igrantio-issuer-backend
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates secure credential handling by resolving tenant API keys from environment variables on the server-side, ensuring they are never exposed to the frontend.
- [SAFE]: Implements HMAC signature verification (X-iGrant-Signature) for all incoming webhooks using constant-time comparison to prevent timing attacks and unauthorized data injection.
- [SAFE]: The reverse proxy implementation in
proxy.tsutilizes an allow-list (ISSUER_PERMITTED_PREFIXES) to restrict access to specific iGrant.io OWS endpoints, adhering to the principle of least privilege. - [SAFE]: Dependencies listed in
package.jsonare standard, well-known libraries (Express, Cors, Dotenv, TSX) with no evidence of suspicious or typosquatted packages. - [SAFE]: The Dockerfile uses a stable official Node.js alpine image and performs standard installation and startup procedures without acquiring elevated privileges.
Audit Metadata