks/useTimer.ts","size":6544,"binary":false},{"path":"src/index.css","size":7885,"binary":false},{"path":"src/main.tsx","size":472,"binary":false},{"path":"src/pages/CheckIn.tsx","size":6314,"binary":false},{"path":"src/pages/CheckInHelpers.tsx","size":2178,"binary":false},{"path":"src/pages/Exercise.tsx","size":28111,"binary":false},{"path":"src/pages/Onboarding.tsx","size":6632,"binary":false},{"path":"src/pages/Progress.tsx","size":12629,"binary":false},{"path":"src/pages/Settings.tsx","size":9306,"binary":false},{"path":"src/pages/Timers.tsx","size":4788,"binary":false},{"path":"src/pages/Today.tsx","size":13822,"binary":false},{"path":"src/utils/date.ts","size":2178,"binary":false},{"path":"src/vite-env.d.ts","size":317,"binary":false},{"path":"supabase/schema.sql","size":5083,"binary":false},{"path":"tsconfig.app.json","size":732,"binary":false},{"path":"tsconfig.json","size":119,"binary":false},{"path":"tsconfig.node.json","size":653,"binary":false},{"path":"vite.config.ts","size":1706,"binary":false}],"readme_html":"<h2>ACL Recovery Tracker</h2>\n<p>A progressive web app for tracking recovery after ACL reconstruction. It turns a surgery date into a week-by-week rehabilitation plan: the right exercises for your current phase, timers for ice and EMS sessions, weekly pain and range-of-motion check-ins, and a milestone timeline showing how far you&#39;ve come.</p>\n<p>Installs to the home screen on iOS and Android, works as a normal website everywhere else.</p>\n<p><strong>Version 1.0.3</strong> · React 19 · TypeScript · Vite · Tailwind CSS 4 · Supabase</p>\n<blockquote><p><strong>Not medical advice.</strong> This app follows a general ACL rehabilitation template. Recovery timelines vary by graft type, meniscus involvement and surgeon preference. Always follow the plan your surgeon and physiotherapist give you.</p></blockquote>\n<hr />\n<h3>Features</h3>\n<table><thead><tr><th scope=\"col\"></th><th scope=\"col\"></th></tr></thead><tbody><tr><td><strong>Phased plan</strong></td><td>Five phases from <em>Protection &amp; Early Healing</em> through <em>Return to Activity</em>, advancing automatically from your surgery date</td></tr><tr><td><strong>Daily exercises</strong></td><td>Grouped by strength, mobility, cardio, balance and recovery, with per-session tracking and a long-press shortcut to complete</td></tr><tr><td><strong>Guided sessions</strong></td><td>Step-by-step exercise player with set/rep counters, rest timers and audio cues</td></tr><tr><td><strong>Timers</strong></td><td>Presets for ice, EMS and collagen loading, with a screen wake lock so the display stays on</td></tr><tr><td><strong>Weekly check-ins</strong></td><td>Pain, swelling, extension and flexion, kept as a full history</td></tr><tr><td><strong>Progress</strong></td><td>Streaks, range-of-motion trend, milestone timeline and a browsable overview of the whole plan</td></tr><tr><td><strong>EMS protocols</strong></td><td>Per-phase electrode placement and stimulator settings</td></tr><tr><td><strong>Offline-capable</strong></td><td>Installable PWA with an auto-updating service worker</td></tr></tbody></table>\n<hr />\n<h3>Quick start</h3>\n<p>You&#39;ll need <a href=\"https://nodejs.org/\" rel=\"nofollow noopener ugc\" target=\"<em>blank\">Node.js 20+</a> and a free <a href=\"https://supabase.com/\" rel=\"nofollow noopener ugc\" target=\"</em>blank\">Supabase</a> account.</p>\n<h4>1. Install</h4>\n<pre><code class=\"language-bash\">git clone &lt;your-repo-url&gt;\ncd acl-recovery-tracker\nnpm install\n</code></pre>\n<h4>2. Create the database</h4>\n<ol><li>Create a new project at <a href=\"https://supabase.com/dashboard\" rel=\"nofollow noopener ugc\" target=\"_blank\">supabase.com/dashboard</a>.</li><li>Open <strong>SQL Editor → New query</strong>.</li><li>Paste the contents of <code>supabase/schema.sql</code> and click <strong>Run</strong>.</li></ol>\n<p>This creates four tables — <code>exercise_logs</code>, <code>daily_logs</code>, <code>weekly_check_ins</code> and <code>user_settings</code> — and enables row level security on each.</p>\n<h4>3. Configure</h4>\n<pre><code class=\"language-bash\">cp .env.example .env\n</code></pre>\n<p>Fill in the two values from <strong>Project Settings → Data API</strong> in your Supabase dashboard:</p>\n<pre><code class=\"language-ini\">VITE_SUPABASE_URL=https://your-project-ref.supabase.co\nVITE_SUPABASE_ANON_KEY=your-anon-public-key\n</code></pre>\n<h4>4. Run</h4>\n<pre><code class=\"language-bash\">npm run dev\n</code></pre>\n<p>Open the URL it prints. On first launch you&#39;ll be asked for your name, surgery date and procedure — everything else is derived from those.</p>\n<hr />\n<h3>Deploying</h3>\n<p>The app is a static bundle, so any static host works. Set the two <code>VITE_*</code> environment variables in your host&#39;s dashboard before building.</p>\n<h4>GitHub Pages</h4>\n<p>A workflow is included at <code>.github/workflows/deploy.yml</code>.</p>\n<ol><li><strong>Settings → Pages → Source:</strong> GitHub Actions.</li><li><strong>Settings → Secrets and variables → Actions → Secrets:</strong> add <code>SUPABASE_URL</code> and <code>SUPABASE_ANON_KEY</code>.</li><li>If you&#39;re deploying to a project site (<code>https://&lt;user&gt;.github.io/&lt;repo&gt;/</code>), add a repository <strong>variable</strong> named <code>BASE_PATH</code> set to <code>/&lt;repo&gt;/</code>.</li></ol>\n<p>Push to <code>main</code> and the workflow does the rest.</p>\n<h4>Netlify / Vercel / Cloudflare Pages</h4>\n<ul><li>Build command: <code>npm run build</code></li><li>Output directory: <code>dist</code></li><li>Environment variables: <code>VITE_SUPABASE_URL</code>, <code>VITE_SUPABASE_ANON_KEY</code></li></ul>\n<p>No <code>BASE_PATH</code> is needed — these serve from the root.</p>\n<hr />\n<h3>Security</h3>\n<p><strong>Read this before sharing a deployment.</strong></p>\n<p>The app ships without authentication. It is built on the assumption that <strong>one deployment belongs to one person</strong>, which keeps setup to a single SQL paste and no login screen.</p>\n<p>The consequence: the row level security policies in <code>supabase/schema.sql</code> grant full access to the <code>anon</code> role, so anyone who obtains your project URL and anon key can read and write your recovery data. Both values are embedded in the JavaScript bundle and are therefore visible to anyone who loads the page. For a personal deployment at an unlisted URL that is usually a reasonable trade-off — but it is a trade-off, and it is the wrong one if you plan to publish the link.</p>\n<p>To make it genuinely multi-user:</p>\n<ol><li>Enable an auth provider in <strong>Supabase → Authentication</strong>.</li><li>Add <code>user_id uuid not null references auth.users default auth.uid()</code> to each of the four tables.</li><li>Replace <code>using (true)</code> in each policy with <code>using (auth.uid() = user_id)</code>.</li><li>Add a sign-in screen and gate the app on an active session.</li></ol>\n<hr />\n<h3>Customising</h3>\n<p>Everything clinical lives in three plain data files — no database migration or component changes are needed to adapt the plan.</p>\n<table><thead><tr><th scope=\"col\">File</th><th scope=\"col\">Contents</th></tr></thead><tbody><tr><td><code>src/data/recoveryPlan.ts</code></td><td>Phase definitions (goals, cautions, week ranges) and every exercise: sets, reps, holds, frequency, instructions, progression notes</td></tr><tr><td><code>src/data/milestones.ts</code></td><td>The milestone timeline and its target weeks</td></tr><tr><td><code>src/data/emsProtocol.ts</code></td><td>Per-phase EMS settings and electrode placement</td></tr></tbody></table>\n<p>Branding lives in <code>src/config.ts</code> (app name and tagline), <code>vite.config.ts</code> (PWA manifest) and <code>src/index.css</code> (the colour palette, defined as CSS custom properties on <code>:root</code>). Icons are in <code>public/icons/</code>.</p>\n<p>If you are redistributing this as your own product, update the copyright holder in <code>LICENSE</code> to your own name or company.</p>\n<hr />\n<h3>Project structure</h3>\n<pre><code>src/\n├── components/     Reusable UI — cards, nav, timers, progress ring\n├── config.ts       App name, tagline, version\n├── context/        Settings provider (profile + phase override)\n├── data/           The recovery plan, milestones and EMS protocols\n├── db/             Supabase client, types and queries\n├── hooks/          usePhase, useDailyExercises, useTimer, useNotifications\n├── pages/          Onboarding, Today, Exercise, Timers, Check-In, Progress, Settings\n└── utils/          Shared date helpers\n</code></pre>\n<h4>How the phase system works</h4>\n<p><code>usePhase()</code> reads the surgery date from the settings context, converts it to a day count and then a week number, and looks up the matching phase in <code>recoveryPlan.ts</code>. <code>useDailyExercises()</code> filters exercises to that phase and merges them with today&#39;s logs. A user can override the phase manually from the Settings page when their physiotherapist moves them on early or holds them back.</p>\n<hr />\n<h3>Scripts</h3>\n<table><thead><tr><th scope=\"col\">Command</th><th scope=\"col\">Description</th></tr></thead><tbody><tr><td><code>npm run dev</code></td><td>Start the dev server with hot reload</td></tr><tr><td><code>npm run build</code></td><td>Type-check and build to <code>dist/</code></td></tr><tr><td><code>npm run preview</code></td><td>Serve the production build locally</td></tr><tr><td><code>npm run lint</code></td><td>Run ESLint</td></tr><tr><td><code>npm run typecheck</code></td><td>Type-check without building</td></tr></tbody></table>\n<hr />\n<h3>Licence</h3>\n<p>MIT</p>","dependencies":[],"licence":{"spdx":"MIT","verdict":"pass"},"scan":{"verdict":"pass","scanner_version":"2026.08.1","at":"2026-09-01T19:34:06.827Z","checks":[{"id":"secrets","tool":"x402git/secrets","tool_version":"2026.08.1","status":"pass","at":"2026-09-01T19:34:06.827Z","findings":0},{"id":"limits","tool":"x402git/limits","tool_version":"2026.08.1","status":"pass","at":"2026-09-01T19:34:06.827Z","findings":0},{"id":"known_vulns","tool":"osv.dev","tool_version":"2026-09-16","status":"findings","at":"2026-09-16T04:01:10.361Z","findings":1,"packages":545},{"id":"known_malware","tool":"osv.dev/MAL","tool_version":"2026-09-16","status":"pass","at":"2026-09-16T04:01:10.361Z","findings":0,"packages":545},{"id":"dep_behaviour","tool":"socket.dev","tool_version":"2026-09-14","status":"findings","at":"2026-09-14T09:54:01.221Z","findings":1209,"packages":545},{"id":"capabilities","tool":"x402git/caps","tool_version":"2026.09.1","status":"findings","at":"2026-09-14T09:19:49.548Z","findings":17},{"id":"injection","tool":"x402git/inject","tool_version":"2026.09.1","status":"pass","at":"2026-09-14T09:19:49.548Z","findings":0}],"findings":[{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"workflow","severity":"MODERATE","description":"A GitHub Actions workflow runs on push, pull_request, schedule, workflow_dispatch","path":".github/workflows/audit.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"workflow","severity":"MODERATE","description":"A GitHub Actions workflow runs on push, workflow_dispatch","path":".github/workflows/deploy.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to eslint.org","path":"package-lock.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to fonts.googleapis.com","path":"index.html"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to fonts.gstatic.com","path":"index.html"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to github.com","path":"package-lock.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to opencollective.com","path":"package-lock.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to registry.npmjs.org","path":"package-lock.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to tidelift.com","path":"package-lock.json"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to user.github.io","path":"vite.config.ts"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to your-name.github.io","path":".env.example"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"host","severity":"LOW","description":"Talks to your-project-ref.supabase.co","path":".env.example"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable SUPABASE_ANON_KEY","path":".github/workflows/deploy.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable SUPABASE_URL","path":".github/workflows/deploy.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable VITE_BASE_PATH","path":".github/workflows/deploy.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable VITE_SUPABASE_ANON_KEY","path":".github/workflows/deploy.yml"},{"kind":"capability","check":"capabilities","tier":"disclosed","rule_id":"env","severity":"LOW","description":"Reads the environment variable VITE_SUPABASE_URL","path":".github/workflows/deploy.yml"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"@supabase/supabase-js 2.98.0 (direct) — makes network requests at runtime","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"@supabase/supabase-js 2.98.0 (direct) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"@supabase/supabase-js","version":"2.98.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"@types/node 24.11.0 (direct) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"@types/node","version":"24.11.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"@vitejs/plugin-react 5.1.4 (direct, dev only) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"@vitejs/plugin-react","version":"5.1.4","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"debugAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — can attach a debugger","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"debugAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — can attach a debugger","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"deprecated","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — deprecated by its author","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"dynamicRequire","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — loads modules by a computed name","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"dynamicRequire","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — loads modules by a computed name","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"dynamicRequire","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — loads modules by a computed name","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"eslint 9.39.3 (direct, dev only) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"eslint","version":"9.39.3","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"eslint-plugin-react-hooks 7.0.1 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"eslint-plugin-react-hooks","version":"7.0.1","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"lucide-react 0.575.0 (direct) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"lucide-react","version":"0.575.0","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"react 19.2.4 (direct) — reads environment variables","package":{"ecosystem":"npm","name":"react","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"react 19.2.4 (direct) — reads environment variables","package":{"ecosystem":"npm","name":"react","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"react 19.2.4 (direct) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"react","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"review","rule_id":"gptSecurity","severity":"MODERATE","description":"react-dom 19.2.4 (direct) — flagged for review by Socket's classifier as a security risk","package":{"ecosystem":"npm","name":"react-dom","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"react-dom 19.2.4 (direct) — reads environment variables","package":{"ecosystem":"npm","name":"react-dom","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"react-dom 19.2.4 (direct) — reads environment variables","package":{"ecosystem":"npm","name":"react-dom","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"react-dom 19.2.4 (direct) — reads environment variables","package":{"ecosystem":"npm","name":"react-dom","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"react-dom 19.2.4 (direct) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"react-dom","version":"19.2.4","direct":true,"dev":false},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"tailwindcss 4.2.1 (direct, dev only) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"tailwindcss","version":"4.2.1","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"review","rule_id":"gptAnomaly","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — flagged for review by Socket's classifier as anomalous","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"debugAccess","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — can attach a debugger","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"highEntropyStrings","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — contains high-entropy strings","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"vite 7.3.6 (direct, dev only) — makes network requests at runtime","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"vite 7.3.6 (direct, dev only) — makes network requests at runtime","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"vite 7.3.6 (direct, dev only) — makes network requests at runtime","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"vite 7.3.6 (direct, dev only) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"usesEval","severity":"MODERATE","description":"vite 7.3.6 (direct, dev only) — evaluates code at runtime","package":{"ecosystem":"npm","name":"vite","version":"7.3.6","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"debugAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — can attach a debugger","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads environment variables","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — reads or writes files","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"vite-plugin-pwa 1.2.0 (direct, dev only) — contains hard-coded URLs","package":{"ecosystem":"npm","name":"vite-plugin-pwa","version":"1.2.0","direct":true,"dev":true},"source":"socket.dev"},{"kind":"vulnerability","check":"known_vulns","tier":"disclosed","rule_id":"GHSA-p498-v437-472g","severity":"MODERATE","description":"@humanfs/node@0.16.7 (npm): humanfs: Recursive copy follows symlinked files and copies data from outside the source tree","package":{"ecosystem":"npm","name":"@humanfs/node","version":"0.16.7"},"advisory_ids":["GHSA-p498-v437-472g"],"source":"osv.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"review","rule_id":"gptSecurity","severity":"MODERATE","description":"@rollup/plugin-terser 1.0.0 (transitive, dev only) — flagged for review by Socket's classifier as a security risk","package":{"ecosystem":"npm","name":"@rollup/plugin-terser","version":"1.0.0","direct":false,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"installScripts","severity":"MODERATE","description":"esbuild 0.28.2 (transitive, dev only) — install scripts run when installed","package":{"ecosystem":"npm","name":"esbuild","version":"0.28.2","direct":false,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"highEntropyStrings","severity":"LOW","description":"jiti 2.6.1 (transitive, dev only) — contains high-entropy strings","package":{"ecosystem":"npm","name":"jiti","version":"2.6.1","direct":false,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"highEntropyStrings","severity":"LOW","description":"jiti 2.6.1 (transitive, dev only) — contains high-entropy strings","package":{"ecosystem":"npm","name":"jiti","version":"2.6.1","direct":false,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"obfuscatedFile","severity":"HIGH","description":"json-schema 0.4.0 (transitive, dev only) — contains an obfuscated file","package":{"ecosystem":"npm","name":"json-schema","version":"0.4.0","direct":false,"dev":true},"source":"socket.dev"},{"kind":"behaviour","check":"dep_behaviour","tier":"review","rule_id":"gptAnomaly","severity":"LOW","description":"flagged for review by Socket's classifier in 40 transitive packages","source":"socket.dev","aggregate":{"packages":40,"examples":["@babel/core@7.29.7","@babel/helper-module-imports@7.29.7","@babel/helper-module-transforms@7.29.7"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"usesEval","severity":"MODERATE","description":"usesEval in 23 transitive packages","source":"socket.dev","aggregate":{"packages":23,"examples":["@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5","@babel/plugin-transform-async-generator-functions@7.29.0","@babel/plugin-transform-async-to-generator@7.28.6"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"networkAccess","severity":"MODERATE","description":"networkAccess in 16 transitive packages","source":"socket.dev","aggregate":{"packages":16,"examples":["@supabase/auth-js@2.98.0","@supabase/functions-js@2.98.0","@supabase/postgrest-js@2.98.0"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"shellAccess","severity":"MODERATE","description":"shellAccess in 9 transitive packages","source":"socket.dev","aggregate":{"packages":9,"examples":["@tailwindcss/oxide@4.2.1","commander@2.20.3","cross-spawn@7.0.6"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"urlStrings","severity":"LOW","description":"urlStrings in 56 transitive packages","source":"socket.dev","aggregate":{"packages":56,"examples":["@babel/core@7.29.7","@babel/helper-create-class-features-plugin@7.28.6","@babel/helper-define-polyfill-provider@0.6.6"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"envVars","severity":"LOW","description":"envVars in 50 transitive packages","source":"socket.dev","aggregate":{"packages":50,"examples":["@babel/code-frame@7.29.7","@babel/core@7.29.7","@babel/helper-compilation-targets@7.29.7"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"filesystemAccess","severity":"LOW","description":"filesystemAccess in 40 transitive packages","source":"socket.dev","aggregate":{"packages":40,"examples":["@babel/core@7.29.7","@rollup/plugin-node-resolve@16.0.3","@tailwindcss/oxide@4.2.1"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"unmaintained","severity":"LOW","description":"unmaintained in 40 transitive packages","source":"socket.dev","aggregate":{"packages":40,"examples":["acorn-jsx@5.3.2","at-least-node@1.0.0","buffer-from@1.1.2"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"debugAccess","severity":"LOW","description":"debugAccess in 12 transitive packages","source":"socket.dev","aggregate":{"packages":12,"examples":["@babel/core@7.29.7","@babel/helper-define-polyfill-provider@0.6.6","@humanwhocodes/module-importer@1.0.1"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"dynamicRequire","severity":"LOW","description":"dynamicRequire in 10 transitive packages","source":"socket.dev","aggregate":{"packages":10,"examples":["@babel/helper-module-imports@7.29.7","@tailwindcss/oxide@4.2.1","browserslist@4.28.8"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"minifiedFile","severity":"LOW","description":"minifiedFile in 9 transitive packages","source":"socket.dev","aggregate":{"packages":9,"examples":["@isaacs/cliui@9.0.0","common-tags@1.8.2","esquery@1.7.0"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"newAuthor","severity":"LOW","description":"newAuthor in 4 transitive packages","source":"socket.dev","aggregate":{"packages":4,"examples":["async-function@1.0.0","convert-source-map@2.0.0","source-map@0.8.0-beta.0"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"trivialPackage","severity":"LOW","description":"trivialPackage in 4 transitive packages","source":"socket.dev","aggregate":{"packages":4,"examples":["at-least-node@1.0.0","is-obj@1.0.1","is-regexp@1.0.0"]}},{"kind":"behaviour","check":"dep_behaviour","tier":"disclosed","rule_id":"deprecated","severity":"LOW","description":"deprecated in 2 transitive packages","source":"socket.dev","aggregate":{"packages":2,"examples":["glob@11.1.0","source-map@0.8.0-beta.0"]}}],"capabilities":{"tools":[],"runs":[{"path":".github/workflows/audit.yml","kind":"workflow","detail":"push, pull_request, schedule, workflow_dispatch"},{"path":".github/workflows/deploy.yml","kind":"workflow","detail":"push, workflow_dispatch"}],"hosts":[{"host":"eslint.org","local":false,"from":"code","paths":["package-lock.json"]},{"host":"fonts.googleapis.com","local":false,"from":"code","paths":["index.html"]},{"host":"fonts.gstatic.com","local":false,"from":"code","paths":["index.html"]},{"host":"github.com","local":false,"from":"code","paths":["package-lock.json"]},{"host":"opencollective.com","local":false,"from":"code","paths":["package-lock.json"]},{"host":"registry.npmjs.org","local":false,"from":"code","paths":["package-lock.json"]},{"host":"tidelift.com","local":false,"from":"code","paths":["package-lock.json"]},{"host":"user.github.io","local":false,"from":"code","paths":["vite.config.ts"]},{"host":"your-name.github.io","local":false,"from":"code","paths":[".env.example"]},{"host":"your-project-ref.supabase.co","local":false,"from":"code","paths":[".env.example"]},{"host":"nodejs.org","local":false,"from":"docs","paths":["README.md"]},{"host":"supabase.com","local":false,"from":"docs","paths":["README.md"]},{"host":"your-project-ref.supabase.co","local":false,"from":"docs","paths":["README.md"]}],"env":[{"name":"SUPABASE_ANON_KEY","paths":[".github/workflows/deploy.yml"]},{"name":"SUPABASE_URL","paths":[".github/workflows/deploy.yml"]},{"name":"VITE_BASE_PATH","paths":[".github/workflows/deploy.yml","vite.config.ts"]},{"name":"VITE_SUPABASE_ANON_KEY","paths":[".github/workflows/deploy.yml"]},{"name":"VITE_SUPABASE_URL","paths":[".github/workflows/deploy.yml"]}],"install_runs":false,"summary":"runs 2 workflows · talks to 10 hosts · links to 3 hosts in its docs · reads 5 environment variables · nothing runs at install"},"counts":{"blocking":0,"disclosed":1175,"review":52},"advisories_refreshed_at":"2026-09-16T04:01:10.361Z"},"cadence_sentence":"Ships every day, hits that 67% of the time. Last release today.","originality":{"blob_overlap_ratio":0.02,"blobs_seen_elsewhere":1,"blobs_total":50,"nearest_listing":"examples/humanizer","derivative_of":null},"engineering":{"unique_5gram_ratio":0.404,"type_token_ratio":0.467,"effective_code_lines":2108,"effective_doc_words":962,"code_files":32,"test_files":0,"padding_suspected":true,"class_note":"Capped at Pack: unique 5-gram ratio 0.404 is below the 0.6 guard."},"cadence":{"releases":7,"median_days_between_releases":0,"on_time_fraction":0.67,"days_since_last":0,"score":67,"finished":false},"inventory_sentence":"3 hooks · 29 source files · 2 docs · 2 CI files","extensions":{"js":1,"md":1,"ts":12,"css":1,"png":2,"sql":1,"svg":1,"tsx":18,"yml":2,"html":2,"json":5,"(none)":3,"example":1},"lines_of_code":5224,"warnings":["sbom_unavailable"],"repo_meta":{"repo_id":1353550698,"name":"acl-recovery-tracker","full_name":"pcmarts/acl-recovery-tracker","description":"A progressive web app for tracking ACL reconstruction recovery — phased exercise plans, timers, check-ins and milestones.","homepage":null,"topics":[],"language":"TypeScript","default_branch":"main","size_kb":171,"created_at":"2026-09-01T12:32:31Z","pushed_at":"2026-09-01T19:34:00Z","licence_spdx":"MIT","open_issues":null,"stars":null,"forks":null,"watchers":null,"archived":false,"private":true,"html_url":null},"owner":{"login":"pcmarts","name":"Paul Martin","avatar_url":"https://avatars.githubusercontent.com/u/53514319?v=4","bio":"GTM, Marketing and Growth by day\r\nVibe Coding by night","blog":"https://paulmartin.link/","company":null,"location":null,"twitter_username":"pcmarts","followers":null,"public_repos":4,"created_at":"2019-07-31T09:12:36Z","html_url":"https://github.com/pcmarts"},"computed_at":"2026-09-01T19:34:07.048Z","analyzer_version":"0.1.0"},"self_reported":{"description":"tracks the recovery of your ACL when you've just had surgery","trigger_hint":"when a user wants an app to track their ACL recovery"}}