@columenlabs/lumen-ui@0.1.161
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically reports runtime errors with raw messages, stack traces, and URL query parameters, despite describing its telemetry as excluding those details. This is undisclosed telemetry with a plausible risk of exposing sensitive application data, so it warrants a warning rather than a publish block.
Decision evidence
public snapshot- On reported errors, the package sends the error message, stack, and current path including query parameters to `/api/client-error`.
- The report path is used for API failures and React boundary errors, so reporting can happen during normal app use.
- The separate `/api/t` telemetry is started when an app mounts `useLumenTelemetry`; it is first-party and documents route and error-class data.
- The package has no lifecycle scripts, and query-cache persistence is only enabled when the caller supplies `persist`.
- The package is a React component library with ordinary component and client exports.
- Error reports are sent to a same-origin endpoint, not a hard-coded external collector.
- The `/api/t` telemetry implementation documents its app-mount trigger and limits its event fields.
- The query cache uses browser local storage and persistence requires an explicit option.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgOn reported errors, the package sends the error message, stack, and current path including query parameters to `/api/client-error`.
dist/route-error.jsView on unpkg · L172Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.161.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.161 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.