@columenlabs/lumen-ui@0.1.179
Lumen: shared React components (frame, views, widgets, charts, drawers).
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s automatic error reporting sends unfiltered error details and the full page query string to its application server. That is a plausible diagnostic feature, but the payload may contain sensitive data and has no opt-out, so it warrants a warning.
Decision evidence
public snapshot- The UI error boundary reports caught errors automatically, including errors it displays or handles during a reload.
- Failed API requests can also invoke error reporting automatically; network error messages include the request URL.
- Error reports include the error message, stack and current page path with its query string, then POST them to /api/client-error.
- The source says these reports are written to the app Worker’s logs, but the report payload can include unfiltered query parameters or error details.
- The error endpoint is a relative, first-party application path, not an unrelated collector.
- Error reporting serves the UI’s diagnostics, and message and stack fields are length-limited.
- The separate useLumenTelemetry hook is explicitly mounted by an app and reports route templates, error classes and stack hashes.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assistant/lumen-assistant.js#virtual:normalized:round1View on unpkgThe UI error boundary reports caught errors automatically, including errors it displays or handles during a reload.
dist/lumen-boundary.jsView on unpkg · L4Findings
Affected versions and remediation
This report applies to @columenlabs/lumen-ui@0.1.179.
See all versions of @columenlabs/lumen-ui for other recorded verdicts.
- Review the evidence and your use of @columenlabs/lumen-ui@0.1.179 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.