@schemavaults/auth-react-provider
React hooks and components to make using the @schemavaults/auth-client-sdk a breeze
This report shows the evidence for @schemavaults/auth-react-provider@0.19.6. 0 of 29 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe package delegates default-on runtime error reporting to its auth SDK, which can transmit error and contextual details to the configured service. This is a telemetry risk, not evidence of credential theft or unrelated collection.
Decision evidence
public snapshot- The provider sets disable_telemetry only when the caller explicitly passes true, so reporting is enabled by default.
- The auth client’s error reporter can send error name, message, stack, operation, page URL path, user ID, and optional context to its configured auth server.
- The reporter sends reports to /api/client-errors/{client_app_id} and omits browser credentials.
- The package manifest has no install, preinstall, or postinstall hook.
- The package entry point only re-exports the provider, hooks, and auth SDK symbols.
- The browser adapter’s network requests support the package’s authentication and session features.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/lib/react-auth-client-adapter.js#virtual:normalized:round1View on unpkgThe provider sets disable_telemetry only when the caller explicitly passes true, so reporting is enabled by default.
dist/auth-provider/core-schemavaults-auth-client-provider.jsView on unpkg · L58Findings
Affected versions and remediation
This report applies to @schemavaults/auth-react-provider@0.19.6.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @schemavaults/auth-react-provider@0.19.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.