@open-mercato/onboarding
Tenant onboarding and first-run experience for Open Mercato.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Test file snapshotting process.env for restoration, not exfiltration. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Loopback IP used in a URL-resolution unit test, not a network call. | ai | |
| provenance | missing-githead | AI (provenance): SLSA provenance attestation compensates; package has clean history and no other risk signals. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo component; missing repo/keywords/non-trivial main is expected for this scoped package family. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.6.6 | 0 / 5 | |
| 0.6.5 | 0 / 4 | |
| 0.6.4 | 0 / 4 | |
| 0.6.3 | 0 / 4 | |
| 0.6.2 | 0 / 4 | |
| 0.6.1 | 0 / 4 | |
| 0.6.0 | 0 / 4 | |
| 0.5.0 | 0 / 4 | |
| 0.4.10 | 0 / 4 | |
| 0.4.9 | 0 / 4 | |
| 0.4.8 | 0 / 4 | |
| 0.4.7 | 0 / 4 | |
| 0.4.6 | 1 / 3 | |
| 0.4.5 | 1 / 3 |
v0.6.6
3 findingsSpreading entire process.env into an object — may capture all secrets 54 | 55 | describe('sendWorkspaceReadyEmail', () => { > 56 | const originalEnv = { ...process.env } 57 | 58 | beforeEach(() => {
HTTP request to raw IP address — legitimate packages use domain names 37 | it('accepts equivalent loopback hostnames on the same port', () => { 38 | const result = resolveVerifyRedirectBaseUrl( > 39 | buildRequest('http://127.0.0.1:3001/api/onboarding/onboarding/verify?token=t'), 40 | { 41 | APP_URL: 'http://localhost:3001',
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.