@egosbr/guard-brasil@0.3.0
Brazilian AI safety layer — PII masking, ATRiAN ethical validation, and traceable evidence discipline for AI assistants
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source enables runtime telemetry by default and sends content-derived hashes and PII metadata on every inspection, without documenting that behavior in the README. The endpoint is consumer-configured and the source does not send the original text, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- Telemetry is enabled by default in GuardBrasil configuration.
- Each inspect() call records an event unless telemetry is explicitly disabled.
- Events include an input hash, tenant ID, PII categories, and finding count.
- The recorder inserts events into a Supabase table using a URL and key read from environment variables.
- The event builder records a hash and PII metadata rather than the original text.
- The telemetry endpoint is configured through the consumer's Supabase environment variables.
- The only lifecycle script is prepublishOnly, which runs the package build.
Source & flagged code
6 flaggedSource appears to send environment or credential material to an external endpoint.
dist/keys.jsView on unpkg · L16A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/pii-patterns.js#virtual:normalized:round1View on unpkgFindings
Affected versions and remediation
This report applies to @egosbr/guard-brasil@0.3.0.
See all versions of @egosbr/guard-brasil for other recorded verdicts.
- Review the evidence and your use of @egosbr/guard-brasil@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.