@vibes.diy/api-svc@14.3.260
WebSocket-based API for vibes.diy chat persistence and app deployment. Supports both HTTP POST and WebSocket connections using the same handler via the Evento event-driven framework.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged avatar script is an explicitly invoked backfill with a dry-run default and an explicit --apply write mode. The embedding code sends its selected text and backend key to the configured LLM backend, while the alarm’s GitHub token is used for GitHub API calls rather than sent to PostHog.
Decision evidence
public snapshot- The manifest sets index.js as the main entry and declares no install lifecycle scripts.
- The avatar backfill runs as a command, uses the official vibes.diy asset host by default, and requires --apply for writes; otherwise it reports a dry run.
- The embedding request sends text and the backend API key to the URL supplied as the configured LLM backend.
- The alarm reads GitHub credentials only when run and uses a --write flag for issue changes; its GitHub token is sent to api.github.com, not PostHog.
Source & flagged code
5 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
usage-report/backfill-avatars.jsView on unpkg · L1The avatar backfill runs as a command, uses the official vibes.diy asset host by default, and requires --apply for writes; otherwise it reports a dry run.
Findings
Affected versions and remediation
This report applies to @vibes.diy/api-svc@14.3.260.
See all versions of @vibes.diy/api-svc for other recorded verdicts.
- Review the evidence and your use of @vibes.diy/api-svc@14.3.260 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.