@sphoro/bugcatch-web-sdk@0.17.0
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall metadata contains only a publish-time vite build, and runtime fetches target the integrator-configured BugCatch API for bug reports and status. Session and watch tokens stay on that same API path and are not sent to a hidden recipient.
Decision evidence
public snapshot- package.json has only vite build scripts and no install lifecycle hooks or runtime dependencies.
- The published bundle posts bug reports to the caller-configured apiBase ingest route with the project API key.
- Watch tokens are stored in localStorage under a project-scoped key and used only for that project's watch API.
- Reference-field lookup fetches the configured apiBase and returns an empty policy when the request fails.
Source & flagged code
7 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.umd.jsView on unpkg · L1The published bundle posts bug reports to the caller-configured apiBase ingest route with the project API key.
dist/bugcatch.umd.jsView on unpkg · L1432Findings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.17.0.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.