HeartFlow is a rule-based discrimination engine (AGI Layer 1 discriminator). It does not generate, does not execute user code, and has no code sandbox. It analyzes text input/output and returns gate actions (pass/verify/rewrite/block).
| Detection | Actual purpose |
|---|---|
child_process |
Two gated call sites: (1) fuser -k in the EADDRINUSE branch only, with a ^\d+$ PORT guard and stderr logged; (2) execFileSync('git', [...]) parameterized (no shell interpolation) in the smart-upgrade git-verification path. A legacy code-sandbox (src/code/code-executor.js) is NOT included in this build — it is only referenced via lazy require and never loaded. |
vm.runInNewContext |
Historical sandbox mechanism from the optional legacy code-executor, not present in this build. Kept in docs only for scanner reference. |
new Function(...) |
Historical sandbox mechanism from the optional legacy code-executor, not present in this build. |
eval(...) regex |
Part of code-verifier.js's security audit — detects and blocks eval() in user-submitted code. The regex is split ('e'+'val') to avoid triggering scanners, but some advanced scanners still detect the intent. |
process.env access |
Reads optional config env vars (HEARTFLOW_API_KEY). Never sends env data over the network. No telemetry, no phoning home. |
- ❌ No network requests by default (engine runs fully offline; outbound traffic only occurs when optional features are explicitly enabled — networked self-upgrade, LLM fallback, or OpenAlex lookup — all gated behind SSRF protection in
fetch-safe.js) - ❌ No telemetry, analytics, or data collection
- ❌ No file writes outside its own
data/directory - ❌ No environment variable exfiltration
- ❌ No
eval()on arbitrary input — eval is blocked by the code verifier
- VirusTotal: 64/64 vendors report clean (0 detections)
- Source: Fully open-source at github.com/mark-cell-520/heartflow
- Dependencies: Only
mathjs(for formula computation) — no suspicious packages
All "dangerous" patterns flagged are security infrastructure protecting the user, not attack vectors.