better-auth

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEOBFUSCATION
Full Analysis
  • [COMMAND_EXECUTION]: The initialization script scripts/better_auth_init.py performs local file system operations to assist in project setup.
  • The script writes generated TypeScript configuration to auth.ts and environment variable templates to .env.
  • It includes logic to back up existing .env files to .env.backup before overwriting them.
  • These operations are transparent and restricted to the project directory structure as intended for a configuration utility.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates and promotes secure practices for handling sensitive authentication data.
  • The instructions and documentation correctly guide users to store secrets, such as BETTER_AUTH_SECRET and OAuth provider credentials, in environment variables rather than hardcoding them in source files.
  • The better_auth_init.py script utilizes the cryptographically secure secrets module to generate unique secrets for new installations.
  • [OBFUSCATION]: The scripts/ directory contains binary files (.coverage).
  • These files are standard SQLite-formatted databases created by Python's coverage measurement tools during testing.
  • Analysis of the embedded metadata and table schemas (e.g., tracer, arc, line_bits) confirms they are legitimate test artifacts and do not contain hidden malicious logic or obfuscated commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 04:34 AM