surendrapandar/minilytics

Review signals: 1 connection review, 1 hardcoded secret, 14 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 10 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. scripts/smoke-hosted.mjs

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 14 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Seed 30 days of demo data: Real input produced the expected result: commands executed successfully

  Source: optional: 30 days of demo data

  Input: npm run seed

  Expected: demo data SQL is loaded into local D1 with success

  Command: npm run seed

  Observed: commands executed successfully. [ { "results": [], "success": true, "meta": { "duration": 197 } }, { "results": [], "success": true, "meta": { "duration": 284 } }, { "results": [], "success": true, "meta": { "duration": 94 } }, { "results": [], "success": true, "meta": { "duration": 2 } }, { "results": [], "success": true, "meta": { "duration": 1 } }, { "results": [], "success": true, "meta": { "duration": 2 } }, { "results": [],

Examples

• Unit tests from Contributing section: command completed successfully

  Source: README.md Contributing

  Input: npm test

  Expected: 23 tests pass

  Command: npm test

  Observed: > [email protected] test > vitest run RUN v3.2.7 <guest-path> ✓ test/core.test.ts (23 tests) 57ms Test Files 1 passed (1) Tests 23 passed (23) Start at 21:12:44 Duration 999ms (transform 223ms, setup 0ms, collect 332ms, tests 57ms, environment 0ms, prepare 215ms)

• Typecheck from Contributing section: command completed successfully

  Source: README.md Contributing

  Input: npm run typecheck

  Expected: typecheck exits 0

  Command: npm run typecheck

  Observed: > [email protected] typecheck > tsc --noEmit

Local or hosted: both

Run the Minilytics local dev stack (Cloudflare Worker API on localhost:8787) and read back a real API response; also run the documented demo seed and unit/typecheck commands

cd <guest-path> && git status 2>&1 | head -3; ls -la; cat README.md; id -u; python3 --version
cd <guest-path> && git init -q && git remote add origin https://github.com/surendrapandar/minilytics && git fetch -q --depth 1 origin 4058dc39e0d9aeaf26ed49c0eef07b559523398f && git reset -q --mixed FETCH_HEAD && git log --oneline -1; git status --short | head; cat .dev.vars.example; cat package.json | head -40; node -v; npm -v; echo "CDP=$CDP_URL $<env-var>"; cat /etc/os-release | head -2
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -5; cp .dev.vars.example .dev.vars && npm run db:migrate:local 2>&1 | tail -8; npm run build 2>&1 | tail -4
cd <guest-path> && npm test 2>&1 | tail -6; (nohup npm run dev:api > /tmp/devapi.log 2>&1 &); sleep 15; tail -5 /tmp/devapi.log; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8787/
cd <guest-path> && npm run smoke 2>&1 | tail -15; echo ---; sed -n 1,40p scripts/smoke.mjs; grep -rn "app\.\(get\|post\)(" src/worker | head -40
cd <guest-path> && pkill -f "wrangler dev" ; pkill -f workerd; sleep 3; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8787/ || true; (nohup npm run dev:api > /tmp/devapi2.log 2>&1 &); sleep 15; curl -s http://localhost:8787/api/public/plan; echo; curl -s -X POST http://localhost:8787/api/auth/login -H 'content-type: application/json' -d '{"password":"<secret>"}' -i | head -12
cd <guest-path> && ps aux | grep -E "wrangler|workerd|npm" | grep -v grep | head; curl -s -m 5 -o /dev/null -w "%{http_code}\n" http://localhost:8787/ ; echo rc=$?
cd <guest-path> && (nohup npm run dev:api > /tmp/devapi2.log 2>&1 &); sleep 15; tail -2 /tmp/devapi2.log; curl -s -m 10 http://localhost:8787/api/public/plan; echo; curl -s -m 10 -X POST http://localhost:8787/api/auth/login -H 'content-type: application/json' -d '{"password":"<secret>"}' -i | head -8
cd <guest-path> && pkill -f "wrangler dev"; sleep 3; curl -s -m 3 -o /dev/null -w "%{http_code}\n" http://localhost:8787/; grep -rn "scheduled\|crons\|triggers" src wrangler.jsonc scripts | head; grep -n "npm test\|typecheck" README.md; cat .github/workflows/* 2>/dev/null | head -30; npm run typecheck >/tmp/tc.log 2>&1; echo tc=$?
cd <guest-path> && pkill -f "[w]rangler dev"; pkill -f "[w]orkerd"; sleep 3; curl -s -m 3 -o /dev/null -w "%{http_code}\n" http://localhost:8787/; echo; grep -rn "scheduled\|crons\|triggers" src wrangler.jsonc scripts | head -5; grep -n "npm test\|typecheck" README.md; npm run typecheck >/tmp/tc.log 2>&1; echo tc=$?; ls .github
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["npm","run","dev:api"],"cwd":"<guest-path>","url":"http://localhost:8787/api/public/plan","expected_text":"\"hosted\":false"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Unit tests run via npm test before a PR","source":"Before opening a PR, run `npm run typecheck && npm test`.","input":"npm test","expected":"unit test suite passes","probe_kind":"cli","argv":["npm","test"],"cwd":"<guest-path>","expected_text":"23 passed"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Unit tests from Contributing section","source":"README.md Contributing","input":"npm test","expected":"23 tests pass","argv":["npm","test"],"cwd":"<guest-path>","env":{},"expected_text":"23 passed"},{"kind":"example","claim":"Typecheck from Contributing section","source":"README.md Contributing","input":"npm run typecheck","expected":"typecheck exits 0","argv":["npm","run","typecheck"],"cwd":"<guest-path>","env":{}}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected package.json scripts, wrangler.jsonc (no triggers/crons), src/worker/index.ts routes and scripts/. Minilytics is request-driven (Cloudflare Worker fetch handler); no scheduled/cron or --once loop exists in the product. Nothing triggered by hand.","checks":[]}
EOF
for f in .coldpass/*.json; do python3 -m json.tool $f >/dev/null && echo "ok $f"; done; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && npm run seed 2>&1 | tail -8; echo rc=$?; ls .wrangler | head
cd <guest-path> && npm run seed >/tmp/seed2.log 2>&1; echo rc=$?; grep -c success /tmp/seed2.log; grep -n "success" /tmp/seed2.log | head -3; grep -n "ShipKit" README.md | head -2
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Seed 30 days of demo data","source":"optional: 30 days of demo data","input":"npm run seed","expected":"demo data SQL is loaded into local D1 with success","probe_kind":"cli","argv":["npm","run","seed"],"cwd":"<guest-path>","env":{},"expected_text":"commands executed successfully"}]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; t=sys.stdin.read(); print(t[:3000])"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Minilytics local dev stack (Cloudflare Worker API on localhost:8787) and read back a real API response; also run the documented demo seed and unit/typecheck commands","operation_scope":"Local development path only (README 'Local development'). Requires Node 22 (README asks for 20+) and npm. Does not cover the Cloudflare hosted deploy (needs a Cloudflare account and wrangler login) or the browser-based dashboard.","steps":["git init; git remote add origin https://github.com/surendrapandar/minilytics; git fetch --depth 1 origin 4058dc39e0d9aeaf26ed49c0eef07b559523398f; git reset --mixed FETCH_HEAD","npm install","cp .dev.vars.example .dev.vars","npm run db:migrate:local","npm run build","npm test (23 passed)","npm run dev:api (http://localhost:8787)","npm run smoke (all checks passed, run against the running dev server)","npm run seed","npm run typecheck"],"deviations":["Skipped 'npx wrangler login' and 'npx wrangler d1 create' / 'npm run deploy' (Cloudflare hosted path needs an account and browser login); used the README's local development section instead.","Ran 'npm run smoke' manually against a dev server I started; it is not in examples.json because it needs a running server that the checker does not start for CLI examples.","First attempts to stop the dev server with pkill -f matched my own shell and returned 255; re-ran with a non-self-matching pattern. No product code was edited.","No browser was used; CDP endpoint was not needed."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo ok; ls .coldpass