07-27T22:56:13.000Z","artifactStatus":"verified"}],"findings":[{"id":1173694,"pluginId":"siden","version":"0.1.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":107,"codeSnippet":"this.app.workspace.on","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/giuseqpe/siden/blob/refs/tags/0.1.0/src/main.ts#L107"},{"id":1173695,"pluginId":"siden","version":"0.1.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":130,"codeSnippet":"this.app.vault.on","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/giuseqpe/siden/blob/refs/tags/0.1.0/src/main.ts#L130"},{"id":1173696,"pluginId":"siden","version":"0.1.0","category":"vault_access","severity":"info","filePath":"src/main.ts","lineNumber":211,"codeSnippet":" 208 | await this.pdfAdapter.navigate(annotation);\n 209 | return;\n 210 | }\n> 211 | const file = this.app.vault.getAbstractFileByPath(annotation.sourcePath);\n 212 | if (!(file instanceof TFile)) {\n 213 | new Notice(`Source note not found: ${annotation.sourcePath}`);\n 214 | return;","explanation":"Reads a single vault file by path","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/giuseqpe/siden/blob/refs/tags/0.1.0/src/main.ts#L211"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"","initialDiffTo":"0.1.0","summary":"Siden reads a single vault file by path to load the content it annotates, and it is designed to add highlights, margin notes, and a review sidebar for Markdown and PDF text. In the reviewed behavior, it does not use network access and does not send data to any external endpoint. If used as intended, its data handling stays local to the vault file it opens.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":"<1.1.18","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development s