en","version":"1.0.1","category":"permissions_scope","severity":"info","filePath":"src/plugin/main.ts","lineNumber":64,"codeSnippet":"this.app.workspace.detachLeavesOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/lucasmelin/red-pen/blob/1.0.1/src/plugin/main.ts#L64"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"red-pen","fromVersion":"1.0.0","toVersion":"1.0.1","files":[{"path":"src/settings/settingsTab.ts","hunks":"@@ -13,7 +13,7 @@ export class RedPenSettingsTab extends PluginSettingTab {\n const { containerEl } = this;\n containerEl.empty();\n new Setting(containerEl)\n- .setName(\"Show proofreader highlights by Default\")\n+ .setName(\"Show proofreader highlights by default\")\n .setDesc(\n \"Show red pen proofreader highlights by default when Obsidian is loaded.\"\n )\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"Red Pen performs local proofreading analysis on text within the editor without accessing vault data or making network requests. The plugin operates entirely on content in memory and does not transmit writing samples, metadata, or other information outside the local system. With no detected network activity, obfuscation, or vault API usage, data processing appears confined to the user's device.","dependencyVulnerabilities":[{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"micromatch","packageVersion":"<4.0.8","severity":"moderate","title":"Regular Expression Denial of Service (ReDoS) in micromatch","advisoryUrl":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","ghsaId":"GHSA-952p-6rrq-rcjv","cveId":null,"vulnerableRange":"<4.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":18,"directDeps":10,"transitiveDeps":0}}]]}]