@saasmakers/ui@2.2.38
Reusable Nuxt UI components for SaaS Makers projects
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Nuxt layer enables runtime analytics and outbound-link tracking by default, without an inspected disclosure or opt-out. This is undisclosed runtime telemetry, so it warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
When a consuming Nuxt app uses this configuration and runs its site.
Impact
Runtime pageview and outbound-link activity may be reported without an explicit opt-in or disclosure in the inspected package source.
Mechanism
Plausible analytics and automatic outbound-link tracking are configured to use plausible.saasmakers.dev; PostHog pageview capture is conditional on production mode and a public key.
AI rationale
The Nuxt layer enables runtime analytics and outbound-link tracking by default, without an inspected disclosure or opt-out. This is undisclosed runtime telemetry, so it warrants a warning rather than a malicious verdict.
Evidence
nuxt.config.ts
Network endpoints3
plausible.saasmakers.deveu.i.posthog.comeu.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Nuxt configuration enables Plausible analytics by default, with automatic outbound-link tracking to plausible.saasmakers.dev.
- PostHog pageview capture is configured when production mode and NUXT_PUBLIC_POSTHOG_KEY are present.
Evidence against
- The package describes itself as reusable Nuxt UI components for SaaS Makers projects.
- Its npm scripts are lint and typecheck; no install lifecycle scripts are declared.
Behavioral surface
EnvironmentVars
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedapp/utils/notesField.ts#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
app/utils/notesField.ts#virtual:normalized:round1View on unpkgnuxt.config.tsView file
147plausible: {
apiHost: 'https://plausible.saasmakers.dev',
autoOutboundTracking: true,
ignoreSubDomains: true,
proxy: true,
},
robots: { credits: false },
sourc
Medium
Ai Review Evidence
The Nuxt configuration enables Plausible analytics by default, with automatic outbound-link tracking to plausible.saasmakers.dev.
nuxt.config.tsView on unpkg · L147129...(isPostHogEnabled
? {
posthogConfig: {
clientConfig: {
capture_pageview: true,
defaults: '2026-01-30',
disable_session_recording: false,
opt_out_capturing_by_default: false,
person_profiles: 'identified_only',
Findings
1 High4 Medium3 Low
HighSemantic Analysis Limitedapp/utils/notesField.ts#virtual:normalized:round1
MediumEnvironment Vars
MediumAi Review Evidencenuxt.config.ts
MediumAi Review Evidencenuxt.config.ts
MediumAi Review Evidencepackage.json
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @saasmakers/ui@2.2.38.
See all versions of @saasmakers/ui for other recorded verdicts.
- Review the evidence and your use of @saasmakers/ui@2.2.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.