Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks

CHECKS EXPLAINED

Checks Explained

Metadata links and missing fields

Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.

Dockerfile command patterns

Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.

Runtime shell network calls

Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.

Privilege escalation and credential leakage

Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.

Feed vs repo version drift

Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.

Metadata links and missing fields
Dockerfile command patterns
Runtime shell network calls
Privilege escalation and credential leakage
Feed vs repo version drift

Example inputs

https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json

https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json

https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json

Generated Report

CouchDB for Obsidian LiveSync

CouchDB preconfigured as the sync backend for Obsidian Self-hosted LiveSync

Score

50/100

50 reached50 still requires deeper inspection

Automated checks can score at most 70/100. The remaining 30 points require deep inspection.

This tool is for informational purposes only. Use at your own risk.

Safety Flags

Fail

Unsure

Pass

Master Info

Install feed

https://raw.githubusercontent.com/fengchang/couchdb-cloudron/main/CloudronVersions.json

packageUrl

Not available

Website link

https://github.com/fengchang/couchdb-cloudron

Repository

Not available

Packager

fengchang

packagerUrl

https://github.com/fengchang/couchdb-cloudron

minBox

9.1.0

Version

1.0.1

Tags

couchdbobsidianlivesyncsyncdatabasenotes

Detailed Checklist

packageUrl link is present and well formed when required (7/7)

pass

No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.

Website link is present and well formed (7/7)

pass

https://github.com/fengchang/couchdb-cloudron

Metadata and README links avoid insecure HTTP (0/7)

fail

http://localhost`.

Metadata and README links avoid URL shorteners (7/7)

pass

No shortener links found.

Cloudron feed version matches the repository manifest (7/7)

pass

Feed and repo both report 1.0.1.

Repository content was fetched for static analysis (7/7)

pass

https://github.com/fengchang/couchdb-cloudron @ 424af31860b4a4883152879bfa86d50b557ad35e

Dockerfile scan did not detect clearly suspicious commands (4/7)

unsure

Dockerfile:20 System package installation found. Review whether all packages are justified. Dockerfile:34 System package installation found. Review whether all packages are justified.

Runtime shell scripts avoid suspicious outbound network calls (4/7)

unsure

start.sh:83 Network-capable command found in a runtime shell script. start.sh:88 Network-capable command found in a runtime shell script.

Runtime shell scripts avoid privilege escalation patterns (0/7)

fail

start.sh:14 Privileged command or direct system-path modification detected in startup script. start.sh:15 Privileged command or direct system-path modification detected in startup script.

Runtime shell scripts avoid credential leakage patterns (7/7)

pass

No credential leakage patterns found in scanned shell scripts.

Raw Findings

Flagged lines are highlighted directly in the code snippet.

7 findings

Dockerfile:20

low

System package installation found. Review whether all packages are justified.

18# /app/data volume. No real secret is baked into the image.
19RUN apt-get update && \
20    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
21        curl ca-certificates gnupg && \
22    curl -fsSL https://couchdb.apache.org/repo/keys.asc \

Dockerfile:34

low

System package installation found. Review whether all packages are justified.

32    echo "couchdb couchdb/adminpass_again password ${BUILD_PW}"  | debconf-set-selections && \
33    apt-get update && \
34    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
35        "couchdb=${COUCHDB_VERSION}" && \
36    rm -rf /var/lib/apt/lists/*

start.sh:14

high

Privileged command or direct system-path modification detected in startup script.

12DATA=/app/data
13COUCH_DATA="$DATA/couchdb/data"
14ETC_LOCAL="$DATA/couchdb/etc-local"          # -> /opt/couchdb/etc/local.d
15LOCAL_INI="$DATA/couchdb/local.ini"          # -> /opt/couchdb/etc/local.ini
16CREDS="$DATA/credentials.txt"

start.sh:15

high

Privileged command or direct system-path modification detected in startup script.

13COUCH_DATA="$DATA/couchdb/data"
14ETC_LOCAL="$DATA/couchdb/etc-local"          # -> /opt/couchdb/etc/local.d
15LOCAL_INI="$DATA/couchdb/local.ini"          # -> /opt/couchdb/etc/local.ini
16CREDS="$DATA/credentials.txt"
17DEFAULTS=/app/code/couchdb-defaults

start.sh:83

medium

Network-capable command found in a runtime shell script.

81    (
82        for _ in $(seq 1 60); do
83            if curl -sf http://127.0.0.1:5984/_up >/dev/null 2>&1; then
84                break
85            fi

start.sh:88

medium

Network-capable command found in a runtime shell script.

86            sleep 1
87        done
88        curl -s -u "$ADMIN_USER:$ADMIN_PASS" -X PUT \
89            http://127.0.0.1:5984/obsidian >/dev/null 2>&1 || true
90        echo "==> Ensured 'obsidian' database exists"

metadata

high

Insecure HTTP link found: http://localhost`.