CookThisApp

Kitchen Report

Home · Add an app

Scores

Score details and supporting evidence for each check.

100 / 100

All promised features found

Features found in source

App specification source review: 24 of 24 features (100%); partial features count half. Source review based on your App specification (24 features).

The AI read 136 of 298 source files.

Features found in the code

App specification source review: 24 of 24 features found in source (100%)

Show the 24 features

Static AI review of the source. Partial features count half. Actual run verification: Not tested; source presence and a responding demo do not prove the features work.

82 / 100

Good, small improvements suggested

Security screening

3 security issue(s) found; serious issues reduce this score most. No scan guarantees safety.

  • medium · Native helper transcribes any filesystem path supplied over stdin · native/local-transcription/Sources/ListenLocalTranscription/main.swift

    What to do: Validate the audioPath against the allowed data directory and reject paths outside it before calling transcribe; do not trust renderer-supplied paths.

  • medium · Sanitized rich text still permits arbitrary href schemes · src/renderer/richText.ts

    What to do: Restrict ALLOWED_ATTR to safe values and add a hook to force rel=noopener noreferrer and block javascript:/data: hrefs, or drop 'a' from allowed tags.

  • low · Report export path handling relies on documentation, not visible validation · docs/ARCHITECTURE.md

    What to do: Compare resolved real paths (fs.realpath) of the destination against the app data directory and refuse writes inside it, and validate the format against an allowlist before opening the dialog.

57 / 100

Some setup steps missing

Setup files

Present: known install command, run entry point, App specification or AGENTS. Missing: README, environment example. Static check in .; code was not executed. Checks README, environment example, install and run scripts, app specification or AGENTS, confirmed How to run it (confirmed) and run manifest (absent). The app was not executed.

  • ✕ README
  • ✕ Environment example
  • ✓ Install command
  • ✓ Run entry point
  • ✓ App specification or AGENTS — AGENTS.md, Saved App specification
  • ✓ Confirmed How to run it
  • ✕ Run manifest

73 / 100

Mostly up to date, some updates suggested

Dependency & license health

19 known issues, 19 have a fix (for example, npm audit fix); 2 production, 17 dev-only, 0 scope unknown. Licenses: 373 permissive, 15 copyleft, 10 unknown; 0 confirmed conflicts. Unknown licenses need review. Freshness and abandonment: not checked.

  • electron — 1 known issues (1 high) · dev-only
  • glob — 1 known issues (1 moderate) · dev-only
  • minimatch — 3 known issues (3 moderate) · scope unknown
  • undici — 8 known issues (4 high, 4 moderate) · dev-only
  • vite — 6 known issues (1 high, 4 moderate, 1 low) · dev-only
  • buffers — unknown licence
  • chainsaw — unknown licence (MIT/X11)
  • codec-parser — copyleft licence (LGPL-3.0-or-later)
  • dompurify — copyleft licence ((MPL-2.0 OR Apache-2.0))
  • glob — unknown licence (BlueOak-1.0.0)
  • jszip — copyleft licence ((MIT OR GPL-3.0-or-later))
  • lightningcss — copyleft licence (MPL-2.0)
  • lightningcss-android-arm64 — copyleft licence (MPL-2.0)
  • lightningcss-darwin-arm64 — copyleft licence (MPL-2.0)
  • lightningcss-darwin-x64 — copyleft licence (MPL-2.0)
  • lightningcss-freebsd-x64 — copyleft licence (MPL-2.0)
  • lightningcss-linux-arm-gnueabihf — copyleft licence (MPL-2.0)
  • lightningcss-linux-arm64-gnu — copyleft licence (MPL-2.0)
  • lightningcss-linux-arm64-musl — copyleft licence (MPL-2.0)
  • lightningcss-linux-x64-gnu — copyleft licence (MPL-2.0)
  • lightningcss-linux-x64-musl — copyleft licence (MPL-2.0)
  • lightningcss-win32-arm64-msvc — copyleft licence (MPL-2.0)
  • lightningcss-win32-x64-msvc — copyleft licence (MPL-2.0)
  • lru-cache — unknown licence (BlueOak-1.0.0)
  • minimatch — unknown licence (BlueOak-1.0.0)
  • minipass — unknown licence (BlueOak-1.0.0)
  • pako — unknown licence ((MIT AND Zlib))
  • path-scurry — unknown licence (BlueOak-1.0.0)
  • sax — unknown licence (BlueOak-1.0.0)
  • serdar-live-transcript — unknown licence

Source coverage: Sampled — some eligible source files were omitted

Dependency vulnerability check: Complete

Build not run by CookThisApp.

Suggestions (22)

Most serious first · Page 1

  • undici 7.30.0: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    High — could seriously affect users or their data; fix promptly.

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    Dependency warning — does not block publishing. Review before use. Scanner severity: high.

    Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

    Open

    GHSA-2m5v-pch6-74hx · package-lock.json

  • undici 7.30.0: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    High — could seriously affect users or their data; fix promptly.

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    Dependency warning — does not block publishing. Review before use. Scanner severity: high.

    Fix hint: Update undici from 7.30.0 to 7.30.1 or newer (check compatibility).

    Open

    GHSA-4w7w-5xrc-9h26 · package-lock.json

  • vite 8.3.2: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    High — could seriously affect users or their data; fix promptly.

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    Dependency warning — does not block publishing. Review before use. Scanner severity: high.

    Fix hint: Update vite from 8.3.2 to 8.3.3 or newer (check compatibility).

    Open

    GHSA-587h-7wmj-h5pm · package-lock.json

  • undici 7.30.0: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    High — could seriously affect users or their data; fix promptly.

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    Dependency warning — does not block publishing. Review before use. Scanner severity: high.

    Fix hint: Update undici from 7.30.0 to 6.29.1 or newer (check compatibility).

    Open

    GHSA-xjj6-f33q-929c · package-lock.json

  • electron 44.5.1: Electron: Mitigation for compromised eMudhra intermediate certificates

    High — could seriously affect users or their data; fix promptly.

    Electron: Mitigation for compromised eMudhra intermediate certificates

    Dependency warning — does not block publishing. Review before use. Scanner severity: high.

    Fix hint: Update electron from 44.5.1 to 45.0.0-beta.6 or newer (check compatibility).

    Open

    GHSA-jr5w-w6x2-84p9 · package-lock.json

Kitchen Report

Current run: generation 6

AI Meeting Assistant — Transcribe, Capture, Keep. · Version 01a18425-4157-7bef-96a5-814bfd181dfb

Report complete.

Live provider analysis

Ordinary dependency advisories are disclosed warnings and allow publication. Harmful source, malicious packages and unresolved rights or license blockers prevent publication.

Features found in source are not proof the app works. Actual run verification: Not tested. License and rights eligibility requires the seller’s declarations; dependency license compatibility: Not checked. Checks do not guarantee safety or production readiness.

Download reportView findings and fixes

Our estimate: $33–57 in AI usage, plus your own time.

How we estimate

We estimate AI usage for repeated edits and context reads, priced at Claude Sonnet 5.5 rates. Repeated reads use the provider's cached-input price.

The developer sets the price; this estimate is guidance only.

Formula v4 · AI usage estimate · 5 rework iterations · 16× context · claude-sonnet-5-5 · Price table 2

Source checks

Source check ✓ 28/10/2026

  1. 1. Unpacking · ✓ Done
  2. 2. Secret scan · ✓ Done
  3. 3. Safety scan (S1) · ✓ Done
  4. 4. Dependency scan (S2) · ✓ Done
For developers: code quality

Improvement hints only; these do not contribute to buyer headline scores.

Architecture / structure: 76 / 100 (AI structure review)

Code cleanliness: 78 / 100 (AI maintainability review)

Test presence: 80 test files found (presence signal only). Coverage: Not checked.

Source size: 40978 LOC (metric, not a scored check).

  • Swift helper emits JSON lines and maps failures to user-facing messages; good separation of protocol from logic. native/local-transcription/Sources/ListenLocalTranscription/main.swift
  • Shared esbuild options extracted so build and tests use one worker configuration; reduces drift. scripts/build-lib.mjs
  • Strict TypeScript with noUnusedLocals/Parameters is enabled, supporting the typing score. tsconfig.json

Help us improve CookThisApp

0/2000