@columenlabs/lumen-ui@0.1.157
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is primarily a UI library and has no install-time behavior, but its error boundary automatically posts error details and the current URL query string to the app server. The visible logging notice limits the concern, though the lack of an apparent opt-out and possible query-string exposure warrant a warning.
Decision evidence
public snapshot- LumenBoundary automatically calls reportError when a component throws.
- reportError includes the error message, stack, and current path plus query string in its payload.
- The payload is sent to the same-origin /api/client-error endpoint without a visible opt-out.
- The error screen tells users that errors are logged, which provides some disclosure.
- The manifest describes a shared React UI package and has no install lifecycle scripts.
- The separate Web Vitals telemetry is activated through an explicit useLumenTelemetry hook and describes the data it sends.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgLumenBoundary automatically calls reportError when a component throws.
dist/lumen-boundary.jsView on unpkg · L4Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.157.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.157 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.