,"privacyLevel":0,"analyzedAt":"2026-08-12T06:21:58.000Z","releaseDate":"2026-07-29T15:26:07.000Z","artifactStatus":"verified"}],"findings":[{"id":1061849,"pluginId":"calendar-ledger","version":"1.0.0","category":"vault_access","severity":"info","filePath":"src/calendar-writer.ts","lineNumber":64,"codeSnippet":" 61 | \t\treturn null;\n 62 | \t}\n 63 | \n> 64 | \tconst content = await vault.read(file);\n 65 | \tconst { dayBlockMap } = parseCalendar(content);\n 66 | \n 67 | \tconst block = dayBlockMap[dateStr];","explanation":"Reads a single vault file","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/millioncheung/obsidian-calendar-ledger/blob/refs/tags/1.0.0/src/calendar-writer.ts#L64"},{"id":1061850,"pluginId":"calendar-ledger","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":43,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/millioncheung/obsidian-calendar-ledger/blob/refs/tags/1.0.0/src/main.ts#L43"},{"id":1061851,"pluginId":"calendar-ledger","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":51,"codeSnippet":"this.app.workspace.getLeavesOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/millioncheung/obsidian-calendar-ledger/blob/refs/tags/1.0.0/src/main.ts#L51"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.0","summary":"Calendar Ledger reads a single Markdown file in your vault to work with dates, records, ranges, tags, and statistics, so its confirmed file access is limited to that one note. It does not make any network requests, and there is no obfuscation. If you use its features, it can organize and process the information in that file locally.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=5.0.0 <5.0.6","severity":"moderate","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","advisoryUrl":"https://github.com/advisories/GHSA-jxxr-4gwj-5jf2","ghsaId":"GHSA-jxxr-4gwj-5jf2","cveId":null,"vulnerableRange":">=5.0.0 <5.0.6","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.2","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=2.0.0 <2.1.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.16","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":"<1.1.16","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=3.0.0 <5.0.7","severity":"high","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","advisoryUrl":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","ghsaId":"GHSA-3jxr-9vmj-r5cp","cveId":null,"vulnerableRange":">=3.0.0 <5.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS