Is DataCharter safe?
Probably. Read the findings first.
Use with care. Some checks failed or could not be verified.
What to know before installing
- highWhole environment serialized (possible credential exfil)
Public scan report
scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it
1 high2 medium
- Code scan274 source files scanned3/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 3 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (3)
- highWhole environment serialized (possible credential exfil)
env.dumpdatacharter-0.44.0/src/datacharter/agent/claude_code.py: …, ] def _env() -> dict: env = dict(os.environ) env.pop("ANTHROPIC_API_KEY", None) … - mediumNetwork call to a raw IP address
net.raw-ipdatacharter-0.44.0/src/datacharter/cli.py: … return demo_ws LOCAL_BASE_URL = "http://127.0.0.1:11434/v1" LOCAL_DEFAULT_MODEL = "qwen3:8b" d…
- mediumeval / new Function used
exec.evaldatacharter-0.44.0/src/datacharter/server/static/assets/index-D7GT8bAk.js: …oC=34,vp=10,lC=13;function aj(e){return new Function("d","return {"+e.map(function(t,n){retur…
Overall 57/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON