{"uuid": "18f1bf1e-5997-4401-992e-fa28a693a12c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-p498-v437-472g", "type": "seen", "source": "https://gist.github.com/citadelculture/5ad0a838a902eb1cbf2ff2ff33472c61", "content": "# tasknode @ 40d2df7 \u2014 GREEN run (guard.patch applied)\nTue Sep  8 05:50:12 UTC 2026\nHEAD 40d2df72710a644f33a2b30831061e8265716db0\n$ /Library/Developer/CommandLineTools/usr/bin/git apply /Users/dom/pft-work/task_tn_default/guard.patch\nexit=0\n$ git status --short\n M server/repositories/identity-approvals.js\n?? node_modules\n?? scripts/network-badge-default-preserved-smoke.mjs\n\n$ npm run network-badge-approval-state-smoke\n\n> tasknode@0.1.0 network-badge-approval-state-smoke\n> node scripts/network-badge-approval-state-smoke.mjs\n\nnetwork badge approval state smoke ok\nexit=0\n\n$ npm run network-task-badge-gate-smoke\n\n> tasknode@0.1.0 network-task-badge-gate-smoke\n> node scripts/network-task-badge-gate-smoke.mjs\n\nnetwork task badge gate smoke ok\nexit=0\n\n$ env GUARD_APPLIED=1 node scripts/network-badge-default-preserved-smoke.mjs\nnetwork badge default preserved smoke ok\nexit=0\n\n$ npm run check:fast\n\n> tasknode@0.1.0 check:fast\n> npm run file-size-check && npm run format-check && npm run lint && npm run api-reference-check && npm run security\n\n\n> tasknode@0.1.0 file-size-check\n> node scripts/check-file-size.mjs\n\nfile size check ok: 0 active exceptions, no file over its configured limit\n\n> tasknode@0.1.0 format-check\n> node scripts/format-check.mjs\n\nformat check ok\n\n> tasknode@0.1.0 lint\n> eslint src server scripts shared\n\n\n> tasknode@0.1.0 api-reference-check\n> node scripts/generate-api-reference.mjs\n\nAPI reference ok: 174 policies match the generated inventory\n\n> tasknode@0.1.0 security\n> npm audit --audit-level=high && npm run public-help-check && npm run route-auth-policy-smoke && npm run trusted-proxy-rate-limit-smoke && npm run account-data-lifecycle-smoke && npm run data-retention-smoke && npm run data-recovery-safety-smoke && npm run asset-provenance-check && npm run dependency-license-check\n\n# npm audit report\n\n@humanfs/node  <0.16.8\nSeverity: moderate\nhumanfs: Recursive copy follows symlinked files and copies data from outside the source tree - https://github.com/advisories/GHSA-p498-v437-472g\nfix available via `npm audit fix`\nnode_modules/@humanfs/node\n\n1 moderate severity vulnerability\n\nTo address all issues, run:\n  npm audit fix\n\n> tasknode@0.1.0 public-help-check\n> node scripts/public-help-boundary.mjs\n\npublic Help boundary ok: 26 explicitly allowlisted Markdown sources\n\n> tasknode@0.1.0 route-auth-policy-smoke\n> node scripts/route-auth-policy-smoke.mjs\n\nroute auth policy smoke ok: 174 policies cover 151 registered literal paths and 8 modes\n\n> tasknode@0.1.0 trusted-proxy-rate-limit-smoke\n> node scripts/trusted-proxy-rate-limit-smoke.mjs\n\ntrusted proxy and shared rate-limit smoke ok\n\n> tasknode@0.1.0 account-data-lifecycle-smoke\n> node scripts/account-data-lifecycle-smoke.mjs\n\naccount data export and deletion lifecycle smoke ok\n\n> tasknode@0.1.0 data-retention-smoke\n> node scripts/data-retention-smoke.mjs\n\ndata retention smoke ok\n\n> tasknode@0.1.0 data-recovery-safety-smoke\n> node scripts/data-recovery-safety-smoke.mjs\n\ndata recovery safety smoke ok: remote, destructive-target, and malformed-store guards verified\n\n> tasknode@0.1.0 asset-provenance-check\n> node scripts/asset-provenance-check.mjs\n\nasset provenance check ok: 10 reviewed public assets\n\n> tasknode@0.1.0 dependency-license-check\n> node scripts/dependency-license-check.mjs\n\ndependency license check ok: 483 packages; reviewed reciprocal/content licenses: LGPL-3.0-or-later=10, Apache-2.0 AND LGPL-3.0-or-later AND MIT=1, Apache-2.0 AND LGPL-3.0-or-later=3, MPL-2.0=13, CC-BY-4.0=1\nexit=0\n", "creation_timestamp": "2026-09-08T06:19:13.809942Z"}