"lineNumber":33,"codeSnippet":" 30 | async loadScratchpadContent(): Promise<{ text: string, canvas: string } | null> {\n 31 | const filePath = this.manifest.dir + \"/\" + SCRATCHPAD_FILE_NAME;\n 32 | if (await this.app.vault.adapter.exists(filePath)) {\n> 33 | const content = await this.app.vault.adapter.read(filePath);\n 34 | try {\n 35 | return JSON.parse(content);\n 36 | } catch (e) {","explanation":"Reads and parses a JSON file from the vault.","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/kvh03/obsidian-scratchpad/blob/0.2.2/src/main.ts#L33"},{"id":907011,"pluginId":"scratchpad","version":"0.2.2","category":"permissions_scope","severity":"info","filePath":"src/scratchpadview.ts","lineNumber":56,"codeSnippet":"this.app.scope","explanation":"Accesses Obsidian API: app.scope","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/kvh03/obsidian-scratchpad/blob/0.2.2/src/scratchpadview.ts#L56"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"scratchpad","fromVersion":"0.2.1","toVersion":"0.2.2","files":[{"path":"src/scratchpadview.ts","hunks":"$21","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":-15}},"initialDiffFrom":"0.2.1","initialDiffTo":"0.2.2","summary":"The scratchpad plugin reads and parses a JSON file stored in your vault for note and drawing data, operating entirely locally with no network connectivity. All data access is confined to the vault's JSON file, and there is no transmission of data outside the plugin or vault.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h3