@grantjs/server@1.18.11
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s behavior matches its stated server authorization SDK purpose. The flagged environment access is an opt-in debug switch, and the client’s credentials and permission data are used in requests to the consumer-configured API.
Decision evidence
public snapshot- The package describes itself as a server authorization SDK, and its manifest declares no install lifecycle scripts.
- The main entry point only exports the client, token extraction helpers, and error classes; it performs no import-time requests.
- The client posts permission checks to /api/auth/is-authorized using the consumer-configured apiUrl.
- Request credentials are attached only when a request is supplied to the client, and the debug environment variable gates local console logging.
Source & flagged code
7 flaggedThe package describes itself as a server authorization SDK, and its manifest declares no install lifecycle scripts.
package.jsonView on unpkg · L1The package describes itself as a server authorization SDK, and its manifest declares no install lifecycle scripts.
package.jsonView on unpkg · L100Findings
Affected versions and remediation
This report applies to @grantjs/server@1.18.11.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.18.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.