Kitchen Report

AI Meeting Assistant — Transcribe, Capture, Keep. · Version 01a18425-4157-7bef-96a5-814bfd181dfb

Checked: 2026-11-01T12:29:09.197Z · Report generation 6

Status: complete · Analysis: live

Kitchen Report · Stage 1 of 2: Source check

Source check ✓ 2026-10-28T20:15:38.107Z

Kitchen Report · Stage 2 of 2

Buyer headline scores

Features found in source

All promised features found 100 / 100

App specification source review: 24 of 24 features (100%); partial features count half. Source review based on your App specification (24 features).

Security screening

Good, small improvements suggested 82 / 100

3 security issue(s) found; serious issues reduce this score most. No scan guarantees safety.

Setup files

Some setup steps missing 57 / 100

Present: known install command, run entry point, App specification or AGENTS. Missing: README, environment example. Static check in .; code was not executed. Checks README, environment example, install and run scripts, app specification or AGENTS, confirmed How to run it (confirmed) and run manifest (absent). The app was not executed.

Dependency & license health

Mostly up to date, some updates suggested 73 / 100

19 known issues, 19 have a fix (for example, npm audit fix); 2 production, 17 dev-only, 0 scope unknown. Licenses: 373 permissive, 15 copyleft, 10 unknown; 0 confirmed conflicts. Unknown licenses need review. Freshness and abandonment: not checked.

The AI read 136 of 298 source files.

What you get

App specification source review: 24 of 24 features found in source (100%)

Actual run verification: Not tested. Source review does not prove the app works. Dependency warnings permit publishing; harmful content and unresolved rights or license blockers prevent it. Checks do not guarantee safety.

Findings

undici 7.30.0: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

High — could seriously affect users or their data; fix promptly.

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-2m5v-pch6-74hx · package-lock.json

undici 7.30.0: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

High — could seriously affect users or their data; fix promptly.

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Fix hint: Update undici from 7.30.0 to 7.30.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-4w7w-5xrc-9h26 · package-lock.json

vite 8.3.2: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

High — could seriously affect users or their data; fix promptly.

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-587h-7wmj-h5pm · package-lock.json

undici 7.30.0: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

High — could seriously affect users or their data; fix promptly.

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-xjj6-f33q-929c · package-lock.json

electron 44.5.1: Electron: Mitigation for compromised eMudhra intermediate certificates

High — could seriously affect users or their data; fix promptly.

Electron: Mitigation for compromised eMudhra intermediate certificates

Fix hint: Update electron from 44.5.1 to 45.0.0-beta.6 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-jr5w-w6x2-84p9 · package-lock.json

undici 7.30.0: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

High — could seriously affect users or their data; fix promptly.

undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: high

GHSA-qrxm-fqhp-jwvm · package-lock.json

undici 7.30.0: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Medium — could affect users in some situations; plan a fix.

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-4qv8-2p9j-2685 · package-lock.json

undici 7.30.0: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Medium — could affect users in some situations; plan a fix.

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-9fm3-97px-rjf6 · package-lock.json

undici 7.30.0: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

Medium — could affect users in some situations; plan a fix.

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

Fix hint: Update undici from 7.30.0 to 7.30.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-55wc-3pg8-jfw6 · package-lock.json

minimatch 5.1.9: minimatch has potential denial of service via globparts amplification

Medium — could affect users in some situations; plan a fix.

minimatch has potential denial of service via globparts amplification

Fix hint: Update minimatch from 5.1.9 to 11.0.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249 · package-lock.json

vite 8.3.2: launch-editor: escapeCmdArgs() omits % escaping on Windows

Medium — could affect users in some situations; plan a fix.

launch-editor: escapeCmdArgs() omits % escaping on Windows

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-698v-4r3x-3vcv · package-lock.json

glob 13.0.6: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Medium — could affect users in some situations; plan a fix.

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Fix hint: Update glob from 13.0.6 to 14.0.2 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-3g3m-2fjr-6pw4 · package-lock.json

undici 7.30.0: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Medium — could affect users in some situations; plan a fix.

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Fix hint: Update undici from 7.30.0 to 7.30.1 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-f72v-6w45-q472 · package-lock.json

vite 8.3.2: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Medium — could affect users in some situations; plan a fix.

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-vfpm-58rq-9qcg · package-lock.json

vite 8.3.2: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Medium — could affect users in some situations; plan a fix.

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-rq7h-c2jc-7f22 · package-lock.json

vite 8.3.2: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Medium — could affect users in some situations; plan a fix.

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: medium

GHSA-r825-w8mm-5pxw · package-lock.json

Native helper transcribes any filesystem path supplied over stdin

Medium — could affect users in some situations; plan a fix.

A crafted audioPath could make the helper read arbitrary files on disk and return their transcribed content to the caller.

Fix hint: Validate the audioPath against the allowed data directory and reject paths outside it before calling transcribe; do not trust renderer-supplied paths.

open · Review finding

ai-security · native/local-transcription/Sources/ListenLocalTranscription/main.swift

Sanitized rich text still permits arbitrary href schemes

Medium — could affect users in some situations; plan a fix.

Model-generated links could use javascript: or data: URLs; clicking them in the renderer may execute script in the app context.

Fix hint: Restrict ALLOWED_ATTR to safe values and add a hook to force rel=noopener noreferrer and block javascript:/data: hrefs, or drop 'a' from allowed tags.

open · Review finding

ai-security · src/renderer/richText.ts

vite 8.3.2: Vite: Cross origin script execution through Vite custom middleware

Low — limited impact; fix during routine maintenance.

Vite: Cross origin script execution through Vite custom middleware

Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

open · Dependency warning — does not block publishing · Scanner severity: low

GHSA-9jrq-w75r-8gcw · package-lock.json

Report export path handling relies on documentation, not visible validation

Low — limited impact; fix during routine maintenance.

A manipulated export destination could overwrite application data files or write outside the user's intended folder.

Fix hint: Compare resolved real paths (fs.realpath) of the destination against the app data directory and refuse writes inside it, and validate the format against an allowlist before opening the dialog.

open · Review finding

ai-security · docs/ARCHITECTURE.md

Platform check: Windows detected but not selected

Low — an improvement hint for the developer, with no confirmed user harm.

Fix hint: Review the platforms in your listing Basics. This information does not affect the score or publication.

open · Review finding

platform-check · package.json

Platform check: Linux detected but not selected

Low — an improvement hint for the developer, with no confirmed user harm.

Fix hint: Review the platforms in your listing Basics. This information does not affect the score or publication.

open · Review finding

platform-check · package.json

For developers: code quality

Improvement hints only; excluded from buyer headline scores.

Code cleanliness: 78 / 100 (AI maintainability review). Architecture: 76 / 100 (AI structure review). Test presence: 80 test files (presence signal only). Coverage: Not checked.

Swift helper emits JSON lines and maps failures to user-facing messages; good separation of protocol from logic.

native/local-transcription/Sources/ListenLocalTranscription/main.swift

Shared esbuild options extracted so build and tests use one worker configuration; reduces drift.

scripts/build-lib.mjs

Strict TypeScript with noUnusedLocals/Parameters is enabled, supporting the typing score.

tsconfig.json

Source coverage: Sampled. Build not run by CookThisApp.