# Pitfall Log

Project: JuliusBrussee/cavemem

Summary: Found 35 structured pitfall item(s), including 8 high/blocking item(s). Top priority: Installation risk - Installation risk requires verification.

## 1. Installation risk - Installation risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/17

## 2. Installation risk - Installation risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/11

## 3. Configuration risk - Configuration risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Project evidence flags a configuration risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/39

## 4. Security or permission risk - Security or permission risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Developers should check this security_permissions risk before relying on the project: No per-tool capture allowlist/matcher: sensitive MCP tool I/O captured by default
- User impact: Developers may expose sensitive permissions or credentials: No per-tool capture allowlist/matcher: sensitive MCP tool I/O captured by default
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/50

## 5. Security or permission risk - Security or permission risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Developers should check this security_permissions risk before relying on the project: Windows: hook commands written with backslashes break under bash -c (path collapse to `C:Usershp...`)
- User impact: Developers may expose sensitive permissions or credentials: Windows: hook commands written with backslashes break under bash -c (path collapse to `C:Usershp...`)
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/43

## 6. Security or permission risk - Security or permission risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Developers should check this security_permissions risk before relying on the project: Worker HTTP viewer on 127.0.0.1:37777 is unauthenticated and serves decompressed memory
- User impact: Developers may expose sensitive permissions or credentials: Worker HTTP viewer on 127.0.0.1:37777 is unauthenticated and serves decompressed memory
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/51

## 7. Security or permission risk - Security or permission risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Developers should check this security_permissions risk before relying on the project: privacy.excludePatterns is documented as enforced but is never read (matching paths still captured)
- User impact: Developers may expose sensitive permissions or credentials: privacy.excludePatterns is documented as enforced but is never read (matching paths still captured)
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/48

## 8. Security or permission risk - Security or permission risk requires verification

- Severity: high
- Evidence strength: source_linked
- Finding: Developers should check this security_permissions risk before relying on the project: redactSecrets is a no-op: secrets in tool output are stored verbatim (no output-side scrubber)
- User impact: Developers may expose sensitive permissions or credentials: redactSecrets is a no-op: secrets in tool output are stored verbatim (no output-side scrubber)
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/49

## 9. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: Add Antigravity IDE support
- User impact: Developers may fail before the first successful local run: Add Antigravity IDE support
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/38

## 10. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: Add Trae SOLO IDE support
- User impact: Developers may fail before the first successful local run: Add Trae SOLO IDE support
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/40

## 11. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: Codex installer is out of date
- User impact: Developers may fail before the first successful local run: Codex installer is out of date
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/17

## 12. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: cavemem start fails with spawn EFTYPE on Windows
- User impact: Developers may fail before the first successful local run: cavemem start fails with spawn EFTYPE on Windows
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/11

## 13. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: cavemem v0.1.0
- User impact: Upgrade or migration may change expected behavior: cavemem v0.1.0
- Evidence: failure_mode_cluster:github_release | https://github.com/JuliusBrussee/cavemem/releases/tag/v0.1.0

## 14. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: cavemem v0.1.1
- User impact: Upgrade or migration may change expected behavior: cavemem v0.1.1
- Evidence: failure_mode_cluster:github_release | https://github.com/JuliusBrussee/cavemem/releases/tag/v0.1.1

## 15. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: v0.1.3
- User impact: Upgrade or migration may change expected behavior: v0.1.3
- Evidence: failure_mode_cluster:github_release | https://github.com/JuliusBrussee/cavemem/releases/tag/v0.1.3

## 16. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this installation risk before relying on the project: v0.2.1
- User impact: Upgrade or migration may change expected behavior: v0.2.1
- Evidence: failure_mode_cluster:github_release | https://github.com/JuliusBrussee/cavemem/releases/tag/v0.2.1

## 17. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/38

## 18. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/40

## 19. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/50

## 20. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/43

## 21. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/37

## 22. Installation risk - Installation risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/48

## 23. Configuration risk - Configuration risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a configuration risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: capability.host_targets | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 24. Configuration risk - Configuration risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a configuration risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/45

## 25. Capability evidence risk - Capability evidence risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: README/documentation is current enough for a first validation pass.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: capability.assumptions | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 26. Maintenance risk - Maintenance risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Developers should check this migration risk before relying on the project: bug: better-sqlite3 native bindings fail on Node.js 26.0.0 (v147) - use bun:sqlite as fallback?
- User impact: Developers may hit a documented source-backed failure mode: bug: better-sqlite3 native bindings fail on Node.js 26.0.0 (v147) - use bun:sqlite as fallback?
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/37

## 27. Maintenance risk - Maintenance risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a maintenance risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: evidence.maintainer_signals | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 28. Security or permission risk - Security or permission risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: no_demo
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: downstream_validation.risk_items | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 29. Security or permission risk - Security or permission risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: no_demo
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: risks.scoring_risks | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 30. Security or permission risk - Security or permission risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a security or permission risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/51

## 31. Security or permission risk - Security or permission risk requires verification

- Severity: medium
- Evidence strength: source_linked
- Finding: Project evidence flags a security or permission risk. Review the linked source before relying on this workflow.
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: community_evidence:github | https://github.com/JuliusBrussee/cavemem/issues/49

## 32. Capability evidence risk - Capability evidence risk requires verification

- Severity: low
- Evidence strength: source_linked
- Finding: Developers should check this capability risk before relying on the project: session-start: prior-session context not scoped to cwd, leaks across unrelated projects
- User impact: Developers may hit a documented source-backed failure mode: session-start: prior-session context not scoped to cwd, leaks across unrelated projects
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/39

## 33. Runtime risk - Runtime risk requires verification

- Severity: low
- Evidence strength: source_linked
- Finding: Developers should check this performance risk before relying on the project: Cavemen with Opecode Desktop App on windows not working
- User impact: Developers may hit a documented source-backed failure mode: Cavemen with Opecode Desktop App on windows not working
- Evidence: failure_mode_cluster:github_issue | https://github.com/JuliusBrussee/cavemem/issues/45

## 34. Maintenance risk - Maintenance risk requires verification

- Severity: low
- Evidence strength: source_linked
- Finding: issue_or_pr_quality=unknown。
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: evidence.maintainer_signals | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem

## 35. Maintenance risk - Maintenance risk requires verification

- Severity: low
- Evidence strength: source_linked
- Finding: release_recency=unknown。
- User impact: May increase setup, validation, or first-run risk for the user.
- Evidence: evidence.maintainer_signals | github_repo:1213956965 | https://github.com/JuliusBrussee/cavemem