"2026-08-21T09:00:45.000Z","releaseDate":"2026-07-21T13:57:41.000Z","artifactStatus":"verified"},{"id":122224,"version":"0.1.2","score":100,"privacyLevel":0,"analyzedAt":"2026-08-21T09:00:33.000Z","releaseDate":"2026-07-21T06:52:53.000Z","artifactStatus":null},{"id":122223,"version":"0.1.1","score":100,"privacyLevel":0,"analyzedAt":"2026-08-21T09:00:22.000Z","releaseDate":"2026-07-21T03:03:59.000Z","artifactStatus":null},{"id":122222,"version":"0.1.0","score":100,"privacyLevel":0,"analyzedAt":"2026-08-21T09:00:10.000Z","releaseDate":"2026-07-21T02:31:31.000Z","artifactStatus":null}],"findings":[{"id":1189981,"pluginId":"theme-school","version":"0.1.3","category":"permissions_scope","severity":"info","filePath":"main.js","lineNumber":447,"codeSnippet":"this.app.vault.configDir","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/michellegdyason/theme-school/blob/refs/tags/0.1.3/main.js#L447"},{"id":1189982,"pluginId":"theme-school","version":"0.1.3","category":"permissions_scope","severity":"info","filePath":"main.js","lineNumber":531,"codeSnippet":"this.app.workspace.getLeavesOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/michellegdyason/theme-school/blob/refs/tags/0.1.3/main.js#L531"}],"factors":null,"networkEndpoints":[],"initialDiff":null,"initialDiffFrom":"0.1.2","initialDiffTo":"0.1.3","summary":"Theme School does not use Obsidian vault APIs, so it does not demonstrably read, write, or modify vault files through Obsidian’s standard file-access layer. It also has no recorded network activity, so it does not send data to any remote service in its normal operation. Based on the available review data, its behavior appears limited to local theme-learning features inside Obsidian, with no confirmed external data transfer.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":"<1.1.17","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":"<1.1.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.3","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=2.0.0 <2.1.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.8","severity":"high","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","advisoryUrl":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","ghsaId":"GHSA-mh99-v99m-4gvg","cveId":null,"vulnerableRange":">=4.0.0 <5.0.8","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=4.0.0 <5.0.9","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=4.0.0 <5.0.9","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.1.4","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","advisoryUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","ghsaId":"GHSA-rgw5-rvv9-x895","cveId":null,"vulnerableRange":">=2.0.0 <2.1.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.18","severity":"high","title":"brace-expansion: DoS via unbounded intermediate arrays, bypassi