AppInspector logoAppInspector
Automated Analysis != Safety. This is a Developer Transparency Tool.
Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks
CHECKS EXPLAINED
Checks Explained
Metadata links and missing fields
Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.
Dockerfile command patterns
Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.
Runtime shell network calls
Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.
Privilege escalation and credential leakage
Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.
Feed vs repo version drift
Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.
  • Metadata links and missing fields
  • Dockerfile command patterns
  • Runtime shell network calls
  • Privilege escalation and credential leakage
  • Feed vs repo version drift
Refresh
Example inputs
https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json
https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json
https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json
Generated Report

Matrix WhatsApp Bridge

Bridge between Matrix and WhatsApp

Score
64/100
64 reached36 still requires deeper inspection
Automated checks can score at most 70/100. The remaining 30 points require deep inspection.
This tool is for informational purposes only. Use at your own risk.
Safety Flags
0
Fail
2
Unsure
8
Pass
Master Info
Install feed
https://git.due.ren/andreas/mautrix-whatsapp-cloudron/-/raw/main/CloudronVersions.json
packageUrl
Not available
Website link
https://docs.mau.fi/bridges/go/whatsapp/index.html
Repository
Not available
Packager
Andreas Dueren
packagerUrl
https://git.due.ren/andreas/mautrix-whatsapp-cloudron
minBox
9.1.0
Version
2.0.7
Tags
matrixwhatsappchatbridgecommunication
Detailed Checklist
packageUrl link is present and well formed when required (7/7)
pass
No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.
Website link is present and well formed (7/7)
pass
https://docs.mau.fi/bridges/go/whatsapp/index.html
Metadata and README links avoid insecure HTTP (7/7)
pass
No HTTP links found.
Metadata and README links avoid URL shorteners (7/7)
pass
No shortener links found.
Cloudron feed version matches the repository manifest (7/7)
pass
Feed and repo both report 2.0.7.
Repository content was fetched for static analysis (7/7)
pass
https://git.due.ren/andreas/mautrix-whatsapp-cloudron @ 5222684fa4eed30e099771d237f4ff224786c2fc
Dockerfile scan did not detect clearly suspicious commands (4/7)
unsure
Dockerfile.cloudron:4 System package installation found. Review whether all packages are justified.
Runtime shell scripts avoid suspicious outbound network calls (4/7)
unsure
scripts/ci-setup-git-push.sh:10 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:12 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:14 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:16 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:18 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:19 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:20 Network-capable command found in a runtime shell script. scripts/ci-setup-git-push.sh:21 Network-capable command found in a runtime shell script. scripts/update-upstream.sh:18 Network-capable command found in a runtime shell script. scripts/update-upstream.sh:55 Network-capable command found in a runtime shell script.
Runtime shell scripts avoid privilege escalation patterns (7/7)
pass
No privilege-escalation patterns found in scanned shell scripts.
Runtime shell scripts avoid credential leakage patterns (7/7)
pass
No credential leakage patterns found in scanned shell scripts.
Raw Findings
Flagged lines are highlighted directly in the code snippet.
11 findings
Dockerfile.cloudron:4
low
System package installation found. Review whether all packages are justified.
2 
3# Install dependencies
4RUN apt-get update && apt-get install -y \
5    curl \
6    ca-certificates \
scripts/ci-setup-git-push.sh:10
medium
Network-capable command found in a runtime shell script.
8fi
9 
10git_push_remote="${GIT_PUSH_REMOTE:-ssh://git@git.due.ren:29418/andreas/mautrix-whatsapp-cloudron.git}"
11 
12install -m 700 -d ~/.ssh
scripts/ci-setup-git-push.sh:12
medium
Network-capable command found in a runtime shell script.
10git_push_remote="${GIT_PUSH_REMOTE:-ssh://git@git.due.ren:29418/andreas/mautrix-whatsapp-cloudron.git}"
11 
12install -m 700 -d ~/.ssh
13if [[ -n "${GIT_SSH_PRIVATE_KEY_B64:-}" ]]; then
14    printf '%s' "$GIT_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
scripts/ci-setup-git-push.sh:14
medium
Network-capable command found in a runtime shell script.
12install -m 700 -d ~/.ssh
13if [[ -n "${GIT_SSH_PRIVATE_KEY_B64:-}" ]]; then
14    printf '%s' "$GIT_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
15else
16    printf '%s\n' "$GIT_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
scripts/ci-setup-git-push.sh:16
medium
Network-capable command found in a runtime shell script.
14    printf '%s' "$GIT_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
15else
16    printf '%s\n' "$GIT_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
17fi
18chmod 600 ~/.ssh/id_ed25519
scripts/ci-setup-git-push.sh:18
medium
Network-capable command found in a runtime shell script.
16    printf '%s\n' "$GIT_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
17fi
18chmod 600 ~/.ssh/id_ed25519
19ssh-keyscan -p 29418 git.due.ren > ~/.ssh/known_hosts
20chmod 600 ~/.ssh/known_hosts
scripts/ci-setup-git-push.sh:19
medium
Network-capable command found in a runtime shell script.
17fi
18chmod 600 ~/.ssh/id_ed25519
19ssh-keyscan -p 29418 git.due.ren > ~/.ssh/known_hosts
20chmod 600 ~/.ssh/known_hosts
21git config core.sshCommand "ssh -i $HOME/.ssh/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=15 -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
scripts/ci-setup-git-push.sh:20
medium
Network-capable command found in a runtime shell script.
18chmod 600 ~/.ssh/id_ed25519
19ssh-keyscan -p 29418 git.due.ren > ~/.ssh/known_hosts
20chmod 600 ~/.ssh/known_hosts
21git config core.sshCommand "ssh -i $HOME/.ssh/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=15 -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
22
scripts/ci-setup-git-push.sh:21
medium
Network-capable command found in a runtime shell script.
19ssh-keyscan -p 29418 git.due.ren > ~/.ssh/known_hosts
20chmod 600 ~/.ssh/known_hosts
21git config core.sshCommand "ssh -i $HOME/.ssh/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=15 -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
22 
23git remote set-url origin "$git_push_remote"
scripts/update-upstream.sh:18
medium
Network-capable command found in a runtime shell script.
16trap 'rm -rf "$tmpdir"' EXIT
17 
18latest_release_tag="$(curl -fsSL "$UPSTREAM_API/releases/latest" | jq -r '.tag_name')"
19if [[ -z "$latest_release_tag" || "$latest_release_tag" == "null" ]]; then
20    echo "Unable to determine latest upstream stable release" >&2
scripts/update-upstream.sh:55
medium
Network-capable command found in a runtime shell script.
53 
54go_mod="$tmpdir/go.mod"
55curl -fsSL "$UPSTREAM_RAW/$latest_sha/go.mod" -o "$go_mod"
56go_version="$(awk '
57    $1 == "toolchain" {
0.0.9