@faable/auth-js@2.20.0
<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected entry points and network paths match the package’s authentication purpose: the Next.js integration uses a configured issuer, and the main client sends tokens with caller-invoked requests. The routing hints are consistent with ordinary configuration, URL, and auth code patterns.
Decision evidence
public snapshot- The package entry point is the auth client bundle and its runtime dependency is jose; Next.js support is an optional export.
- The Next.js integration reads auth settings from constructor options or matching FAABLE_AUTH_* environment variables and derives its issuer from the configured domain.
- The callback exchanges an authorization code and client credentials with that configured issuer as part of the OAuth flow.
- The main client makes HTTP requests through its configured fetch and attaches a bearer token only when supplied in request options.
Source & flagged code
4 flaggedThe package entry point is the auth client bundle and its runtime dependency is jose; Next.js support is an optional export.
package.jsonView on unpkg · L2The callback exchanges an authorization code and client credentials with that configured issuer as part of the OAuth flow.
dist/nextjs.jsView on unpkg · L6Findings
Affected versions and remediation
This report applies to @faable/auth-js@2.20.0.
See all versions of @faable/auth-js for other recorded verdicts.
- Review the evidence and your use of @faable/auth-js@2.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.