nordscope-fi/Discord-stoat-ferry

Review signals: 2 hardcoded secret, 72 known vulnerability. 10 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 2 findings.

OSV reports a known vulnerability in this dependency version. 11 distinct locations. 72 findings.

10 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Ferry validate reports export counts: Real input produced the expected result: Channels

  Source: `ferry validate`**, check an export before migrating: counts, warnings, and a time estimate. No network calls.

  Input: tests/fixtures

  Expected: reports channel counts for fixture exports

  Command: <guest-path> validate tests/fixtures

  Observed: Channels │ 7 │ │ Categories │ 3 │ │ Roles │ 3 │ │ Messages │ 30 │ │ Attachments │ 2 │ │ Custom Emoji │ 1 │ │ Threads/Forums │ 2 │ └────────────────┴───────┘ Warnings (3): - Channel 'edge-cases': attachment 'expired_file.png' has an HTTP URL — media was not downloaded locally - Channel 'rendered-markdown': 1 message(s) have mentions written as plain text instead of raw IDs, so they will arrive as text, with no link back to the user. - 1 attachment URL(s) have expired. Re-export with --media flag to download files locally. 30 m

Examples

• Validate a clean export folder and report counts: A clean standalone DCE export fixture is not available; tests/fixtures contains multiple samples and the documented mentions warning, so the exercised validation output is recorded in probe and claim.

  Source: docs/guides/cli-reference.md, ferry validate

  Expected: documented command completes successfully

  Observed: A clean standalone DCE export fixture is not available; tests/fixtures contains multiple samples and the documented mentions warning, so the exercised validation output is recorded in probe and claim.

Local or hosted: both

ferry validate tests/fixtures

pwd && id -u && python3 --version && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'AGENTS.md' -g '.github/**' | head -80
ls -la; find . -maxdepth 3 -type f | head -100
cat README.md
python3 -m pip --version && python3 -m pip install --user pipx
sudo -n apt-get -o DPkg::Lock::Timeout=300 update && sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y pipx python3-venv
sed -n '1,220p' docs/guides/cli-reference.md; cat pyproject.toml
pipx install .
find tests/fixtures -maxdepth 1 -type f -name '*.json' -printf '%f\n' | head -20; sed -n '1,120p' tests/fixtures/README.md 2>/dev/null; <guest-path> validate tests/fixtures
sed -n '1,160p' README.md | tail -35; cat tests/fixtures/simple_channel.json | head -c 800
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"cwd":"<guest-path>","expected_text":"Channels"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Validate an export before migrating: counts, warnings, and a time estimate.","source":"`ferry validate`, check an export before migrating: counts, warnings, and a time estimate. No network calls.","input":"tests/fixtures/simple_channel.json","expected":"channel counts and an estimated migration time","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"expected_text":"Channels","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Validate an export before migrating","source":"docs/guides/cli-reference.md, ferry validate","input":"tests/fixtures/simple_channel.json","expected":"report of export contents","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"cwd":"<guest-path>","expected_text":"Channels"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and CLI reference entry points; the documented product operations are invoked manually, with no product scheduler or cycle mechanism described.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"validate reports export counts","source":"Ferry validate`, check an export before migrating: counts, warnings, and a time estimate. No network calls.","input":"tests/fixtures/simple_channel.json","expected":"channel counts and an estimated migration time","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"expected_text":"Channels","cwd":"<guest-path>"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 -c 'import json; print(json.load(open(".coldpass/claims.json"))[0]["source"])'
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Validate an export before migrating: counts, warnings, and a time estimate.","source":"Ferry validate`, check an export before migrating: counts, warnings, and a time estimate. No network calls.","input":"tests/fixtures/simple_channel.json","expected":"channel counts and an estimated migration time","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"expected_text":"Channels","cwd":"<guest-path>"}]
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"No network calls.","source":"No network calls.","input":"tests/fixtures/simple_channel.json","expected":"export validation without network calls","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures/simple_channel.json"],"expected_text":"Channels","cwd":"<guest-path>"}]
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","validate","tests/fixtures"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"Channels"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Validation reports export counts","source":"Parse a DiscordChatExporter export and report what was found. Makes **zero network calls**, nothing is sent to your Stoat server.","input":"tests/fixtures","expected":"reports counts for a valid fixture export","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures"],"expected_returncode":1,"expected_text":"Channels","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Validate an export before migrating","source":"docs/guides/cli-reference.md, ferry validate","input":"tests/fixtures","expected":"report of export contents","argv":["<guest-path>","validate","tests/fixtures"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"Channels"}]
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Ferry validate reports export counts","source":"`ferry validate`**, check an export before migrating: counts, warnings, and a time estimate. No network calls.","input":"tests/fixtures","expected":"reports channel counts for fixture exports","probe_kind":"cli","argv":["<guest-path>","validate","tests/fixtures"],"expected_returncode":1,"expected_text":"Channels","cwd":"<guest-path>"}]
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"The documented fixture validation command reports counts and warnings, then exits 1 for plain text mentions","source":"docs/guides/cli-reference.md, Exit code","input":"tests/fixtures","expected":"counts and warning output; documented exit code 1","argv":["<guest-path>","validate","tests/fixtures"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"1 message(s) across 1 export file(s) have mentions written as plain text"}]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","validate","tests/fixtures"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"Channels"}
EOF

cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"ferry validate tests/fixtures","operation_scope":"Offline export validation with Python 3.12.3 and pipx-installed discord-ferry 3.1.6","steps":["Read README and CLI reference","Installed pipx and python3-venv with apt","Installed project using pipx install .","Ran ferry validate tests/fixtures; reported 7 channels, 3 categories, 3 roles, 30 messages, 2 attachments, 1 custom emoji, and 2 threads/forums"],"deviations":["The validation command returns 1 because the fixture includes a message whose mentions are plain text; the CLI reference documents this behavior."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
p='.coldpass/examples.json'; d=json.load(open(p)); d[0]['expected_text']='Channels'; d[0]['expected_returncode']=1; json.dump(d,open(p,'w'))
PY

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Validate a clean export folder and report counts","source":"docs/guides/cli-reference.md, ferry validate","reason":"A clean standalone DCE export fixture is not available; tests/fixtures contains multiple samples and the documented mentions warning, so the exercised validation output is recorded in probe and claim."}]
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay