@atlaskit/editor-plugin-limited-mode@27.0.7
LimitedMode plugin for @atlaskit/editor-core
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package performs runtime analytics reporting on editor performance and document size when an experiment is active. The reviewed source does not establish that this collection is disclosed to users or can be disabled, so it warrants a warning; it does not show secret or content theft.
Static reason
No blocking static signals were detected.
Trigger
The dynamic limited mode experiment is enabled and the editor meets the runtime latch criteria.
Impact
The analytics service receives operational data about editor performance and document size; the endpoint is supplied by the host API and is not specified here.
Mechanism
It measures input latency and long tasks, then sends latch reasons, performance counts, document node size, and device hints through the host editor analytics API.
AI rationale
The package performs runtime analytics reporting on editor performance and document size when an experiment is active. The reviewed source does not establish that this collection is disclosed to users or can be disabled, so it warrants a warning; it does not show secret or content theft.
Evidence
dist/cjs/pm-plugins/main.jsdist/cjs/pm-plugins/utils/latch-detector.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime latch policy is enabled when the `platform_editor_dynamic_limited_mode` experiment is active.
- When latch criteria are met, the plugin fires a `LIMITED_MODE_LATCHED` event through the editor analytics API.
- The event includes latency and freeze metrics, document node size, and device hardware hints.
- The plugin measures input latency during editor use when the policy is active.
Evidence against
- The manifest has no lifecycle scripts, and the package is an editor plugin.
- The reported values are operational performance metrics; the reviewed code does not include document contents or credentials in the event.
- No direct network endpoint or filesystem write appears in the reviewed plugin code.
Behavioral surface
UrlStrings
Source & flagged code
5 flaggeddist/cjs/pm-plugins/main.jsView file
68} else if ((0, _isExperimentEnabled.isExperimentEnabled)('platform_editor_dynamic_limited_mode')) {
var config = (0, _expVal.expVal)('platform_editor_dynamic_limited_mode', 'policyConf
Medium
Ai Review Evidence
The runtime latch policy is enabled when the `platform_editor_dynamic_limited_mode` experiment is active.
dist/cjs/pm-plugins/main.jsView on unpkg · L68119api === null || api === void 0 || (_api$analytics = api.analytics) === null || _api$analytics === void 0 || _api$analytics.actions.fireAnalyticsEvent({
action: _enums.ACTION.LIMITED_MODE_LATCHED,
Medium
Ai Review Evidence
When latch criteria are met, the plugin fires a `LIMITED_MODE_LATCHED` event through the editor analytics API.
dist/cjs/pm-plugins/main.jsView on unpkg · L119127requiredConfirmations: details.requiredConfirmations,
documentAlreadyBreached: details.documentAlreadyBreached,
msFromFirstWindow: details.msFromFirstWindow,
latencyMedianMs: deta
Medium
Findings
5 Medium1 Low
MediumAi Review Evidencedist/cjs/pm-plugins/main.js
MediumAi Review Evidencedist/cjs/pm-plugins/main.js
MediumAi Review Evidencedist/cjs/pm-plugins/main.js
MediumAi Review Evidencedist/cjs/pm-plugins/main.js
MediumAi Review Evidencedist/cjs/pm-plugins/utils/latch-detector.js
LowUrl Strings
Affected versions and remediation
This report applies to @atlaskit/editor-plugin-limited-mode@27.0.7.
See all versions of @atlaskit/editor-plugin-limited-mode for other recorded verdicts.
- Review the evidence and your use of @atlaskit/editor-plugin-limited-mode@27.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.