Inspector
Cloudron community app transparency reports
Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.
What this checks
- Metadata links and missing fields
- Dockerfile command patterns
- Runtime shell network calls
- Privilege escalation and credential leakage
- Feed vs repo version drift