1.2/src/logger.ts#L352"},{"id":1171242,"pluginId":"seek","version":"1.1.2","category":"permissions_scope","severity":"info","filePath":"src/search-modal.ts","lineNumber":878,"codeSnippet":"this.app.metadataCache","explanation":"Accesses Obsidian API: app.metadataCache","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ryan-manor/Obsidian-Seek/blob/refs/tags/1.1.2/src/search-modal.ts#L878"},{"id":1171243,"pluginId":"seek","version":"1.1.2","category":"vault_access","severity":"medium","filePath":"src/search-modal.ts","lineNumber":1112,"codeSnippet":" 1109 | // Below MATCH_STRENGTH_MIN_NOTES notes the dense background is too sparse to\n 1110 | // calibrate (the settings toggle is disabled there too). strength == null\n 1111 | // means the corpus isn't calibrated yet → hide the line, no rank fallback.\n> 1112 | const scoresMeaningful = this.app.vault.getMarkdownFiles().length >= MATCH_STRENGTH_MIN_NOTES;\n 1113 | if (this.settings.showScores && scoresMeaningful && hasTextQuery && strength != null) {\n 1114 | // Title shown as a normalized [0,1] match strength (1 = full known-item\n 1115 | // title match), mirroring how recency renders its raw signal rather than","explanation":"Reads all markdown files in your vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/ryan-manor/Obsidian-Seek/blob/refs/tags/1.1.2/src/search-modal.ts#L1112"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"1.1.1","initialDiffTo":"1.1.2","summary":"The plugin reads your vault locally: it accesses all markdown files and can read a single vault file via the adapter to support its search features. No network activity is listed, so it does not send data to any external service in the documented behavior. Its documented capability is hybrid semantic and keyword search across vault content, including in over 52 languages.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","advisoryUrl":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","ghsaId":"GHSA-4w7w-66w2-5vf9","cveId":null,"vulnerableRange":"<=6.4.1","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageVersion":"<=6.4.2","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":"<=6.4.2","fixAvailable":"4.1.10","source":"npm-audit","isDirect":false,"path":"@vitest/mocker > vite, vite-node > vite, vitest > vite"},{"packageName":"vite","packageV