,"obfuscationMarkers":[]},"diffStats":{"totalLinesChanged":3484,"percentChanged":96.54}},"activityTier":"active"},"versions":[{"id":107247,"version":"1.0.0","score":75,"privacyLevel":0,"analyzedAt":"2026-08-14T08:32:03.000Z","releaseDate":"2026-07-28T11:32:28.000Z","artifactStatus":"divergent"}],"findings":[{"id":1093880,"pluginId":"finkey","version":"1.0.0","category":"permissions_scope","severity":"info","filePath":"src/SankeyProcessor.ts","lineNumber":30,"codeSnippet":"this.app.vault.getAbstractFileByPath","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/mrmupfel/FinKey/blob/refs/tags/1.0.0/src/SankeyProcessor.ts#L30"},{"id":1093881,"pluginId":"finkey","version":"1.0.0","category":"vault_access","severity":"info","filePath":"src/SankeyProcessor.ts","lineNumber":30,"codeSnippet":" 27 | const sectionInfo = this.ctx.getSectionInfo(this.containerEl);\n 28 | if (!sectionInfo) return;\n 29 | \n> 30 | const file = this.app.vault.getAbstractFileByPath(this.ctx.sourcePath);\n 31 | if (!(file instanceof TFile)) return;\n 32 | \n 33 | const warningString = `// --- hic sunt dracones --- positional logic generated by finkey --`;","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/mrmupfel/FinKey/blob/refs/tags/1.0.0/src/SankeyProcessor.ts#L30"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"1.0.0","summary":"Finkey reads a single file from your Obsidian vault by path and uses that content to generate interactive Sankey diagrams. Based on the available review, it does not have network activity, so it does not send data to any endpoints. There is no evidence here that it can transmit vault data unless its behavior changes in a future version.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS