) {","explanation":"Accesses all files in your vault","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/grumpydev/vaultbox/blob/refs/tags/1.0.6/src/sync-plan.ts#L87"}],"factors":null,"networkEndpoints":[{"host":"api.dropboxapi.com","url":null,"filePath":"src/dropbox-auth.ts","lineNumber":101,"codeSnippet":" 98 | }\n 99 | \n 100 | async function postTokenRequest(body: Record): Promise {\n> 101 | const response = await requestUrl({\n 102 | url: DROPBOX_TOKEN_URL,\n 103 | method: \"POST\",\n 104 | headers: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to api.dropboxapi.com (https://api.dropboxapi.com/oauth2/token)","endpointSource":"hardcoded-url"},{"host":"api.dropboxapi.com","url":null,"filePath":"src/dropbox.ts","lineNumber":144,"codeSnippet":" 141 | }\n 142 | \n 143 | private async rpc(endpoint: string, body: unknown): Promise {\n> 144 | const response = await requestUrl({\n 145 | url: `${API_URL}${endpoint}`,\n 146 | method: \"POST\",\n 147 | headers: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to api.dropboxapi.com (https://api.dropboxapi.com/2)","endpointSource":"hardcoded-url"},{"host":"content.dropboxapi.com","url":null,"filePath":"src/dropbox.ts","lineNumber":172,"codeSnippet":" 169 | const maxRetries = options.maxRetries ?? 0;\n 170 | \n 171 | for (let attempt = 0; attempt <= maxRetries; attempt += 1) {\n> 172 | const response = await requestUrl({\n 173 | url: `${CONTENT_URL}${endpoint}`,\n 174 | method: \"POST\",\n 175 | headers: {","networkType":"active-outbound","sendsData":true,"dataDescription":"requestUrl() makes a network request to content.dropboxapi.com (https://content.dropboxapi.com/2)","endpointSource":"hardcoded-url"}],"initialDiff":null,"initialDiffFrom":"1.0.5","initialDiffTo":"1.0.6","summary":"Vaultbox accesses all files in your vault so it can keep them in sync with a selected Dropbox folder on desktop and mobile. It sends data to Dropbox’s OAuth token endpoint at `api.dropboxapi.com` and to Dropbox content endpoints at `content.dropboxapi.com` during sync and authentication. In practice, it can upload and download vault content to Dropbox when you configure or use the sync feature.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":">=0.27.3 <0.28.1","severity":"low","title":"esbuild allows arbitrary file read when running the development server on Windows","advisoryUrl":"https://github.com/advisories/GHSA-g7r4-m6w7-qqqr","ghsaId":"GHSA-g7r4-m6w7-qqqr","cveId":null,"vulnerableRange":">=0.27.3 <0.28.1","fixAvailable":null,"source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":">=8.0.0 <=8.0.15","severity":"moderate","title":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","advisoryUrl":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","ghsaId":"GHSA-v6wh-96g9-6wx3","cveId":null,"vulnerableRange":">=8.0.0 <=8.0.15","fixAvailable":null,"source":"npm-audit","isDirect":false,"path"