Inspector
Cloudron community app transparency reports
Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.
What this checks
CHECKS EXPLAINED
Checks Explained
Metadata links and missing fields
Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.
Dockerfile command patterns
Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.
Runtime shell network calls
Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.
Privilege escalation and credential leakage
Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.
Feed vs repo version drift
Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.
- Metadata links and missing fields
- Dockerfile command patterns
- Runtime shell network calls
- Privilege escalation and credential leakage
- Feed vs repo version drift
Example inputs
https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json
https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json
https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json