History

CRT 582ea909ca scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages		2026-10-12 02:03:07 +08:00
..
apps	scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages	2026-10-12 02:03:07 +08:00
packages/shared	scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages	2026-10-12 02:03:07 +08:00
package.json	scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages	2026-10-12 02:03:07 +08:00
README.md	scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages	2026-10-12 02:03:07 +08:00
storebound.config.ts	scan: accounts mean User ID, never email without evidence; accounts.signUp (username -> PSL_ACM_USER_ID_OTHER_AUTH); built bundles are low-trust evidence; privacy-manifest and scan find plugins in monorepo node_modules, workspaces and local SwiftPM packages	2026-10-12 02:03:07 +08:00

README.md

monorepo fixture

A made-up Bun monorepo game (the layout storebound scan and privacy-manifest met live): the Capacitor shell lives in apps/native with its plugins in apps/native/node_modules (not the root node_modules), the web build is copied into apps/native/web (the Capacitor webDir, a minified bundle with route constants), and accounts are a username picked on the device plus a server token: no password, no email anywhere. Expected: User ID detected, no email finding, the ad SDK found behind its plugin (podspec, Package.swift, android/build.gradle), the plugins found without --sdk-dirs. Not a buildable project.