nd.","endpointSource":"user-configured"},{"host":"","url":null,"filePath":"src/api.ts","lineNumber":138,"codeSnippet":" 135 | }\n 136 | \n 137 | async getBlob(url: string): Promise {\n> 138 | const res = await withTimeout(fetch(url), BLOB_TIMEOUT_MS, \"blob download\");\n 139 | if (!res.ok) throw new ApiError(res.status, \"blob_get_failed\", `Blob download failed: HTTP ${res.status}`);\n 140 | return res.arrayBuffer();\n 141 | }","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"},{"host":"","url":null,"filePath":"src/api.ts","lineNumber":145,"codeSnippet":" 142 | \n 143 | private async req(method: string, path: string, body?: unknown, auth = true): Promise {\n 144 | const res = await withTimeout(\n> 145 | requestUrl({\n 146 | url: this.baseUrl().replace(/\\/+$/, \"\") + path,\n 147 | method,\n 148 | contentType: body === undefined ? undefined : \"application/json\",","networkType":"active-outbound","sendsData":true,"dataDescription":"Sends data to a destination that could not be determined from the source code.","endpointSource":"unresolved"},{"host":"obsyncian.com","url":"https://obsyncian.com","filePath":"src/settings.ts","lineNumber":40,"codeSnippet":" 37 | }\n 38 | \n 39 | export const DEFAULT_SETTINGS: ObsyncSettings = {\n> 40 | serverUrl: \"https://obsyncian.com\",\n 41 | email: \"\",\n 42 | identity: \"\",\n 43 | apiToken: \"\",","networkType":"active-outbound","sendsData":true,"dataDescription":"URL property targets obsyncian.com (https://obsyncian.com)","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"1.0.14","initialDiffTo":"1.0.16","summary":"Syncian reads vault files by path in a loop, so it demonstrably accesses each file as part of its sync/backup process. It sends data to obsyncian.com, and it can also send data to, and retrieve data from, an endpoint you configure; the source code did not show any other hardcoded destination URLs. The plugin also decodes some base64-encoded strings at runtime, which is consistent with handling configuration or endpoint details dynamically.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.co