Sales collateral · Team tier
Security Verification Report
Targeted remediation verification and periodic re-review — not a full independent audit of all ~122K lines. Suitable for engineering leads evaluating Team governance and local-first deployment.
Pack battery (July 2026)
~262 suites / ~4,600 tests passing
MCP server npm audit
0 vulnerabilities
Verified baseline commit
75107b2b
Last refreshed
2026-07-30
Verified fixes (March 2026 remediation)
CRITICAL-1
Command injection (MCP test runner)
No shell: true on spawn; framework whitelist only (jest, vitest, mocha, pytest).
CRITICAL-2
Team license bypass
Team keys route through validateLicense() — server check, fail-closed when cache expired.
HIGH
Path traversal (code intelligence)
Workspace-root containment on all file reads via path.resolve + startsWith checks.
HIGH
Sensitive param redaction
content, answer, question, code, password, token, key, secret redacted before logging.
Scope & limits
- First-party remediation fixes + regression checks on re-review
- Transitive npm audit findings triaged individually (optional deps may remain open)
- Does not claim SOC 2 compliance — produces audit-ready artifacts only
- Team export redaction and journal compaction tracked separately in product backlog