{"id":"pwamart.com/pwamart","name":"pwamart","commands":["pwamart"],"examples":[{"run":"pwamart search notes","does":"Search the web-app store"},{"run":"pwamart browse --offline","does":"Browse only apps whose service worker works offline"},{"run":"pwamart install <slug>","does":"Open an app as an app window and write a launcher entry"},{"run":"pwamart tui","does":"The whole store in your terminal"},{"run":"pwamart check https://your.app","does":"Grade a site's installability before you submit it"}],"description":"pwamart, the app store for web apps, from the terminal: search, install PWAs as app windows, publish your own, and browse it all in a TUI.","homepage":"https://pwamart.com","repository":"https://github.com/profullstack/pwamart.com","license":"MIT","agentic":false,"latest_version":"0.11.0","vendor":"Profullstack","install":"curl -fsSL https://pwamart.com/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install pwamart.com/pwamart","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":89,"summary":{"critical":34,"high":5,"medium":133,"low":40,"info":0},"malware":0,"truncated":true,"version":"0.11.0","sources":{"installer":"https://pwamart.com/install.sh","installerSha256":"244828e71d9686fa4e5589c8b98c6c86bf99ae66f0ec06ba5c2af55cc55baa57","repository":"github.com/profullstack/pwamart.com"},"notes":[],"scannedAt":"2026-11-01T22:56:22.538Z","findings":[{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":282,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":418,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":419,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":613,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":614,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":616,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":639,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":663,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":795,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":829,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":832,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":841,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":855,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":866,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":886,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":900,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":964,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":975,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":977,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":979,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1000,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1002,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1055,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1059,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1060,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1299,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1300,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1302,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":179,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":180,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":617,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":634,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":642,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"critical","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":646,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"high","category":"secret","cwe":"CWE-798","file":"source/.github/workflows/ci.yml","line":22,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/apps/desktop/src/main.cjs","line":43,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"high","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":183,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"high","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1109,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/apps/web/public/sw.js","line":34,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":64,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":51,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":63,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":95,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":121,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":224,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":237,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":274,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":293,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":309,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":326,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":432,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":507,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":624,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":646,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":687,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":713,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":738,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":755,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":781,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":845,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":941,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":973,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1046,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1066,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1089,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1140,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1163,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/console/console.js","line":1185,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/public/store.js","line":55,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":103,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":132,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":156,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":166,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":254,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":256,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":421,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":563,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":719,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":915,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1016,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1045,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/api.js","line":1276,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/app.js","line":170,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":113,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":139,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":172,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":212,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":227,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/auth.js","line":229,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/badge.js","line":160,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":32,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":47,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":106,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":107,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":114,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":143,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/billing.js","line":144,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/catalog.js","line":105,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/catalog.js","line":177,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/apps/web/src/catalog.js","line":178,"malware":false}]}}