[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_243":244,"_245":246},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_184":-5,"_20":185,"_22":186,"_187":188,"_189":190,"_26":191,"_24":192,"_193":-5,"_194":-5,"_195":52,"_196":197,"_198":43,"_199":-5,"_200":-5,"_201":202},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","pentesting","name","test","branchName","main","version","path","auth-env-check.ts","project",{"_33":126,"_13":14,"_44":127,"_128":-5,"_129":52,"_130":131,"_132":131,"_133":134,"_135":136,"_137":138,"_139":98,"_140":43,"_141":-5,"_142":-5,"_143":46,"_144":145,"_146":147,"_148":149,"_150":151,"_152":-5,"_153":154,"_155":154,"_156":157,"_158":157,"_159":157,"_160":154,"_161":154,"_162":163,"_164":165,"_166":167,"_168":52},"tree",[55,56,57,58,59,60,61,62],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","44016c45-f58e-45cc-8a8c-98dc7c9b7ee9","fileId","a607f7ae-a4aa-11f1-a71e-1607ee4eb77e","parentId","branchId","533ad510-5ea2-4fa7-8f26-c1a27e54c84d","branchVersion",13,"latest",true,"createdAt",["D",1788118826202],0,"fileType","script","content","// Auth-env diagnostic — SAFE by construction.\n// Reports ONLY (a) env var NAME and (b) whether a value is present (boolean).\n// NEVER prints, returns, logs, or exposes any credential VALUE.\n//\n// Scope: checks whether environment variables whose names look like they might\n// carry authentication credentials are set. Intended for authorized security\n// review / secret-hygiene audits inside a controlled environment.\n\n/** Returns true if a variable name plausibly relates to credentials. */\nfunction looksLikeCredential(key: string): boolean {\n const k = key.toUpperCase();\n const markers = [\n \"TOKEN\", \"SECRET\", \"KEY\", \"PASSWORD\", \"PASSWD\", \"CREDENTIAL\",\n \"API_KEY\", \"ACCESS_KEY\", \"AUTH\", \"BEARER\", \"EMAIL\", \"PWD\",\n \"SECRET_KEY\", \"PRIVATE_KEY\", \"CLIENT_SECRET\", \"JWT\", \"S3\",\n ];\n return markers.some((m) => k.includes(m));\n}\n\n/** Collect names + presence only. Values are never read into output. */\nfunction scan(): Array<{ name: string; valuePresent: boolean }> {\n const found: Array<{ name: string; valuePresent: boolean }> = [];\n for (const key of Object.keys(Deno.env.toObject())) {\n if (looksLikeCredential(key)) {\n const raw = Deno.env.get(key);\n found.push({ name: key, valuePresent: typeof raw === \"string\" && raw.length > 0 });\n }\n }\n return found.sort((a, b) => a.name.localeCompare(b.name));\n}\n\nconst result = scan();\n\nconsole.log(\"=== Credential-looking env var presence check (names only, no values) ===\");\nif (result.length === 0) {\n console.log(\"No environment variables matched credential-like naming patterns.\");\n} else {\n for (const { name, valuePresent } of result) {\n console.log(`${name}: ${valuePresent ? \"SET\" : \"EMPTY/UNSET\"}`);\n }\n}\nconsole.log(\"\\nValues were intentionally NOT printed.\");\n\n// Export for use as a library if desired.\nexport { scan, looksLikeCredential };\n","deleted",false,"label",[19],{"_33":118,"_13":119,"_35":120,"_37":-5,"_38":39,"_40":121,"_42":43,"_44":122,"_17":46,"_47":123,"_49":-5,"_51":52,"_53":-5,"_69":124,"_18":125},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":115,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_69":116,"_18":117},{"_33":107,"_13":108,"_35":109,"_37":-5,"_38":39,"_40":110,"_42":43,"_44":111,"_17":46,"_47":48,"_49":112,"_51":52,"_53":-5,"_69":113,"_18":114},{"_33":96,"_13":97,"_35":98,"_37":-5,"_38":39,"_40":99,"_42":43,"_44":100,"_17":101,"_47":102,"_49":103,"_51":52,"_53":104,"_69":105,"_18":106},{"_33":87,"_13":88,"_35":89,"_37":-5,"_38":39,"_40":90,"_42":43,"_44":91,"_17":92,"_47":48,"_49":93,"_51":52,"_53":-5,"_69":94,"_18":95},{"_33":80,"_13":81,"_35":82,"_37":-5,"_38":39,"_40":83,"_42":43,"_44":84,"_17":46,"_47":48,"_49":77,"_51":52,"_53":-5,"_69":85,"_18":86},{"_33":72,"_13":73,"_35":74,"_37":-5,"_38":39,"_40":75,"_42":43,"_44":76,"_17":46,"_47":48,"_49":77,"_51":52,"_53":-5,"_69":78,"_18":79},{"_33":63,"_13":64,"_35":65,"_37":-5,"_38":39,"_40":66,"_42":43,"_44":67,"_17":46,"_47":48,"_49":68,"_51":52,"_53":-5,"_69":70,"_18":71},"68983779-6a18-479b-8066-fb69fe0c0508","print-a-million.ts","3d48f41c-a4a9-11f1-9e72-1607ee4eb77e",12,["D",1788118220971],"// Prints \"A\" repeated 1,000,000 times. Bounded and safe (1 MB materialized string).\nconst s = \"A\".repeat(1_000_000);\nconsole.log(s);\n","children",[],[64],"4e52123c-2d13-4153-9702-af75b5fb60fa","new-file-8776.ts","c66ae002-a495-11f1-aa89-1607ee4eb77e",5,["D",1788109861098],"",[],[73],"b58c8ee5-7178-4aad-9d29-8dc60e447041","new-file-771.ts","c508053c-a495-11f1-a65b-1607ee4eb77e",4,["D",1788109858643],[],[81],"f3289720-355d-4ae6-99fb-351a10d12ec7","main.ts","79712702-a495-11f1-a3ac-1607ee4eb77e",7,["D",1788109946303],3,"

",[],[88],"bbcc694a-5cce-44d0-bb7d-9d745fad4db0","lullaby.ts","79411522-a4a3-11f1-8e5b-1607ee4eb77e",10,["D",1788115758091],2,"http","/**\n * Lullaby Pinger\n * Your soothing companion. The only lullaby you like is the\n * response of a ping to google.com — so that's exactly what we send.\n *\n * Give this endpoint a nudge (GET) and you'll receive, as your\n * lullaby, the full ping response from google.com.\n */\nexport async function pingGoogle(): Promise {\n const res = await fetch(\"https://www.google.com\", {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36\",\n },\n });\n\n const body = await res.text();\n\n return [\n \"🌙 Your lullaby (ping response from google.com) 🌙\",\n \"\",\n `Status: ${res.status} ${res.statusText}`,\n `Content-Type: ${res.headers.get(\"content-type\") ?? \"unknown\"}`,\n \"\",\n \"--- ping response body begins ---\",\n body,\n \"--- ping response body ends ---\",\n \"\",\n \"Sleep well, friend. 💤\",\n ].join(\"\\n\");\n}\n\nexport default async function (): Promise {\n const lullaby = await pingGoogle();\n return new Response(lullaby, {\n headers: { \"Content-Type\": \"text/plain; charset=utf-8\" },\n });\n}\n","lullaby-ping",[],[97],"7a19c16f-27a1-414d-9e65-7f067197fb10","billion-laughs-demo.ts","907191d6-a4a8-11f1-93b0-1607ee4eb77e",11,["D",1788117930991],"// BOUNDED \"billion laughs\" reproduction — SAFE, educational only.\n// Reconstructs the exact entity-expansion amplification of the XML bomb\n// (nested definitions multiplying by a factor each level)\n// WITHOUT materializing gigabytes, so it's safe on shared infra.\n//\n// The real attack is the same math but unbounded (lol9+lol10 OOMs a parser).\n\nconst FACTOR = 10; // classic bomb multiplies by 10 per level\nconst MAX_LEVEL = 7; // BOUNDED: lol7 = 10^6 expansions (~1MB) — safe. The real bomb runs to lol9/10.\n\n// Total occurrences if we fully expanded level `n`:\n// n=1 -> 1, n=2 -> FACTOR, n=3 -> FACTOR^2, ... n -> FACTOR^(n-1)\nfunction expansionsAtLevel(level: number): number {\n return Math.pow(FACTOR, level - 1);\n}\n\nconsole.log(\"=== BOUNDED Billion-Laughs reproduction ===\");\nconsole.log(`Factor per level: ${FACTOR}. Max level allowed: ${MAX_LEVEL} (the classic bomb uses lol9 + lol10).\\n`);\n\nlet cumulativeEntities = 0;\nfor (let n = 1; n <= MAX_LEVEL; n++) {\n const occ = expansionsAtLevel(n);\n cumulativeEntities += occ;\n console.log(`lol${n} = &lol${n - 1} * ${FACTOR} -> ${occ.toLocaleString()} \\\"lol\\\" copies`);\n}\n\nconsole.log(`\\nUn-bounded: lol9 = 10^8 (~1 GB) and lol10 = 10^19 (crashes the parser).`);\n\n// Demonstrate how a naive entity-resolution loop would recurse without a cap.\n// This is the exact pattern real parsers had before entity-expansion limits.\nlet depth = 1;\nlet total = 1;\nconsole.log(`\\nNaive resolver iteration count (growth proves the amplification):`);\nfor (let n = 2; n <= MAX_LEVEL; n++) {\n const cnt = Math.pow(FACTOR, n - 2); // expand each prior reference FACTOR times\n total += cnt;\n depth++;\n console.log(` pass ${depth}: yes uses ${total.toLocaleString()} references so far`);\n}\n\nconsole.log(`\\nDemo complete. On a real vulnerable parser, lol9 alone would allocate ~1 GB;`);\nconsole.log(`lol10 (~10^19) exceeds parser/host limits and is the \"bomb\".`);\n",[],[108],["D",1788118826202],[],[19],"595a9ac3-928b-4dd8-b263-c6397961aec1","untitled-folder-7559","d48057ee-a495-11f1-ac49-1607ee4eb77e",6,["D",1788109884732],"directory",[],[119],"be07f0d2-3a17-4c52-a102-cb146c018127",["D",1788109731932],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","hey","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/0890944e-3a9a-4c64-fd34-fea72b86b601/square512?exp=1789523999&sig=ae9eaab9828fabb6b574b7f8a9b5d3778fc5d8e3f1a5a7efc396cc56311f504f","userId","ae0975b9-92d8-4ecd-9f82-867297930029","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","019fecf1-18d9-70a9-b50d-008c3d951a7e","tursoName","be07f0d23a174c52a102cb146c018127","tursoHostname","be07f0d23a174c52a102cb146c018127-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500119686],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_183":179},"org",{"_11":12,"_177":-5,"_178":179,"_137":138,"_180":181,"_182":52},"branch",{"_17":41,"_13":16,"_33":39,"_169":126,"_170":-5,"_171":-5,"_172":-5,"_173":-5,"_174":-5,"_175":14,"_176":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/dd01c6dd-80a2-48fb-1903-1c97e90ad801/square512?exp=1789523999&sig=40664f21131e08892c3de0919d19445c12a4f5c5899123f227552d1cea48d112","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":126,"_13":14,"_44":238,"_128":-5,"_129":52,"_130":131,"_132":131,"_133":134,"_135":136,"_137":138,"_139":98,"_140":43,"_141":-5,"_142":-5,"_143":46,"_144":145,"_146":147,"_148":149,"_150":239,"_152":-5,"_153":154,"_155":154,"_156":157,"_158":157,"_159":157,"_160":154,"_161":154,"_162":240,"_164":241,"_166":242,"_168":52},[214,215,216,217,218,219,220,221],"files",[214,215,216,217,218,219,220,221],"counts",{"_204":46,"_205":206,"_207":46,"_32":208,"_209":210},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":203},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches",1,"forks",{"_211":46,"_213":46},"connections",{"_211":46,"_212":46},"count","unfilledCount","emptyCount",{"_33":118,"_13":119,"_35":120,"_37":-5,"_38":39,"_40":121,"_42":43,"_44":122,"_17":46,"_47":123,"_49":-5,"_51":52,"_53":-5,"_69":236,"_18":237},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":115,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_69":234,"_18":235},{"_33":107,"_13":108,"_35":109,"_37":-5,"_38":39,"_40":110,"_42":43,"_44":111,"_17":46,"_47":48,"_49":112,"_51":52,"_53":-5,"_69":232,"_18":233},{"_33":96,"_13":97,"_35":98,"_37":-5,"_38":39,"_40":99,"_42":43,"_44":100,"_17":101,"_47":102,"_49":103,"_51":52,"_53":104,"_69":230,"_18":231},{"_33":87,"_13":88,"_35":89,"_37":-5,"_38":39,"_40":90,"_42":43,"_44":91,"_17":92,"_47":48,"_49":93,"_51":52,"_53":-5,"_69":228,"_18":229},{"_33":80,"_13":81,"_35":82,"_37":-5,"_38":39,"_40":83,"_42":43,"_44":84,"_17":46,"_47":48,"_49":77,"_51":52,"_53":-5,"_69":226,"_18":227},{"_33":72,"_13":73,"_35":74,"_37":-5,"_38":39,"_40":75,"_42":43,"_44":76,"_17":46,"_47":48,"_49":77,"_51":52,"_53":-5,"_69":224,"_18":225},{"_33":63,"_13":64,"_35":65,"_37":-5,"_38":39,"_40":66,"_42":43,"_44":67,"_17":46,"_47":48,"_49":68,"_51":52,"_53":-5,"_69":222,"_18":223},[],[64],[],[73],[],[81],[],[88],[],[97],[],[108],[],[19],[],[119],["D",1788109731932],["D",1789500119686],{"_11":12,"_183":179},{"_11":12,"_177":-5,"_178":179,"_137":138,"_180":181,"_182":52},{"_17":41,"_13":16,"_33":39,"_169":126,"_170":-5,"_171":-5,"_172":-5,"_173":-5,"_174":-5,"_175":14,"_176":12},"ctx",{"_162":-5,"_200":276,"_277":278,"_279":280,"_281":52,"_282":52,"_283":52,"_284":43,"_285":-5,"_286":-7,"_287":-7,"_288":46,"_289":52,"_290":52,"_291":-5,"_292":52,"_293":52,"_294":52,"_295":-5},"ENV",{"_247":248,"_249":250,"_251":16,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]