@grantjs/server@1.20.1
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s entry point only re-exports SDK functionality, and its authorization requests run when the application invokes a client method or middleware. The request-bound token is sent to the configured Grant API for permission checks; no unrelated credential collection or install-time behavior was found.
Decision evidence
public snapshot- The package exposes server-side authorization SDK entry points and declares build, lint, and test scripts, with no install lifecycle script.
- The main ESM entry point only imports and re-exports the Grant client and error types.
- The client sends a POST to /api/auth/is-authorized when an authorization check is called.
- Requests use the configured apiUrl; a token is extracted from the supplied request and forwarded as a Bearer token.
Source & flagged code
5 flaggedThe package exposes server-side authorization SDK entry points and declares build, lint, and test scripts, with no install lifecycle script.
package.jsonView on unpkg · L1The package exposes server-side authorization SDK entry points and declares build, lint, and test scripts, with no install lifecycle script.
package.jsonView on unpkg · L100Findings
Affected versions and remediation
This report applies to @grantjs/server@1.20.1.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.