@simon-says-build/demo-player@0.8.1
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe entry point only re-exports library code, and the manifest declares no install hooks. Network calls are scoped to the configured demo API and token; account actions such as approving changes or releasing them require an explicit button press.
Decision evidence
public snapshot- The manifest has no install lifecycle hooks, and index.js only re-exports the player and helpers.
- API requests use the configured demo API URL and the demo token supplied to the player.
- Approval and release calls are wired to explicit review-card button handlers.
Source & flagged code
4 flaggedThe manifest has no install lifecycle hooks, and index.js only re-exports the player and helpers.
index.jsView on unpkg · L1The manifest has no install lifecycle hooks, and index.js only re-exports the player and helpers.
package.jsonView on unpkg · L23Findings
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.8.1.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.