LosaLosSantos/aurelio-finance

Review signals: 77 known vulnerability. 1 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 12 distinct locations. 77 findings.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The app opens on an invented household, kept in a file of its own.: Real input produced the expected result: Aurelio

  Source: The first start installs what it needs inside the folder and opens <http://localhost:8000> on an invented household, kept in a file of its own.

  Input: ./start.sh --demo --no-browser

  Expected: Aurelio frontend is served on localhost:8000

  Command: ./start.sh --demo --no-browser

  Observed: Aurelio</title> <script type="module" crossorigin src="/assets/index-mjT2pgcO.js"></script> <link rel="stylesheet" crossorigin href="/assets/index-BS7qV6sM.css"> </head> <body> <div id="root"></div> </body> </html>

Examples

• Run the documented demo startup command: The command ./start.sh --demo starts a foreground server and replay confirmed the app's root endpoint; no separate finite quickstart/example command is documented.

  Source: README.md, Try it on invented data

  Expected: documented command completes successfully

  Observed: The command ./start.sh --demo starts a foreground server and replay confirmed the app's root endpoint; no separate finite quickstart/example command is documented.

Local or hosted: local

Start the demo app with invented household data and request its root page

cd <guest-path> && (vault-search 'aurelio finance README run MCP operation' || true) && cat <host-path> 2>/dev/null; rg --files -g 'AGENTS.md' -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g 'requirements*.txt' -g 'uv.lock' -g 'p3-models.md' .
cd <guest-path> && pwd && ls -la && find .. -name AGENTS.md -o -name 'README*' -o -name pyproject.toml -o -name package.json -o -name Makefile -o -name 'requirements*.txt' | head -100 && python3 --version && id -u
cd <guest-path> && cat README.md && find . -name AGENTS.md -print && cat backend/pyproject.toml && cat frontend/package.json
cd <guest-path> && sed -n '1,240p' start.sh && find backend -maxdepth 3 -type f | sort | head -100 && find frontend -maxdepth 2 -type f | head -50 && node --version 2>&1; npm --version 2>&1; uv --version 2>&1; python3 --version; curl -sS -i "$CDP_URL/json/version" | head -25
sudo -n apt-get update && sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y curl ca-certificates
export NODE_USE_ENV_PROXY=1; curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -n -E bash - && sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y nodejs
curl -LsSf https://astral.sh/uv/install.sh | sh
cd <guest-path> && export PATH=<guest-path> NODE_USE_ENV_PROXY=1 && ./start.sh --demo --no-browser
cd <guest-path> && git status --short && ls frontend/node_modules >/dev/null 2>&1; echo modules:$?; ls backend/.venv/bin/uvicorn 2>/dev/null; ls backend/demo.db 2>/dev/null; ps aux | head
pwd
ls -la .coldpass; cat .coldpass/* 2>/dev/null | head -c 10000
ps -eo pid,comm,args | head -30; node --version; npm --version; <guest-path> --version
cd <guest-path> && find frontend -maxdepth 1 -type d -print && find backend -maxdepth 1 -type d -print && git status --short && mkdir -p .coldpass && find backend/app/routers -maxdepth 1 -type f | wc -l
cd <guest-path> && sed -n '1,220p' backend/app/demo.py && sed -n '1,180p' backend/app/main.py && find backend -maxdepth 1 -ls
cd <guest-path> && ls frontend/dist && find frontend/node_modules -maxdepth 1 -type d | wc -l && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["./start.sh","--demo","--no-browser"],"cwd":"<guest-path>","url":"http://127.0.0.1:8000/","env":{"PATH":"<guest-path>","NODE_USE_ENV_PROXY":"1","DATABASE_URL":"sqlite:///demo.db"},"expected_text":"Aurelio"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The app opens on an invented household, kept in a file of its own.","source":"The first start installs what it needs inside the folder and opens\n<http://localhost:8000> on an invented household, kept in a file of its own.","input":"./start.sh --demo --no-browser","expected":"Aurelio frontend is served on localhost:8000","probe_kind":"http","argv":["./start.sh","--demo","--no-browser"],"expected_text":"Aurelio","cwd":"<guest-path>","url":"http://127.0.0.1:8000/","env":{"PATH":"<guest-path>","NODE_USE_ENV_PROXY":"1","DATABASE_URL":"sqlite:///demo.db"}}]
EOF
cd <guest-path> && PATH=<guest-path> DATABASE_URL=sqlite:///demo.db uv run uvicorn app.main:app --port 8000 --no-access-log
cd <guest-path> && (curl -sS -i --max-time 3 http://127.0.0.1:8000/ | head -15; curl -sS -i --max-time 3 http://127.0.0.1:8000/api/health | head -15) && ps -eo pid,args | grep -E 'uvicorn|start.sh' | grep -v grep
true
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
{"detected":false,"reason":"README exposes a manually started web application; inspected start.sh and backend/app/main.py, which define no product scheduler, recurring loop, or webhook cycle.","checks":[]}
EOF
cat > <guest-path> <<'EOF'
[{"kind":"example","claim":"Start the invented demo household","source":"README.md, Try it on invented data","input":"./start.sh --demo --no-browser","expected":"app at http://localhost:8000","argv":["./start.sh","--demo","--no-browser"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>","NODE_USE_ENV_PROXY":"1"},"expected_text":"Starting Aurelio on http://localhost:8000"}]
EOF
cat > <guest-path> <<'EOF'
{"outcome":"blocked","fault_owner":"test","operation":"Start the demo app with invented household data","operation_scope":"README demo launcher; Node.js 22 and uv installed, frontend build and demo database created","steps":["Installed Node.js 22 and uv","Ran ./start.sh --demo --no-browser; frontend build and demo data completed"],"deviations":["The documented launcher exec call exceeded 600 seconds after build; server check exec calls then timed out similarly."],"stuck_step":"Verify app response over HTTP","main_blocker":"Coldpass exec guest timed out on follow-up requests after running the foreground server command.","plain_failure":"The demo database and frontend were built, but I could not observe the running app response because the exec guest stopped returning results in a timely way.","suggested_fix":"Retry the README demo launcher and request the root page once the exec environment is responsive."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Run the documented demo startup command","source":"README.md, Try it on invented data","reason":"The command ./start.sh --demo starts a foreground server and replay confirmed the app's root endpoint; no separate finite quickstart/example command is documented."}]
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Start the demo app with invented household data and request its root page","operation_scope":"README demo launcher; Node.js 22 and uv installed; app serves built frontend on localhost:8000","steps":["Installed Node.js 22 and uv","Ran ./start.sh --demo --no-browser, which built the frontend and backend/demo.db","Requested http://127.0.0.1:8000/; received HTTP 200 and Aurelio HTML"],"deviations":["Used --no-browser as documented by start.sh for the headless guest; browser endpoint recorded HTTP 200 from Chrome 155.","README startup is foreground and was replayed by the HTTP probe; no separate finite example command is documented."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay