Skip to main content

​
Known limitations

Nothing on this page is a workaround for something broken in the product. The three defects that used to be listed here — the CLI not being on npm, the hosted API not being deployed, and session start exiting 1 when the API was unreachable — are all fixed. The last one is covered by apps/cli/test/offline-resilience.test.mjs, which asserts that a linked device with a failing API still produces the local report an unlinked device gets, and names the reason. What remains are limits rather than defects, and each is stated in every report’s coverage notes:

​
Installation

npm’s global bin directory is not on your PATH. Either add it, or skip the global install entirely:
Never use sudo npm install -g. If the global install itself failed with EACCES, npm’s directory is not writable — use npx, or a Node version manager.
A shell alias is not visible to a subprocess, so an agent that shells out will not see it. This only comes up with a source build; the npm install puts a real executable on PATH. Use a shim instead of an alias:
Only relevant to a source checkout. Run pnpm install && pnpm build from the repository root — the bundle is produced by the CLI package’s build step, not by pnpm install.
Claude Code derives the slash command from the installed directory name, so the bundle must be at ~/.claude/skills/myrqen/ or <repo>/.claude/skills/myrqen/.
A missing convenience integration does not mean the scanner is broken — myrqen auto works from any agent with shell access.

​
Running a scan

That is the honest outcome when the application was not running, or when no agent settled the static pass’s candidates. Static reading cannot observe a response.Start the application, then have the agent verify or refute each candidate:
See Findings.
The output names the reason. The usual causes:
  • an extra top-level field, including id — the schema is additionalProperties: false and the CLI assigns ids;
  • a secret value that survived redaction;
  • no evidence entries;
  • a length or enum constraint from the schema.
Fix it and resubmit.
A resubmission merges as corroboration only when the summary matches the original word for word. To confirm an existing candidate, use finding verify — never a resubmission.
The origin is quarantined. It appeared only in project content that also tried to instruct the scanner, and a human approving a target that injected text authored is not meaningful consent.If the origin is genuinely part of the project, put it in the project’s configuration. A new session will pick it up as an ordinary candidate. Do not work around the quarantine.
Working as designed. Choose a non-destructive validation that demonstrates the same property, or record the finding as strong_evidence and explain in the report why safe validation was not possible. See Authorization and safety.
All three of logout, workspace --set, and workspace --detach are confirmation-gated, and confirmations default to deny in a non-interactive shell — which is what an agent gives them. They print “Left unchanged”. Run them in a real terminal.
Not a problem. Docker is optional and is never a user-facing prerequisite. Myrqen reports reduced coverage — “Isolated runtime checks are unavailable on this machine; other checks still run” — and carries on. Force that behaviour with MYRQEN_ASSUME_NO_ISOLATION=1.

​
Linking and accounts

The credential was revoked in the app. Run myrqen login again.
Use a recovery code at /recover, together with a new password. Ten codes are shown once at signup and that is the only recovery path — no email is ever sent.
There is no other recovery path. Local scanning and local reports are unaffected, since neither needs an account.
Being first does not make you an administrator. The role is granted only to the address in PLATFORM_ADMIN_EMAIL, and only at signup: apps/web/lib/auth-service.ts computes isPlatformAdmin = configuredPlatformAdminEmail() === email and nothing else ever sets it. With the variable unset, the deployment has no administrator at all.So: set PLATFORM_ADMIN_EMAIL before signing up, then create that account. An account that already exists is not promoted by setting the variable afterwards.Some copy elsewhere in the repository says the first account in a fresh deployment becomes the platform administrator. That is not what the code does.

​
Syncing and sharing

It does not ask a question that cannot succeed. One of these is true:
  • the device is not linked;
  • the repository is not bound to a workspace;
  • the plan’s cloud-report quota is exhausted (quota_blocked);
  • --sync no was passed;
  • the shell is non-interactive, in which case cloud.state is decision_required and the agent is expected to ask you, then run myrqen session sync-decision yes|no.
myrqen status shows which.
The scan still runs and still writes a full local report. Quota windows are UTC-anchored: the day resets at 06:00 UTC, the week at Monday 06:00 UTC. details carries resetsAt, and myrqen status prints the exact instants.After the reset:
The report passed its retention window, so its body and stored object were deleted and its share links stopped working. Retention is 21 days on free, 180 on pro, 365 on team.Your local files under .myrqen/reports/ are untouched — reopen the HTML.
Plaintext slugs are not stored, only a hash, so an existing link cannot be re-listed. Create a new share and copy the URL this time.
Check the principal rules. A viewer with no matching rule gets the share’s default policy, and if that policy allows no findings they see a report with no findings. The dashboard’s share panel previews exactly what each recipient receives before you create the link.

​
Self-hosting

Copy .env.example to .env at the repository root and set it. In production the root .env is deliberately not loaded, so the variable must be a real environment variable.
Required under NODE_ENV=production. Share links and session-cookie security are both derived from it, so a localhost fallback would hand out links nobody can open and cookies without Secure.
The filesystem driver is refused under NODE_ENV=production, because report bodies would live on one container’s disk — lost on the next deploy and invisible to other replicas. Set OBJECT_STORAGE_DRIVER=s3, or OBJECT_STORAGE_ALLOW_EPHEMERAL=true for a throwaway production-mode run.
Move the old key to REPORT_ENCRYPTION_KEY_PREVIOUS, which accepts retired keys for reads. Without that, nothing encrypted under the old key can be decrypted.
The response names every dependency it probed — database, event bus, object storage, encryption keyring — with a detail for the failing one. Gate traffic on ready and container restarts on health, never the reverse.
TRUSTED_PROXY_HOPS is unset, so there is no trustworthy client address and every request shares one bucket. Set it to the number of proxies in front of the app — Railway and most single-proxy platforms need 1.Separately, without REDIS_URL counters are process-local, so N replicas allow N times each limit.
All four of POLAR_ACCESS_TOKEN, POLAR_ENVIRONMENT, POLAR_WEBHOOK_SECRET, and POLAR_PRODUCTS are required together. A half-configured payment path takes money and grants nothing, so it is refused outright.
Most often the demonstration patch is still applied. Revert it and restart the fixture:

​
Getting more detail

doctor reports capability, not alarm: info is a missing convenience, and attention is reserved for something that actually blocks the product.