better-auth
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEOBFUSCATION
Full Analysis
- [COMMAND_EXECUTION]: The initialization script
scripts/better_auth_init.pyperforms local file system operations to assist in project setup. - The script writes generated TypeScript configuration to
auth.tsand environment variable templates to.env. - It includes logic to back up existing
.envfiles to.env.backupbefore overwriting them. - These operations are transparent and restricted to the project directory structure as intended for a configuration utility.
- [CREDENTIALS_UNSAFE]: The skill demonstrates and promotes secure practices for handling sensitive authentication data.
- The instructions and documentation correctly guide users to store secrets, such as
BETTER_AUTH_SECRETand OAuth provider credentials, in environment variables rather than hardcoding them in source files. - The
better_auth_init.pyscript utilizes the cryptographically securesecretsmodule to generate unique secrets for new installations. - [OBFUSCATION]: The
scripts/directory contains binary files (.coverage). - These files are standard SQLite-formatted databases created by Python's coverage measurement tools during testing.
- Analysis of the embedded metadata and table schemas (e.g.,
tracer,arc,line_bits) confirms they are legitimate test artifacts and do not contain hidden malicious logic or obfuscated commands.
Audit Metadata