{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"c50ad8d3-bcce-4f70-bc19-0b9c2d8af0e1","kind":"skill:site-content-check","nodes":[{"acceptedSubmissionHash":"d2d4deff1471a39a70513ada8191ef1f514e3bcdce2c21606a23a5b9e54a77ca","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"9724d22ee4afab47bcc23d9bcd121784b0de277f78f82806d4dc4e8aa62609bf","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"9724d22ee4afab47bcc23d9bcd121784b0de277f78f82806d4dc4e8aa62609bf","skillId":"site-content-check","state":"accepted"}],"objective":"Host TurgayAcar49/squeek-hours as it is.","parentJobId":null,"planHash":"f5b931d9cdd344f87ade51b628c01020f72627f6bfa825a7ec1d2b88e6c197fc","previousHash":"5dfd21dc0a227ddaa43274b6163e7924285d825a3118d9a1c67b02a016779c9a","projectId":"c50ad8d3-bcce-4f70-bc19-0b9c2d8af0e1","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":{"cid":"bafybeibqtssjnfcderoyqeu5grfdjgby2xqu2iwodhcboi54yagyanw3vm","ensName":"squeek-hours.identitymd.eth","namingTransaction":"0x9103ab36f5ccf4176467e0cf7161e86789ce4bb1476305b8dd72549d7c924f6a"},"snapshotHash":"2722200c8dd200c0e2367571bd7c5cb529c564d5df23a8f6b45dde0055f5d8bc","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a7979f925df7a720","findings":[{"citation":"resolved","description":"public/art/focus-league.png is a screen capture of another focus app's UI. It shows the 'FOCUMON' wordmark and logo top-left, a 'FOCUS NOW' button, 'Quests completed' and 'New cheers' stats, and the caption 'Collect monsters by being productive!'. The Board view shows it as the banner for Squeek Hours' own 'Focus league', with the alt text 'Focus league desk.' This passes off another product's branded artwork as this site's league art without credit. The page never claims to be Focumon and asks for nothing because of the image, so it is not impersonation and does not block hosting. It is a trademark and copyright concern.","line":107,"path":"public/index.html","reproduction":"Open the hosted index.html and click 'Board' in the nav. The banner at the top shows the Focumon logo and UI. You can also open /art/focus-league.png directly. Expected: original or credited art. Actual: another product's branded screenshot.","severity":"medium","snippet":" ","title":"Board banner is a screenshot of a third-party product (Focumon) with its name and logo"},{"citation":"resolved","description":"The page depends on the Python backend in server.py (/api/me, /api/login, /api/register, /api/rooms, /api/sessions, /api/expedition, /api/leaderboard). Only public/ gets pinned, so the hosted page has no backend. The sign-in dialog (index.html line 126, '') still asks for a password and sends it as JSON to /api/login or /api/register on whatever origin serves the page, for example the IPFS gateway behind the ENS name. Nothing there processes it. This is an app account password, not a wallet or exchange password, and it is not sent to a third party, so it is not critical. But visitors are asked for a credential the hosted site cannot use, and sign-in, rooms, sessions, board and profile are all broken. Only the chain status falls back, to api.squeekchain.com (line 121).","line":367,"path":"public/app.js","reproduction":"Serve public/ with a static server (python3 -m http.server -d public) and open it. Click 'Sign in', type any username and an 8+ character password, and press 'Sign in'. DevTools > Network shows POST /api/login with {\"username\":...,\"password\":...} to the static origin, which returns 404/501. The dialog then shows 'Request failed'. Clicking 'Rooms' or 'Board' does nothing: the GET /api/rooms and /api/leaderboard requests fail.","severity":"medium","snippet":" await api(path, { method: \"POST\", body: { username: form.get(\"username\"), password: form.get(\"password\") } });","title":"Hosted statically, every /api call fails, but the sign-in dialog still collects and POSTs a password to the hosting origin"},{"citation":"resolved","description":"The home-page hero public/art/hamster-clock.png has the text \"Windows'u Etki...\" in its bottom-right corner. public/art/focus-league.png shows 'Windows', and public/art/global-impact.jpg shows \"Windows'u Etki / Windows'u etkinleştir\". These are screen captures of other sources, not original exports. This is cosmetic, but it backs up the provenance concern above. Also, the .png files are really JPEG data (they start with FF D8 FF E0).","line":33,"path":"public/index.html","reproduction":"Open the hosted index.html. On the home view the hamster hero image shows the watermark text bottom-right. You can also open /art/hamster-clock.png and /art/global-impact.jpg directly.","severity":"low","snippet":" ","title":"Served images carry an 'Activate Windows' (Windows'u Etkinleştir) screen-capture watermark"},{"citation":"resolved","description":"When /api/chain fails, which always happens on a static host, the page fetches https://api.squeekchain.com/v1/status from the visitor's browser. It does this on load and every 8 seconds (line 380). The response is parsed as JSON and only drawn as text (interpretStatus, lines 76-113). No code is downloaded or run, so this is not a remote-code concern. It is a third-party request the page does not disclose.","line":121,"path":"public/app.js","reproduction":"Open the hosted page with DevTools > Network open. A GET to https://api.squeekchain.com/v1/status fires right away and then every 8 s.","severity":"low","snippet":" const response = await fetch(\"https://api.squeekchain.com/v1/status\", { cache: \"no-store\" });","title":"Visitor browsers request api.squeekchain.com directly and the page does not say so"},{"citation":"resolved","description":"room_detail serialises the whole rooms row, including the 'invite' column, with no sign-in or membership check. join_room (line 741) requires that invite for private rooms, but anyone with the slug can read it from GET /api/rooms/, so the invite gate does nothing. server.py is source, not part of the pinned export, so this does not affect the hosted page.","line":555,"path":"server.py","reproduction":"Run python server.py, sign in as user A and create a private room. The page shows 'Code p-xxxxxxxx · invite yyyyyy'. Without any cookie, run curl http://127.0.0.1:4183/api/rooms/p-xxxxxxxx. Expected: no invite in the response. Actual: the JSON includes \"invite\": \"yyyyyy\".","severity":"low","snippet":" self.send_json(200, {\"room\": dict(room), \"people\": [dict(row) for row in people], \"messages\": [dict(row) for row in reversed(notes)]})","title":"Room detail endpoint returns a private room's invite code to anyone who knows the room code"}],"hash":"d2d4deff1471a39a70513ada8191ef1f514e3bcdce2c21606a23a5b9e54a77ca","nodeId":"3ec32398-80b8-4320-b4e5-19509899b6ab","outcome":"completed","summary":"Nothing in the export needs to stop hosting: I found no critical or high issues. I read `public/index.html`, `public/app.js`, `public/styles.css`, all four images in `public/art/`, and also `server.py` and the README. The five advisory findings are in `.imd-findings.json`, and I checked that each path, line and snippet matches the files exactly.\n\n**What I looked for and didn't find:**\n- No request for a wallet seed phrase, private key or exchange password.\n- No wallet approvals, signatures or crypto-wallet code at all.\n- No hidden iframes, redirects or obfuscated code.\n- No code loaded from another site and run. The only outside request is a JSON status read, and the result is only shown as text.\n- No investment claims or impersonation of the site as someone else.\n\n**Findings:**\n1. **Medium: third-party product image** (`public/index.html:107`). The Board banner `focus-league.png` is a screenshot of another focus app, Focumon, including its logo and name. The site shows it as its own \"Focus league desk\" art. It isn't pretending to be Focumon, so I didn't rate it as impersonation, but it's a trademark and copyright concern.\n2. **Medium: the hosted site has no backend** (`public/app.js:367`). Only `public/` gets pinned, so every `/api/*` call fails. The sign-in dialog still asks for a username and password and sends them to whatever server hosts the page, which can't use them. Sign-in, rooms, sessions, board and profile are all broken. It's an account password for this app, not a wallet password, so it isn't critical.\n3. **Low: \"Activate Windows\" watermark** (`public/index.html:33`). Three of the images are screen captures showing the Turkish \"Windows'u Etkinleştir\" (\"Activate Windows\") text. Also, the `.png` files actually contain JPEG data.\n4. **Low: undisclosed outside request** (`public/app.js:121`). When the backend call fails, which is always on a static host, the visitor's browser fetches `https://api.squeekchain.com/v1/status` on load and every 8 seconds. The page doesn't mention it.\n5. **Low: private-room invite codes are exposed** (`server.py:555`). The room details endpoint returns a private room's invite code to anyone who has the room code, so the invite check does nothing. This is in the server source, which isn't part of what gets hosted.\n\nThe repository has no Solidity, so I wrote no Foundry tests, and no finding was severe enough to need one. The only file I created is `.imd-findings.json`.","treeHash":null,"usage":{"cachedInputTokens":285019,"cost":{"source":"runtime","usdMicros":531171},"inputTokens":17,"model":"claude-opus-5-5","outputTokens":6488,"runtime":"claude","turns":13,"wallClockMs":79583}}],"verification":[]}
![\"Focus](\"/art/focus-league.png\")
","title":"Board banner is a screenshot of a third-party product (Focumon) with its name and logo"},{"citation":"resolved","description":"The page depends on the Python backend in server.py (/api/me, /api/login, /api/register, /api/rooms, /api/sessions, /api/expedition, /api/leaderboard). Only public/ gets pinned, so the hosted page has no backend. The sign-in dialog (index.html line 126, '') still asks for a password and sends it as JSON to /api/login or /api/register on whatever origin serves the page, for example the IPFS gateway behind the ENS name. Nothing there processes it. This is an app account password, not a wallet or exchange password, and it is not sent to a third party, so it is not critical. But visitors are asked for a credential the hosted site cannot use, and sign-in, rooms, sessions, board and profile are all broken. Only the chain status falls back, to api.squeekchain.com (line 121).","line":367,"path":"public/app.js","reproduction":"Serve public/ with a static server (python3 -m http.server -d public) and open it. Click 'Sign in', type any username and an 8+ character password, and press 'Sign in'. DevTools > Network shows POST /api/login with {\"username\":...,\"password\":...} to the static origin, which returns 404/501. The dialog then shows 'Request failed'. Clicking 'Rooms' or 'Board' does nothing: the GET /api/rooms and /api/leaderboard requests fail.","severity":"medium","snippet":" await api(path, { method: \"POST\", body: { username: form.get(\"username\"), password: form.get(\"password\") } });","title":"Hosted statically, every /api call fails, but the sign-in dialog still collects and POSTs a password to the hosting origin"},{"citation":"resolved","description":"The home-page hero public/art/hamster-clock.png has the text \"Windows'u Etki...\" in its bottom-right corner. public/art/focus-league.png shows 'Windows', and public/art/global-impact.jpg shows \"Windows'u Etki / Windows'u etkinleştir\". These are screen captures of other sources, not original exports. This is cosmetic, but it backs up the provenance concern above. Also, the .png files are really JPEG data (they start with FF D8 FF E0).","line":33,"path":"public/index.html","reproduction":"Open the hosted index.html. On the home view the hamster hero image shows the watermark text bottom-right. You can also open /art/hamster-clock.png and /art/global-impact.jpg directly.","severity":"low","snippet":" ![\"Squeektoshi](\"/art/hamster-clock.png\")
","title":"Served images carry an 'Activate Windows' (Windows'u Etkinleştir) screen-capture watermark"},{"citation":"resolved","description":"When /api/chain fails, which always happens on a static host, the page fetches https://api.squeekchain.com/v1/status from the visitor's browser. It does this on load and every 8 seconds (line 380). The response is parsed as JSON and only drawn as text (interpretStatus, lines 76-113). No code is downloaded or run, so this is not a remote-code concern. It is a third-party request the page does not disclose.","line":121,"path":"public/app.js","reproduction":"Open the hosted page with DevTools > Network open. A GET to https://api.squeekchain.com/v1/status fires right away and then every 8 s.","severity":"low","snippet":" const response = await fetch(\"https://api.squeekchain.com/v1/status\", { cache: \"no-store\" });","title":"Visitor browsers request api.squeekchain.com directly and the page does not say so"},{"citation":"resolved","description":"room_detail serialises the whole rooms row, including the 'invite' column, with no sign-in or membership check. join_room (line 741) requires that invite for private rooms, but anyone with the slug can read it from GET /api/rooms/