@canonry/canonry@7.61.2
⚠ Under reviewSelf-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe inspected TypeSafe flow sends the configured TypeSafe classifier key to its matching service endpoint and rejects redirects, which does not establish credential theft. The flagged browser credential and other high-severity paths remain unresolved, so the source review is incomplete.
Decision evidence
public snapshot- The manifest exposes CLI and library entrypoints and contains no install lifecycle hook.
- The fixed TypeSafe endpoint receives a key passed to the TypeSafe classifier; the request rejects redirects.
- The inspected runtime subscriptions monitor tool limits and assistant turn completion.
- The flagged password-related code validates a password and normalizes a user name.
- The required high-severity finding paths were not all reviewed, so the browser credential and other flagged behaviors remain unresolved.
Source & flagged code
8 flaggedPackage source references child process execution.
dist/google-D4O4JCM4.jsView on unpkg · L89Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
Affected versions and remediation
This report applies to @canonry/canonry@7.61.2.
See all versions of @canonry/canonry for other recorded verdicts.
- Review the evidence and your use of @canonry/canonry@7.61.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.