@ever-gauzy/plugin-integration-plane-api@0.1.12
Ever Gauzy Plane Integration - A Proxy connecting Plane frontend to Ever Gauzy APIs
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe default instance configuration enables telemetry, and its endpoint returns that setting to clients without a visible opt-out in the package. The source does not show telemetry events or a fixed collector, so the evidence supports a warning rather than a malicious verdict.
Decision evidence
public snapshot- The default instance configuration sets `is_telemetry_enabled` to true without a visible opt-out in that configuration.
- An instance endpoint returns that default configuration, so a client requesting it receives the telemetry-enabled setting.
- API calls use the configured Gauzy API base URL and attach the request token; no unrelated fixed collector appears in the inspected path.
- The package is a Plane-to-Gauzy proxy, and its network requests forward API traffic to a configurable Gauzy API host.
- Mounting the proxy requires the consumer to call `mountPlaneProxy`; the package manifest has no install lifecycle scripts.
- PostHog key and host are consumer-configurable, and the inspected package code does not show analytics events being sent.
Source & flagged code
3 flaggedThe default instance configuration sets `is_telemetry_enabled` to true without a visible opt-out in that configuration.
dist/modules/instances/instances.service.jsView on unpkg · L65An instance endpoint returns that default configuration, so a client requesting it receives the telemetry-enabled setting.
dist/modules/instances/instances.controller.jsFindings
Affected versions and remediation
This report applies to @ever-gauzy/plugin-integration-plane-api@0.1.12.
See all versions of @ever-gauzy/plugin-integration-plane-api for other recorded verdicts.
- Review the evidence and your use of @ever-gauzy/plugin-integration-plane-api@0.1.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.