forklaunch 1.33.0

Done dynamic on Linux job 262195 crates.io SBOM Findings (VEX)

high severity exfiltration_endpoint in library code: {"id": "cfg-1", "serviceName": "iam", "slackWebhookUrl": "https://hooks.slack.com/x"}

low

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	static:exfiltration_endpoint static · forklaunch	src/notifiers.rs:204	high severity exfiltration_endpoint in library code: {"id": "cfg-1", "serviceName": "iam", "slackWebhookUrl": "https://hooks.slack.com/x"}
2	static:obfuscated_data static · forklaunch	src/init/rust_project/auth_env.rs:433	medium severity obfuscated_data in library code (3 places): STRIPE_API_KEY=replace-with-stripe-api-key\u{a}PAYPAL_BASE_URL=https://api-m.sandbox.paypal.com\u{a}PAYPAL_CLIENT_SECRET=replace-with-paypal-client-secret\u{a}PAYPAL_WEBHOOK_ID=replace-with-paypal-web…
2	static:secret_environment_variable static · forklaunch	src/compliance/checks.rs:188	medium severity secret_environment_variable in library code (10 places): OPENAI_API_KEY
2	static:shell_command static · forklaunch	src/core/docker.rs:903	medium severity shell_command in library code (2 places): /bin/sh -c "mc alias set local http://minio:9000 minioadmin minioadmin && {}"
2	static:yara:persistence_locations static · forklaunch	scripts/install.js:97	medium severity yara:persistence_locations in library code: Paths and keys used to persist on a developer machine
1	static:build_script static · forklaunch	build.rs	low severity build_script in build_script code: build.rs

Behavior

New since the previous version

static:obfuscated_data

Profile

static:exfiltration_endpoint static:obfuscated_data static:secret_environment_variable static:shell_command static:yara:persistence_locations

Static findings

high exfiltration_endpoint library 1

{"id": "cfg-1", "serviceName": "iam", "slackWebhookUrl": "https://hooks.slack.com/x"} src/notifiers.rs:204

medium secret_environment_variable library 10

OPENAI_API_KEY src/compliance/checks.rs:188 src/compliance/checks.rs:2547
ANTHROPIC_API_KEY src/compliance/checks.rs:189 src/compliance/checks.rs:2522
AWS_ACCESS_KEY_ID src/compliance/checks.rs:844 src/infra/capabilities/sms/tests.rs:102 src/infra/capabilities/voice/tests.rs:87
AWS_SECRET_ACCESS_KEY src/compliance/checks.rs:844 src/compliance/checks.rs:2989
OPENAI_API_KEY, openai src/compliance/checks.rs:2591

medium obfuscated_data library 3

STRIPE_API_KEY=replace-with-stripe-api-key\u{a}PAYPAL_BASE_URL=https://api-m.sandbox.paypal.com\u{a}PAYPAL_CLIENT_SECRET=replace-with-paypal-client-secret\u{a}PAYPAL_WEBHOOK_ID=replace-with-paypal-web… src/init/rust_project/auth_env.rs:433
ACCOUNTS_DATABASE_URL=postgresql://accounts_app@postgresql:5432/kestrel_accounts\u{a}ACCOUNTS_STORAGE_ENCRYPTION_NAMESPACE=accounts-records\u{a}ACCOUNTSX_KEEP=1\u{a}IAM_NOTE=accounts\u{a}OTHER_URL=htt… src/init/rust_project/local_runtime.rs:1433
# Separate database per service. Runtime role must not bypass row-level security.\u{a}DATABASE_URL=postgresql://app@localhost:5432/service\u{a}MIGRATION_DATABASE_URL=postgresql://owner@localhost:5432/… src/init/rust_project/service_database.rs:64

medium shell_command library 2

/bin/sh -c "mc alias set local http://minio:9000 minioadmin minioadmin && {}" src/core/docker.rs:903
RUN arch=$(uname -m) && case "$arch" in {cases}*) echo "No pinned watchexec for $arch" >&2; exit 1 ;; esac \\u{a}&& name=watchexec-{WATCHEXEC_VERSION}-$arch-unknown-linux-musl \\u{a}&& curl -fsSL -o /… src/dev.rs:141

medium yara_match persistence_locations library 1

Paths and keys used to persist on a developer machine scripts/install.js:97

low network_access library 116

reqwest::blocking::Client::new src/app/create.rs:145 src/core/http_client.rs:56 src/core/http_client.rs:146 src/core/http_client.rs:201 src/core/token.rs:28 src/core/token.rs:110 src/core/validate.rs:66 src/integrate.rs:86 src/login.rs:204 src/release/s3_upload.rs:149 src/release/s3_upload.rs:256 src/whoami.rs:61
reqwest::Method::DELETE src/app/domain.rs:168 src/app/domain.rs:306 src/app/domain.rs:666 src/core/http_client.rs:132 src/environment/delete.rs:105 src/github/disconnect.rs:55 src/org/invitations.rs:126 src/org/members.rs:218
reqwest::StatusCode::NO_CONTENT src/app/domain.rs:545 src/managed/instance/email.rs:216
reqwest::StatusCode::NOT_FOUND src/app/domain.rs:545 src/app/domain.rs:669 src/managed/instance/email.rs:146 src/managed/instance/email.rs:216 src/managed/instance/email.rs:308
reqwest::Method::PUT src/app/readiness.rs:162 src/app/website.rs:75 src/core/http_client.rs:122 src/core/http_client.rs:258 src/org/domain.rs:123 src/org/members.rs:162 src/org/show.rs:41 src/release/set_current.rs:123
reqwest::blocking::Client::builder src/app/website.rs:60 src/compliance/deps.rs:814 src/core/version_check.rs:101 src/model.rs:118 src/model.rs:155 src/release/prebuilt.rs:12
reqwest::redirect::Policy::none src/app/website.rs:61 src/model.rs:119 src/model.rs:156 src/release/prebuilt.rs:14
reqwest::blocking::Response src/app/website.rs:122 src/core/http_client.rs:26 src/core/http_client.rs:45 src/core/http_client.rs:82 src/core/http_client.rs:111 src/core/http_client.rs:116 src/core/http_client.rs:121 src/core/http_client.rs:126 src/core/http_client.rs:131 src/core/http_client.rs:145 src/core/http_client.rs:178 src/core/http_client.rs:193 src/core/http_client.rs:216 src/core/http_client.rs:232 src/core/http_client.rs:246 src/core/http_client.rs:254 src/data/kafka.rs:94 src/data/redis.rs:82 src/managed/client.rs:145 src/managed/client.rs:145 src/managed/client.rs:226 src/org/shared.rs:29 src/org/shared.rs:36 src/org/shared.rs:36
reqwest::blocking::Client src/compliance/deps.rs:562
reqwest::StatusCode::OK src/config/pull.rs:103 src/config/push.rs:242 src/config/push.rs:285
reqwest::StatusCode src/core/email_sender.rs:39 src/org/pool/log_budget.rs:84
reqwest::StatusCode::FORBIDDEN src/core/email_sender.rs:494 src/org/pool/log_budget.rs:306
reqwest::StatusCode::BAD_REQUEST src/core/email_sender.rs:499
reqwest::StatusCode::CONFLICT src/core/email_sender.rs:506 src/integrate.rs:94
reqwest::StatusCode::SERVICE_UNAVAILABLE src/core/email_sender.rs:512
reqwest::StatusCode::INTERNAL_SERVER_ERROR src/core/email_sender.rs:514 src/org/pool/log_budget.rs:315
std::net::UdpSocket::bind src/core/host_ports.rs:182
std::net::TcpListener::bind src/core/host_ports.rs:184 src/core/host_ports.rs:275
reqwest::Method src/core/http_client.rs:23 src/core/http_client.rs:41 src/core/http_client.rs:79 src/core/http_client.rs:175 src/core/http_client.rs:189 src/org/shared.rs:25
reqwest::Method::GET src/core/http_client.rs:112 src/core/http_client.rs:249
reqwest::Method::POST src/core/http_client.rs:117 src/core/http_client.rs:220 src/core/http_client.rs:237 src/org/domain.rs:63 src/org/domain.rs:93 src/org/invitations.rs:99 src/org/members.rs:119
reqwest::Method::PATCH src/core/http_client.rs:127 src/environment/approval.rs:94 src/environment/branch.rs:97
reqwest::Url::parse src/model.rs:99
reqwest::header::CONTENT_TYPE src/release/s3_upload.rs:162 src/release/s3_upload.rs:264
reqwest::header::CONTENT_LENGTH src/release/s3_upload.rs:163 src/release/s3_upload.rs:265
tokio::net::TcpListener::bind src/templates/rust/billing/bootstrapper.rs:36 src/templates/rust/cac/bootstrapper.rs:28 src/templates/rust/ecommerce/bootstrapper.rs:52 src/templates/rust/iam/bootstrapper.rs:45 src/templates/rust/project/native-service/bootstrapper.rs:16
tokio::net::TcpListener src/templates/rust/project/module/server.rs:6 src/templates/rust/project/native-service/server.rs:8

low process_spawn library 61

low build_script build_script 1

build.rs build.rs

low network_access test 1

tokio::net::TcpListener::bind tests/fixtures/rust-notes-assembly/src/notes/application.rs:41

info url_literal library 341

redis://localhost:6379 src/change/service.rs:429 src/core/openapi_export.rs:100 src/infra/local.rs:309 src/release/create.rs:3389 src/release/create.rs:3397 src/release/create.rs:3414
http://localhost:9000 src/change/service.rs:511 src/core/env_defaults.rs:330 src/core/env_defaults.rs:887 src/infra/local.rs:303 src/infra/native_local.rs:248
redis://localhost:6379/{} src/change/worker.rs:220 src/change/worker.rs:349 src/core/env_defaults.rs:197
{\u{a} "account": {"id": "ca-1"},\u{a} "setupInstructions": {\u{a} "cloudFormationUrl": "https://...",\u{a} "terraformSnippet": "resource ...",\u{a}… src/cloud_account/create.rs:122
Paste into https://mermaid.live to render src/compliance/audit.rs:946
fetch(`https://graph.facebook.com/v20.0/${id}/messages`, { headers: { authorization: `Bearer ${process.env.WHATSAPP_TOKEN}` } }) src/compliance/checks.rs:3341
https://api.osv.dev/v1 src/compliance/deps.rs:30
registry+https://github.com/rust-lang/crates.io-index src/compliance/deps.rs:937 src/compliance/deps.rs:957 src/compliance/deps.rs:1040 src/compliance/deps/cargo.rs:53
git+https://secret@example.com/repo#abc src/compliance/deps.rs:973
registry+https://secret@example.com/index src/compliance/deps.rs:974
[[package]]\u{a}name = "myapp"\u{a}version = "0.1.0"\u{a}source = { editable = "." }\u{a}\u{a}[[package]]\u{a}name = "urllib3"\u{a}version = "1.26.0"\u{a}source = { registry = "https://pypi.org/simple… src/compliance/deps.rs:1154
Compliance management and audit reporting. More info: https://forklaunch.com/docs/compliance src/compliance/mod.rs:36
# application\u{a}DB_HOST=db.example.com\u{a}DB_PORT=5432\u{a}GOOGLE_CLOUD_LOCATION=us-central1\u{a}GOOGLE_CLOUD_API_KEY=abc123\u{a}REDIS_URL=redis://localhost:6379\u{a} src/config/push.rs:368
# application\u{a}DB_HOST=db.example.com\u{a}DB_PORT=5432\u{a}REDIS_URL=redis://localhost:6379\u{a} src/config/push.rs:386
# application\u{a}APP_NAME=myapp\u{a}# my-service (svc-123)\u{a}DB_HOST=db.example.com\u{a}# video-processor-worker (wkr-456)\u{a}QUEUE_URL=sqs://queue\u{a} src/config/push.rs:414
QUEUE_URL=sqs://queue\u{a} src/config/push.rs:433
http://localhost:8004 src/constants.rs:10
http://localhost:8007 src/constants.rs:11
http://localhost:8001 src/constants.rs:12 src/init/agent.rs:605
http://localhost:8000 src/constants.rs:13 src/core/env_defaults.rs:256 src/core/env_defaults.rs:703 src/init/rust_project/worker.rs:871
http://localhost:5173 src/constants.rs:14
http://localhost:8008 src/constants.rs:15
http://localhost:8005 src/constants.rs:16
http://localhost:8006 src/constants.rs:17
https://platform-management.forklaunch.com src/constants.rs:19
https://observability-api.forklaunch.com src/constants.rs:20
https://iam.forklaunch.com src/constants.rs:21
https://billing.forklaunch.com src/constants.rs:22
https://forklaunch.com src/constants.rs:23
https://studio-orchestrator.forklaunch.com src/constants.rs:24 src/model.rs:200
https://resource-management.forklaunch.com src/constants.rs:25
https://developer-tools.forklaunch-production-us-west-2-0aef7f56.app.forklaunch.com src/constants.rs:36
The '{linter}' linter cannot lint TypeScript 7 applications: typescript-eslint does not support TypeScript 7 yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940). Use --linter oxl… src/constants.rs:761
\u{a} const registrations = configInjector({\u{a} workerService: {\u{a} lifetime: Lifetime.Scoped,\u{a} factory: (options) => {\u{a} … src/core/ast/deletions/delete_from_registrations_ts.rs:312
\u{a} const environmentConfig = configInjector.chain({\u{a} OTEL_LEVEL: {\u{a} lifetime: Lifetime.Singleton,\u{a} type: optional(string),\u{a} value: g… src/core/ast/infrastructure/env.rs:750
const harness = new BlueprintTestHarness({\u{a} customEnvVars: {\u{a} REDIS_URL: process.env.REDIS_URL || 'redis://localhost:6379'\u{a} }\u{a} }); src/core/ast/infrastructure/test_utils.rs:123
clientUrl: getEnvVar('DB_URL') || `mongodb://${validConfigInjector.resolve(\u{a} 'DB_USER'\u{a} )}:${validConfigInjector.resol… src/core/ast/transformations/transform_mikroorm_config_ts.rs:328
clientUrl:\u{a} getEnvVar('DB_URL') ||\u{a} `mongodb:// src/core/ast/transformations/transform_mikroorm_config_ts.rs:592
import { forklaunchExpress, schemaValidator } from '@forklaunch/blueprint-core';\u{a}import { getEnvVar } from '@forklaunch/common';\u{a}import dotenv from 'dotenv';\u{a}import { organizationRouter } … src/core/ast/transformations/transform_server_ts.rs:108 src/core/ast/transformations/transform_server_ts.rs:263
/** \u{a} * Generated by ForkLaunch\u{a} * File: server.ts\u{a} * This is an auto-generated file. Modifications are encouraged but may inhibit automated upgrades.\u{a} */\u{a}\u{a}import { forklaunchE… src/core/ast/transformations/transform_server_ts.rs:151
/bin/sh -c "mc alias set local http://minio:9000 minioadmin minioadmin && {}" src/core/docker.rs:903
PLAINTEXT://0.0.0.0:29092,CONTROLLER://0.0.0.0:9093,PLAINTEXT_HOST://0.0.0.0:9092 src/core/docker.rs:986
PLAINTEXT://kafka:29092,PLAINTEXT_HOST://127.0.0.1:9092 src/core/docker.rs:991
-health.url=http://localhost:3200/ready src/core/docker.rs:1139
http://localhost:3000/api/health src/core/docker.rs:1273
redis://redis:6379/{} src/core/docker.rs:1363 src/core/env_defaults.rs:198 src/init/rust_project/local_runtime.rs:242
http://minio:9000 src/core/docker.rs:1423 src/core/env_defaults.rs:331 src/core/env_defaults.rs:900
http://otel-collector:4318 src/core/docker.rs:2079 src/core/env_defaults.rs:275
http://localhost:{}/health src/core/docker.rs:2186
http://iam:{}/api/auth/jwks src/core/docker.rs:2246
http://localhost:3001 src/core/docker.rs:2293 src/core/env_defaults.rs:291
{}://localhost:{} src/core/env_defaults.rs:217
{}://{}:{} src/core/env_defaults.rs:229 src/templates/rust/project/service/src/config/mod.rs:61 src/templates/rust/project/service/src/config/mod.rs:72
http://localhost:8000/api/auth/jwks src/core/env_defaults.rs:242 src/core/env_defaults.rs:951
http://iam:8000/api/auth/jwks src/core/env_defaults.rs:245 src/core/env_defaults.rs:964
http://iam:8000 src/core/env_defaults.rs:257 src/core/env_defaults.rs:716 src/init/rust_project/auth_env.rs:398
http://localhost:4318 src/core/env_defaults.rs:274 src/core/openapi_export.rs:112
redis://localhost:6379/0 src/core/env_defaults.rs:664 src/core/env_defaults.rs:1062
redis://localhost:6379/1 src/core/env_defaults.rs:676
redis://redis:6379/0 src/core/env_defaults.rs:689 src/infra/local.rs:818 src/init/rust_project/local_runtime.rs:1578
ws://localhost:11000 src/core/env_defaults.rs:728
redis://custom:6379/0 src/core/env_defaults.rs:1058
:// src/core/http_client.rs:159 src/core/static_analysis/workspace_diagnostics.rs:658 src/init/storefront.rs:103 src/release/create.rs:2312
https://api.example.com/releases src/core/http_client.rs:270
https://api.example.com:8080/releases/internal src/core/http_client.rs:278
https://api.example.com/deployments/123?status=true src/core/http_client.rs:286
https://api.example.com src/core/http_client.rs:293
https://api.example.com/ src/core/http_client.rs:298
postgresql://dummy:dummy@localhost:5432/dummy src/core/openapi_export.rs:98
http://localhost:{}/api/auth/jwks src/core/openapi_export.rs:125
http://localhost:3000 src/core/openapi_export.rs:130
services:\u{a} notes:\u{a} build:\u{a} context: .\u{a} dockerfile: Dockerfile.rust\u{a} command: 'custom arbitrary shell code'\u{a} remote:\u{a} build: https://example.test/repo.g… src/core/static_analysis/workspace_diagnostics.rs:967
Your free trial has expired{}. Please upgrade at https://forklaunch.com/checkout?plan=pro to continue using the CLI. src/core/validate.rs:85
https://github.com/forklaunch/forklaunch-js/releases/download/cli-v{}/{} src/core/version_check.rs:92
Checks that dependencies aligned across projects. More info: https://forklaunch.com/docs/depcheck src/depcheck.rs:32
{\u{a} "id": "d1",\u{a} "status": "completed",\u{a} "metadata": {\u{a} "outputs": {\u{a} "url_iam": "http://alb-1.us-east-1.elb.amazo… src/deploy/info.rs:596
http://alb-1.us-east-1.elb.amazonaws.com src/deploy/info.rs:616
https://{} src/deploy/target.rs:58 src/release/git.rs:148
ssh://git@ src/deploy/target.rs:60
https://{rest} src/deploy/target.rs:61 src/deploy/target.rs:64 src/deploy/target.rs:67
git:// src/deploy/target.rs:63
http:// src/deploy/target.rs:66 src/infra/capabilities/native.rs:46 src/init/agent.rs:80 src/init/storefront.rs:103 src/observe/logs.rs:367 src/release/git.rs:131
https://github.com/Main-Street-App/mainstreet-hq src/deploy/target.rs:286 src/deploy/target.rs:305
ssh://git@github.com/main-street-app/mainstreet-hq.git src/deploy/target.rs:289
https://github.com/Main-Street-App/mainstreet-hq.git/ src/deploy/target.rs:290
http://github.com/Main-Street-App/mainstreet-hq src/deploy/target.rs:291
https://github.com/o/r src/deploy/target.rs:331 src/deploy/target.rs:333 src/deploy/target.rs:337 src/deploy/target.rs:341 src/deploy/target.rs:351 src/deploy/target.rs:362 src/deploy/target.rs:371 src/deploy/target.rs:372
RUN arch=$(uname -m) && case "$arch" in {cases}*) echo "No pinned watchexec for $arch" >&2; exit 1 ;; esac \\u{a}&& name=watchexec-{WATCHEXEC_VERSION}-$arch-unknown-linux-musl \\u{a}&& curl -fsSL -o /… src/dev.rs:141
fetch("http://localhost:8000/health") src/dev/typescript.rs:472
Repository URL (e.g. https://github.com/org/repo) src/github/connect.rs:38
http://billing-server:8001 src/infra/capabilities/email/tests.rs:108
http://billing:8001 src/infra/capabilities/email/tests.rs:161 src/infra/capabilities/email/tests.rs:195 src/infra/capabilities/tests.rs:17 src/infra/capabilities/tests.rs:18 src/init/rust_project/auth_env.rs:399 src/init/rust_project/auth_env.rs:404
http://billing:8001,http://jobs-server:8002 src/infra/capabilities/email/tests.rs:178
http://localhost:{GATEWAY_MOCK_HOST_PORT} src/infra/capabilities/mod.rs:698
http://{service_key}:{port} src/infra/capabilities/mod.rs:792 src/infra/capabilities/mod.rs:865
http://{GATEWAY_MOCK_SERVICE}:8080 src/infra/capabilities/mod.rs:972
http://gateway-mock:8080 src/infra/capabilities/models/tests.rs:271 src/infra/capabilities/tests.rs:21 src/infra/local.rs:831
http://{service}:{port} src/infra/capabilities/native.rs:134 src/infra/capabilities/native.rs:230
{scheme}://{old} src/infra/capabilities/native.rs:173
{scheme}://{new}{suffix} src/infra/capabilities/native.rs:175
http://{receiver}:{port} src/infra/capabilities/native.rs:649
http://removed:8000 src/infra/capabilities/native/tests.rs:423
http://other:8123 src/infra/capabilities/native/tests.rs:424 src/infra/capabilities/native/tests.rs:445
image: node:22-alpine\u{a}environment:\u{a} MOCK_EVENTS_URL_EMAIL: http://old:8123\u{a} MOCK_EVENTS_URL_SMS: https://old:8443/base\u{a} MOCK_EVENTS_URL_VOICE: https://old.example:8443\u{a} OTHER_U… src/infra/capabilities/native/tests.rs:488
http://new:8123 src/infra/capabilities/native/tests.rs:491
https://new:8443/base src/infra/capabilities/native/tests.rs:492
https://old.example:8443 src/infra/capabilities/native/tests.rs:493
http://old:8123 src/infra/capabilities/native/tests.rs:494
redis://redis:6379/1 src/infra/local.rs:823 src/infra/native_local/tests.rs:28 src/init/rust_project/auth_env.rs:486 src/init/rust_project/local_runtime.rs:1551 src/init/rust_project/local_runtime.rs:1579 src/init/rust_project/local_runtime.rs:1580
http://jobs-server:3000 src/infra/local.rs:856 src/init/rust_project/worker.rs:905 src/init/rust_project/worker.rs:916 src/init/rust_project/worker.rs:954 src/init/rust_project/worker.rs:958 src/init/rust_project/worker.rs:969
REDIS_URL=redis://localhost:6379/{database} src/infra/local.rs:867
S3_URL=http://localhost:9000 src/infra/local.rs:869
PLATFORM_GATEWAY_URL=http://localhost:18088 src/infra/local.rs:870
redis://redis:6379/ src/infra/native_local.rs:107
redis://redis:6379 src/infra/native_local.rs:119 src/init/rust_project/local_runtime.rs:286
redis://localhost:6379/{redis_database} src/infra/native_local.rs:244
--mcp expects name=url, for example --mcp linear=https://mcp.linear.app/mcp src/init/agent.rs:63
https:// src/init/agent.rs:80 src/init/storefront.rs:103 src/managed/template/update.rs:270 src/observe/logs.rs:365 src/release/git.rs:130
http://{host}:{port} src/init/agent.rs:196
linear=https://mcp.linear.app/mcp src/init/agent.rs:555
https://mcp.linear.app/mcp src/init/agent.rs:558 src/init/agent.rs:577
my_linear=https://x src/init/agent.rs:561
_linear=https://x src/init/agent.rs:563
Linear=https://x src/init/agent.rs:564
linear=ftp://x src/init/agent.rs:565
linear=https://x y src/init/agent.rs:566
PORT=8003\u{a}RECORDS_URL=http://custom:1\u{a} src/init/agent.rs:603
PORT=8003\u{a}RECORDS_URL=http://custom:1\u{a}HMAC_SECRET_KEY=k\u{a} src/init/agent.rs:611
http://localhost:{port} src/init/rust_project.rs:2781 src/init/rust_project/worker.rs:717
http://localhost:{port}/health src/init/rust_project.rs:2810
PORT=9999\u{a}REDIS_URL=redis://localhost:6379 src/init/rust_project.rs:4464
PORT=9999\u{a}REDIS_URL=redis://localhost:6379\u{a}HOST=127.0.0.1\u{a}PROTOCOL=http\u{a}VERSION=v1\u{a}DOCS_PATH=/docs\u{a}RUST_LOG=info\u{a}MCP_ENABLED=true\u{a} src/init/rust_project.rs:4468
--mcp expects <name>=<url>, for example --mcp linear=https://mcp.linear.app/mcp src/init/rust_project/agent.rs:34
http://{name}:{port} src/init/rust_project/agent.rs:69 src/init/rust_project/auth_env.rs:93
http://localhost:{port}/api/auth/jwks src/init/rust_project/auth_env.rs:315
\u{a}services:\u{a} iam:\u{a} environment: { PORT: "8000", HMAC_SECRET_KEY: "${IAM_HMAC_SECRET_KEY:?x}", JWKS_PUBLIC_KEY_URL: "${IAM_JWKS_PUBLIC_KEY_URL:?x}" }\u{a} billing:\u{a} environment: … src/init/rust_project/auth_env.rs:378
http://custom:1 src/init/rust_project/auth_env.rs:403
STRIPE_API_KEY=replace-with-stripe-api-key\u{a}PAYPAL_BASE_URL=https://api-m.sandbox.paypal.com\u{a}PAYPAL_CLIENT_SECRET=replace-with-paypal-client-secret\u{a}PAYPAL_WEBHOOK_ID=replace-with-paypal-web… src/init/rust_project/auth_env.rs:433
\u{a}services:\u{a} iam:\u{a} environment: { PORT: "8001", HMAC_SECRET_KEY: shared, JWKS_PUBLIC_KEY_URL: "http://iam:8001/api/auth/jwks" }\u{a} billing:\u{a} environment: { PORT: "8002", HMAC_… src/init/rust_project/auth_env.rs:462
http://iam:8001 src/init/rust_project/auth_env.rs:481
http://billing:8002 src/init/rust_project/auth_env.rs:482
http://iam:8001/api/auth/jwks src/init/rust_project/auth_env.rs:484
https://api-m.sandbox.paypal.com src/init/rust_project/auth_env.rs:494
https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem src/init/rust_project/language_images.rs:7
postgresql://{}@postgresql:5432/{} src/init/rust_project/local_runtime.rs:223
http://iam:{port}/api/auth/jwks src/init/rust_project/local_runtime.rs:325
redis://redis:6379/{wanted} src/init/rust_project/local_runtime.rs:479
http://{hostname}:{port} src/init/rust_project/local_runtime.rs:741
://{old}: src/init/rust_project/local_runtime.rs:1043
://{new}: src/init/rust_project/local_runtime.rs:1043
://{old}-server: src/init/rust_project/local_runtime.rs:1043
://{new}-server: src/init/rust_project/local_runtime.rs:1043
services:\u{a} accounts:\u{a} hostname: accounts\u{a} container_name: kestrel-accounts-rust\u{a} environment:\u{a} PORT: '8000'\u{a} DATABASE_URL: ${ACCOUNTS_DATABASE_URL:?Configur… src/init/rust_project/local_runtime.rs:1407
ACCOUNTS_DATABASE_URL=postgresql://accounts_app@postgresql:5432/kestrel_accounts\u{a}ACCOUNTS_STORAGE_ENCRYPTION_NAMESPACE=accounts-records\u{a}ACCOUNTSX_KEEP=1\u{a}IAM_NOTE=accounts\u{a}OTHER_URL=htt… src/init/rust_project/local_runtime.rs:1433
DATABASE_URL=postgresql://accounts_app@127.0.0.1:5432/kestrel_accounts\u{a}PORT=8000\u{a} src/init/rust_project/local_runtime.rs:1434
http://ledgers:8000 src/init/rust_project/local_runtime.rs:1445
LEDGERS_DATABASE_URL=postgresql://ledgers_app@postgresql:5432/kestrel_ledgers\u{a}LEDGERS_STORAGE_ENCRYPTION_NAMESPACE=ledgers-records\u{a}ACCOUNTSX_KEEP=1\u{a}IAM_NOTE=accounts\u{a}OTHER_URL=http://l… src/init/rust_project/local_runtime.rs:1449
DATABASE_URL=postgresql://ledgers_app@127.0.0.1:5432/kestrel_ledgers\u{a}PORT=8000\u{a} src/init/rust_project/local_runtime.rs:1450
JOBS_DATABASE_URL=postgresql://jobs_app@postgresql:5432/kestrel_jobs\u{a}JOBS_REDIS_URL=redis://redis:6379/1\u{a}JOBS_TENANT_ID=t\u{a}OTHER_DATABASE_URL=x\u{a} src/init/rust_project/local_runtime.rs:1461
DATABASE_URL=postgresql://x\u{a}MIGRATION_DATABASE_URL=postgresql://y\u{a}SQLX_OFFLINE=true\u{a}REDIS_URL=redis://127.0.0.1:6379/1\u{a}MINE=1\u{a} src/init/rust_project/local_runtime.rs:1462
JOBS_REDIS_URL=redis://redis:6379/1\u{a}JOBS_TENANT_ID=t\u{a}OTHER_DATABASE_URL=x\u{a} src/init/rust_project/local_runtime.rs:1464
REDIS_URL=redis://127.0.0.1:6379/1\u{a}MINE=1\u{a} src/init/rust_project/local_runtime.rs:1465
QUEUE_NAME=zebra-jobs-dev\u{a}DATABASE_URL=postgresql://a@postgresql:5432/zebra_accounts\u{a}PATH_HINT=/srv/old-zebra-x\u{a}OTHER=zebras-keep\u{a} src/init/rust_project/local_runtime.rs:1490
QUEUE_NAME=kestrel-jobs-dev\u{a}DATABASE_URL=postgresql://a@postgresql:5432/kestrel_accounts\u{a}PATH_HINT=/srv/old-zebra-x\u{a}OTHER=zebras-keep\u{a} src/init/rust_project/local_runtime.rs:1493
postgresql://localhost/app src/init/rust_project/local_runtime.rs:1516
http://iam:8002/api/auth/jwks src/init/rust_project/local_runtime.rs:1523 src/init/rust_project/local_runtime.rs:1541
postgresql://notes_app@postgresql:5432/notes_app_notes src/init/rust_project/local_runtime.rs:1533
postgresql://notes_owner@postgresql:5432/notes_app_notes src/init/rust_project/local_runtime.rs:1537
redis://redis:6379/2 src/init/rust_project/local_runtime.rs:1552 src/init/rust_project/local_runtime.rs:1581 src/init/rust_project/local_runtime.rs:1582
services:\u{a} api:\u{a} environment: {REDIS_URL: 'redis://redis:6379/0'}\u{a} web-migrate:\u{a} environment: {REDIS_URL: 'redis://redis:6379/0'}\u{a} web:\u{a} environment: {REDIS_URL: 'r… src/init/rust_project/local_runtime.rs:1573
postgresql://a_app@postgresql:5432/db src/init/rust_project/local_runtime.rs:1593
postgresql://a_app@127.0.0.1:5432/db src/init/rust_project/local_runtime.rs:1593
http://iam:8004/api/auth/jwks src/init/rust_project/local_runtime.rs:1594
http://127.0.0.1:8004/api/auth/jwks src/init/rust_project/local_runtime.rs:1594
http://coding-server:3000 src/init/rust_project/local_runtime.rs:1595
http://127.0.0.1:8001 src/init/rust_project/local_runtime.rs:1595
PORT: '8000', DATABASE_URL: '${NOTES_DATABASE_URL:?x}', S3_URL: 'http://minio:9000', S3_BUCKET: demo-notes-dev src/init/rust_project/local_runtime.rs:1663
postgresql://notes_app@127.0.0.1:5432/demo_notes src/init/rust_project/local_runtime.rs:1689
postgresql://notes_owner@127.0.0.1:5432/demo_notes src/init/rust_project/local_runtime.rs:1690
http://localhost:9090/ready src/init/rust_project/modules.rs:541
println!("notes listening on http://{}", address);\u{a} src/init/rust_project/native_layout.rs:806
println!("records listening on http://{}", address);\u{a} src/init/rust_project/native_layout.rs:811
# Separate database per service. Runtime role must not bypass row-level security.\u{a}DATABASE_URL=postgresql://app@localhost:5432/service\u{a}MIGRATION_DATABASE_URL=postgresql://owner@localhost:5432/… src/init/rust_project/service_database.rs:64
http://localhost:{producer_port} src/init/rust_project/worker.rs:477
DATABASE_URL=postgres://worker:change-me@localhost:5432/worker?sslmode=require\u{a} src/init/rust_project/worker.rs:650
http://{name}-server:3000 src/init/rust_project/worker.rs:666
http://localhost:8137 src/init/rust_project/worker.rs:911 src/init/rust_project/worker.rs:925
https://jobs.example.test src/init/rust_project/worker.rs:931 src/init/rust_project/worker.rs:940
https://shop.example.com src/init/storefront.rs:471
http://shop.example.com src/init/storefront.rs:472
ftp://shop.example.com src/init/storefront.rs:473
s3://bucket/manifest.json src/init/storefront.rs:474
https://platform.example.com src/managed/client.rs:444
https://platform.example.com/managed-mode/templates src/managed/client.rs:449
https://platform.example.com/managed-mode/instances/abc/claim-link src/managed/client.rs:453
https://platform.example.com/managed-mode/instances/abc/claim src/managed/client.rs:460
https://platform.example.com/managed-mode/templates/clinic src/managed/client.rs:464
https://GitHub.com/Acme/clinic.git src/managed/detect.rs:109
https://github.com/acme/clinic src/managed/detect.rs:110 src/managed/detect.rs:114 src/managed/detect.rs:118 src/managed/detect.rs:125
https://github.com/acme/clinic/ src/managed/detect.rs:113
https://github.com/acme/clinic.git/ src/managed/detect.rs:117
https://github.com/acme/clinic-staging src/managed/detect.rs:126
https://forklaunch.com/claim/tok src/managed/instance/claim_next.rs:287
Show one managed instance with its lifecycle detail.\u{a}\u{a}This is the row a client polls to follow the state machine: every lifecycle\u{a}command (create, reset, update, apply-variables) answers 2… src/managed/instance/get.rs:29
Declare where a provider's callback is handed on each instance.\u{a}\u{a}A provider such as Epic lets you register ONE redirect URI per app, but a\u{a}product has many instances. So every instance sen… src/managed/template/relay/mod.rs:38
https URL of the repository versions are built from, e.g. https://github.com/org/repo src/managed/template/update.rs:217
--source-repo '{}' must be an https repository URL such as https://github.com/org/repo src/managed/template/update.rs:273
Each instance's UI is now https://<hostPrefix>.{} — point that wildcard at your frontend deployment (see the vercel-frontend skill). src/managed/template/update.rs:495
https://iam.forklaunch.com/api/auth/token src/model.rs:123
https://attacker.invalid src/model.rs:216
wss://{}/ws src/observe/logs.rs:366
ws://{}/ws src/observe/logs.rs:368 src/observe/logs.rs:370
http://iam:8002 src/release/create.rs:2691 src/release/create.rs:2691
http://localhost src/release/create.rs:3590
ssh:// src/release/git.rs:122
ssh://git@github.com/acme/app.git src/release/git.rs:159
https://github.com/acme/app.git src/release/git.rs:160
https://github.com/acme/app src/release/git.rs:161 src/release/git.rs:167
https://x-access-token:tok@github.com/acme/app.git src/release/git.rs:162
https://github.com/acme/app/ src/release/git.rs:163
https://github.com/acme src/release/git.rs:177
Application/Vnd.Example+JSON; profile="https://example.test/v1" src/sdk/media.rs:43
http://json-schema.org/draft-07/schema# src/sdk/schema.rs:160 src/sdk/schema.rs:965 src/sdk/schema_resources.rs:29 src/sdk/schema_resources.rs:561 src/sdk/schema_resources.rs:589 src/sdk/schema_resources.rs:665
https://json-schema.org/draft/2020-12/schema src/sdk/schema.rs:286 src/sdk/schema.rs:978 src/sdk/schema_resources.rs:566 src/sdk/schema_resources.rs:620
https://json-schema.org/draft/2019-09/schema src/sdk/schema.rs:974 src/sdk/schema_resources.rs:619 src/sdk/schema_resources.rs:666
https://example.invalid src/sdk/schema.rs:1099
https://forklaunch.invalid/__document__ src/sdk/schema_resources.rs:8
http://json-schema.org/draft-04/schema# src/sdk/schema_resources.rs:587
http://json-schema.org/draft-06/schema# src/sdk/schema_resources.rs:588
{} listening on http://{} src/templates/rust/billing/bootstrapper.rs:37 src/templates/rust/cac/bootstrapper.rs:29 src/templates/rust/ecommerce/bootstrapper.rs:53 src/templates/rust/iam/bootstrapper.rs:46
{{{name}}} listening on http://{} src/templates/rust/project/native-service/bootstrapper.rs:20
{protocol}://{host}:{port} src/templates/rust/project/service/src/config/mod.rs:32
{}://{}:0 src/templates/rust/project/service/src/config/mod.rs:68
http://127.0.0.1:8080 src/templates/rust/project/service/src/config/mod.rs:116

info unparsable_source library 29

expected `;` src/templates/rust/agent/__test__/agent.rs:17 src/templates/rust/kafka-worker/main.rs:7 src/templates/rust/leased-worker/smoke.rs:1 src/templates/rust/postgres-worker/main.rs:9 src/templates/rust/project/library/tests/smoke.rs:1 src/templates/rust/project/native-service/__test__/http.rs:18 src/templates/rust/project/postgres-service/persistence_test.rs:5 src/templates/rust/project/service/src/main.rs:3 src/templates/rust/project/service/tests/smoke.rs:1 src/templates/rust/project/worker/src/main.rs:3 src/templates/rust/project/worker/tests/smoke.rs:1 src/templates/rust/redis-worker/main.rs:9 src/templates/rust/router/router.rs:11
expected `,` src/templates/rust/agent/mod.rs:15
expected square brackets src/templates/rust/billing/api/contracts/registry.rs:19
expected one of: `fn`, `extern`, `use`, `static`, `const`, `unsafe`, `mod`, `type`, `struct`, `enum`, `union`, `trait`, `auto`, `impl`, `default`, `macro`, identifier, `self`, `super`, `crate`, `::` src/templates/rust/billing/api/controllers/mod.rs:8 src/templates/rust/billing/api/controllers/webhook.rs:1 src/templates/rust/billing/api/routes/mod.rs:12 src/templates/rust/billing/api/routes/webhook.rs:1 src/templates/rust/billing/domain/mod.rs:13 src/templates/rust/billing/registrations.rs:4 src/templates/rust/project/service/src/contracts/mod.rs:2 src/templates/rust/router/native_routes_mod.rs:1 src/templates/rust/router/routes_mod.rs:1 src/templates/sdk/rust/lib.rs:2
expected identifier src/templates/rust/billing/config.rs:20 src/templates/rust/router/contract.rs:5
expected `!` src/templates/rust/capabilities/mod.rs:5 src/templates/rust/capabilities/native_mod.rs:6

info unsafe_code library 2

2 unsafe blocks, functions or impls src/managed/client.rs:441 src/observe/issues.rs:614

Run: check

succeeded

Ended: agent reported the end
Guest: exit code 0
Run time: 669 ms
VM restore: 82 ms
Payload: 24699 files, 407.0 MiB
Files opened: 998

Processes 2

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 1 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	658 ms	0
└rustc /usr/local/bin/rustc	--crate-name crateward_probe --edition=2021 lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=d9152fcf76bf9b7f -C extra-filename=-8c7788aadf5d3a75 --out-dir /work/target/debug/deps -C incremental=/work/target/debug/incremental -L dependency=/work/target/debug/deps	439 ms	195 ms	0

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 21
Directories: 19
Size: 77.8 KiB
Compiled units: 1

Nothing outside the build areas.

Output

Standard error

warning: crateward-probe v0.0.0 (/cw/probe) ignoring invalid dependency `target` which is missing a lib target
    Checking crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.59s

Timeline

When	From	To	Event	Worker
2026-10-24 21:23 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-24 21:23 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-24 21:35 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-24 21:35 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-24 21:35 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-24 21:35 UTC	Scored	Done	finalized	analyzer-12816