AppInspector logoAppInspector
Automated Analysis != Safety. This is a Developer Transparency Tool.
Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks
CHECKS EXPLAINED
Checks Explained
Metadata links and missing fields
Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.
Dockerfile command patterns
Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.
Runtime shell network calls
Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.
Privilege escalation and credential leakage
Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.
Feed vs repo version drift
Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.
  • Metadata links and missing fields
  • Dockerfile command patterns
  • Runtime shell network calls
  • Privilege escalation and credential leakage
  • Feed vs repo version drift
Refresh
Example inputs
https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json
https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json
https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json
Generated Report

Qdrant

High-performance vector database for AI and search

Score
60/100
60 reached40 still requires deeper inspection
Automated checks can score at most 70/100. The remaining 30 points require deep inspection.
This tool is for informational purposes only. Use at your own risk.
Safety Flags
1
Fail
1
Unsure
8
Pass
Master Info
Install feed
https://raw.githubusercontent.com/OrcVole/qdrant-cloudron/main/CloudronVersions.json
packageUrl
Not available
Website link
https://github.com/OrcVole/qdrant-cloudron
Repository
Not available
Packager
OrcVole
packagerUrl
https://github.com/OrcVole/qdrant-cloudron
minBox
9.1.0
Version
1.0.4
Tags
databasesearchai
Detailed Checklist
packageUrl link is present and well formed when required (7/7)
pass
No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.
Website link is present and well formed (7/7)
pass
https://github.com/OrcVole/qdrant-cloudron
Metadata and README links avoid insecure HTTP (7/7)
pass
No HTTP links found.
Metadata and README links avoid URL shorteners (7/7)
pass
No shortener links found.
Cloudron feed version matches the repository manifest (7/7)
pass
Feed and repo both report 1.0.4.
Repository content was fetched for static analysis (7/7)
pass
https://github.com/OrcVole/qdrant-cloudron @ 33d9bc6963be094dcc7c0dcfdae503cfc9dc303f
Dockerfile scan did not detect clearly suspicious commands (7/7)
pass
No Dockerfile red flags found.
Runtime shell scripts avoid suspicious outbound network calls (4/7)
unsure
snapshot.sh:34 Network-capable command found in a runtime shell script. snapshot.sh:40 Network-capable command found in a runtime shell script. snapshot.sh:51 Network-capable command found in a runtime shell script. test/backup-restore.sh:41 Network-capable command found in a runtime shell script. test/lib.sh:16 Network-capable command found in a runtime shell script. test/lib.sh:19 Network-capable command found in a runtime shell script. test/lib.sh:36 Network-capable command found in a runtime shell script. test/lib.sh:38 Network-capable command found in a runtime shell script. test/lib.sh:40 Network-capable command found in a runtime shell script. test/secret-scan.sh:227 Network-capable command found in a runtime shell script. test/secret-scan.sh:228 Network-capable command found in a runtime shell script. test/secret-scan.sh:229 Network-capable command found in a runtime shell script. test/secret-scan.sh:232 Network-capable command found in a runtime shell script. test/secret-scan.sh:243 Network-capable command found in a runtime shell script. test/secret-scan.sh:248 Network-capable command found in a runtime shell script. test/sso-topology.sh:29 Network-capable command found in a runtime shell script. test/sso-topology.sh:33 Network-capable command found in a runtime shell script. test/sso-topology.sh:34 Network-capable command found in a runtime shell script. test/sso-topology.sh:42 Network-capable command found in a runtime shell script. test/upgrade.sh:33 Network-capable command found in a runtime shell script. test/upgrade.sh:35 Network-capable command found in a runtime shell script. test/upgrade.sh:36 Network-capable command found in a runtime shell script. test/upgrade.sh:37 Network-capable command found in a runtime shell script.
Runtime shell scripts avoid privilege escalation patterns (0/7)
fail
test/secret-scan.sh:156 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:227 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:228 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:229 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:232 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:257 Privileged command or direct system-path modification detected in startup script.
Runtime shell scripts avoid credential leakage patterns (7/7)
pass
No credential leakage patterns found in scanned shell scripts.
Raw Findings
Flagged lines are highlighted directly in the code snippet.
29 findings
snapshot.sh:34
medium
Network-capable command found in a runtime shell script.
32 
33echo "==> [snapshot] creating full storage snapshot"
34curl -fsS -X POST "${BASE}/snapshots" \
35  -H "api-key: ${QDRANT_ADMIN_API_KEY}" \
36  -H 'content-type: application/json' >/dev/null
snapshot.sh:40
medium
Network-capable command found in a runtime shell script.
38# Prune to the newest ${RETAIN} full snapshots. Parse the snapshot list with Node (provided by
39# the base image) to avoid adding a JSON tool to the runtime.
40to_delete="$(curl -fsS "${BASE}/snapshots" -H "api-key: ${QDRANT_ADMIN_API_KEY}" \
41  | node -e '
42let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{
snapshot.sh:51
medium
Network-capable command found in a runtime shell script.
49  [[ -n "${snap}" ]] || continue
50  echo "==> [snapshot] pruning ${snap}"
51  curl -fsS -X DELETE "${BASE}/snapshots/${snap}" -H "api-key: ${QDRANT_ADMIN_API_KEY}" >/dev/null || true
52done <<< "${to_delete}"
53
test/backup-restore.sh:41
medium
Network-capable command found in a runtime shell script.
39echo "  operator config on restored app:"
40cloudron --server "$CLOUDRON_SERVER" exec --app "$NEW" -- grep -n 'max_resident_memory_percent:' /app/data/config/production.yaml
41curl -s -o /dev/null -w '  restored app GET /healthz -> %{http_code}\n' "https://${NEW}/healthz"
42 
43if [ "${KEEP:-0}" != "1" ]; then
test/lib.sh:16
medium
Network-capable command found in a runtime shell script.
14seed_known_data() {
15  echo "  seeding collection '${COLL}' with 3 known points"
16  curl -fsS -X PUT "${QDRANT_BASE}/collections/${COLL}" \
17    -H "api-key: ${QDRANT_KEY}" -H 'content-type: application/json' \
18    -d '{"vectors":{"size":4,"distance":"Dot"}}' >/dev/null
test/lib.sh:19
medium
Network-capable command found in a runtime shell script.
17    -H "api-key: ${QDRANT_KEY}" -H 'content-type: application/json' \
18    -d '{"vectors":{"size":4,"distance":"Dot"}}' >/dev/null
19  curl -fsS -X PUT "${QDRANT_BASE}/collections/${COLL}/points?wait=true" \
20    -H "api-key: ${QDRANT_KEY}" -H 'content-type: application/json' \
21    -d '{"points":[
test/lib.sh:36
medium
Network-capable command found in a runtime shell script.
34  local count payload strict ok=0
35 
36  count="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}" -H "api-key: ${expected_key}" \
37    | grep -o '"points_count":[0-9]*' | head -1)"
38  payload="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}/points/2" -H "api-key: ${expected_key}" \
test/lib.sh:38
medium
Network-capable command found in a runtime shell script.
36  count="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}" -H "api-key: ${expected_key}" \
37    | grep -o '"points_count":[0-9]*' | head -1)"
38  payload="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}/points/2" -H "api-key: ${expected_key}" \
39    | grep -o '"tag":"[a-z]*"' | head -1)"
40  strict="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}" -H "api-key: ${expected_key}" \
test/lib.sh:40
medium
Network-capable command found in a runtime shell script.
38  payload="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}/points/2" -H "api-key: ${expected_key}" \
39    | grep -o '"tag":"[a-z]*"' | head -1)"
40  strict="$(curl -fsS "${QDRANT_BASE}/collections/${COLL}" -H "api-key: ${expected_key}" \
41    | grep -o '"strict_mode_config":{[^}]*}')"
42
test/secret-scan.sh:156
high
Privileged command or direct system-path modification detected in startup script.
154  # it does not ship is simply absent. Only then are the container-side hits for these exact paths
155  # dropped, and only for these exact paths, in the same spirit as the pinned SSH keys below.
156  RUNTIME_PATHS=(/etc/hosts /etc/resolv.conf /etc/hostname)
157  RUNFLAGS=(--network=none)                       # no DNS/hosts wiring either engine can avoid
158  [[ "$CRI" == *podman* ]] && RUNFLAGS+=(--no-hosts)   # podman only; docker always injects
test/secret-scan.sh:227
high
Privileged command or direct system-path modification detected in startup script.
225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
test/secret-scan.sh:227
medium
Network-capable command found in a runtime shell script.
225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
test/secret-scan.sh:228
high
Privileged command or direct system-path modification detected in startup script.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
test/secret-scan.sh:228
medium
Network-capable command found in a runtime shell script.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
test/secret-scan.sh:229
high
Privileged command or direct system-path modification detected in startup script.
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
test/secret-scan.sh:229
medium
Network-capable command found in a runtime shell script.
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
test/secret-scan.sh:232
high
Privileged command or direct system-path modification detected in startup script.
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do
test/secret-scan.sh:232
medium
Network-capable command found in a runtime shell script.
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do
test/secret-scan.sh:243
medium
Network-capable command found in a runtime shell script.
241      shp="$(printf '%s\n' "$shp" | grep -vF "$f:" || true)"   # drop ONLY this verified exact path
242    else
243      emit ssh-key "$f sha256=$h is NOT a pinned base host key (new, changed or extra: treat as a leak)"
244    fi
245  done <<< "$ssh_listing"
test/secret-scan.sh:248
medium
Network-capable command found in a runtime shell script.
246  echo "  host keys: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
247  [[ "$found" -eq "${#PINNED_SSH[@]}" && "$pinned_ok" -eq "${#PINNED_SSH[@]}" ]] \
248    || emit ssh-key "host key count mismatch: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
249 
250  # DISTRO-GENERATED PLACEHOLDER KEYS. Some Debian packages mint a self-signed key in their
test/secret-scan.sh:257
high
Privileged command or direct system-path modification detected in startup script.
255  # Nothing else is exempt: a key at any other path is still a finding, including a second key in
256  # the same directory. Add a path here only after confirming the package does not reference it.
257  PLACEHOLDER_KEYS=(/etc/ssl/private/ssl-cert-snakeoil.key /etc/prosody/certs/localhost.key)
258  for k in "${PLACEHOLDER_KEYS[@]}"; do
259    if printf '%s' "$shp" | grep -qF "$k:"; then
test/sso-topology.sh:29
medium
Network-capable command found in a runtime shell script.
27ok() { printf '  PASS  %s\n' "$1"; pass=$((pass + 1)); }
28no() { printf '  FAIL  %s\n' "$1"; fail=$((fail + 1)); }
29code() { curl -s -o /dev/null -w '%{http_code}' "$@"; }
30 
31echo "== 1. Dashboard is behind Cloudron single sign-on =="
test/sso-topology.sh:33
medium
Network-capable command found in a runtime shell script.
31echo "== 1. Dashboard is behind Cloudron single sign-on =="
32# No session and no bearer token must redirect to the Cloudron login (a 3xx), never serve the UI.
33dash_code="$(curl -s -o /dev/null -w '%{http_code}' "${BASE}/dashboard")"
34dash_loc="$(curl -s -o /dev/null -w '%{redirect_url}' "${BASE}/dashboard")"
35case "${dash_code}" in
test/sso-topology.sh:34
medium
Network-capable command found in a runtime shell script.
32# No session and no bearer token must redirect to the Cloudron login (a 3xx), never serve the UI.
33dash_code="$(curl -s -o /dev/null -w '%{http_code}' "${BASE}/dashboard")"
34dash_loc="$(curl -s -o /dev/null -w '%{redirect_url}' "${BASE}/dashboard")"
35case "${dash_code}" in
36  30[0-9]) ok "GET /dashboard (no session) -> ${dash_code} redirect to ${dash_loc:-Cloudron login}" ;;
test/sso-topology.sh:42
medium
Network-capable command found in a runtime shell script.
40echo "== 2. Data plane returns Qdrant's own 401, not a login redirect =="
41dp_code="$(code "${BASE}/collections")"
42dp_body="$(curl -s "${BASE}/collections")"
43case "${dp_code}" in
44  401|403) ok "GET /collections (no key) -> ${dp_code}: ${dp_body}" ;;
test/upgrade.sh:33
medium
Network-capable command found in a runtime shell script.
31cloudron --server "$CLOUDRON_SERVER" exec --app "$APP" -- grep -n 'max_resident_memory_percent:' /app/data/config/production.yaml
32echo "  new collection inherits the edited value (expect 70):"
33curl -s -X PUT "$BASE/collections/upg_check" -H "api-key: $K" -H 'content-type: application/json' \
34  -d '{"vectors":{"size":4,"distance":"Cosine"}}' >/dev/null
35curl -s "$BASE/collections/upg_check" -H "api-key: $K" | grep -o '"strict_mode_config":{[^}]*}'; echo
test/upgrade.sh:35
medium
Network-capable command found in a runtime shell script.
33curl -s -X PUT "$BASE/collections/upg_check" -H "api-key: $K" -H 'content-type: application/json' \
34  -d '{"vectors":{"size":4,"distance":"Cosine"}}' >/dev/null
35curl -s "$BASE/collections/upg_check" -H "api-key: $K" | grep -o '"strict_mode_config":{[^}]*}'; echo
36curl -s -X DELETE "$BASE/collections/upg_check" -H "api-key: $K" >/dev/null
37curl -s -o /dev/null -w '  GET /healthz -> %{http_code}\n' "$BASE/healthz"
test/upgrade.sh:36
medium
Network-capable command found in a runtime shell script.
34  -d '{"vectors":{"size":4,"distance":"Cosine"}}' >/dev/null
35curl -s "$BASE/collections/upg_check" -H "api-key: $K" | grep -o '"strict_mode_config":{[^}]*}'; echo
36curl -s -X DELETE "$BASE/collections/upg_check" -H "api-key: $K" >/dev/null
37curl -s -o /dev/null -w '  GET /healthz -> %{http_code}\n' "$BASE/healthz"
38
test/upgrade.sh:37
medium
Network-capable command found in a runtime shell script.
35curl -s "$BASE/collections/upg_check" -H "api-key: $K" | grep -o '"strict_mode_config":{[^}]*}'; echo
36curl -s -X DELETE "$BASE/collections/upg_check" -H "api-key: $K" >/dev/null
37curl -s -o /dev/null -w '  GET /healthz -> %{http_code}\n' "$BASE/healthz"
38
0.0.10