@grantjs/server@1.19.0
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package's request behavior matches its stated purpose as a server authorization SDK: it sends caller-requested checks and associated request credentials to the configured Grant API. The manifest has no install lifecycle hook, and the environment-variable use only gates debug logging.
Decision evidence
public snapshot- The manifest describes a server authorization SDK and exports its runtime entry points.
- Authorization requests use the configured apiUrl and the package's /api/auth/is-authorized endpoint.
- A request token or cookie is forwarded with the authorization request when the caller supplies a request.
- The DEBUG_GRANT environment variable only enables debug logging when set to "1".
- The manifest's scripts are build, type-check, lint, and test commands; it declares no install lifecycle hook.
- The SDK sends request credentials to its configured API endpoint, so deployments should configure apiUrl for the intended Grant service.
- No install-time data collection, unrelated network endpoint, or file modification was identified.
Source & flagged code
5 flaggedThe manifest describes a server authorization SDK and exports its runtime entry points.
package.jsonView on unpkg · L1The manifest's scripts are build, type-check, lint, and test commands; it declares no install lifecycle hook.
package.jsonView on unpkg · L100Findings
Affected versions and remediation
This report applies to @grantjs/server@1.19.0.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.