swadhin / opencodehub public
/ opencodehub / doc / production_security_audit_2026-02-15.md
swadhinbiswas feat: OpenCodeHub v1.1.0 - Enterprise Features & Storage Adapters · 2/15/2026
719a1cb
83 lines · 5.0 KB
Raw Download

Production Security Audit

Date: 2026-02-15
Repository: OpenCodeHub
Scope: src/, cli/, API routes, auth flow, secrets handling, and dependency audit attempt.

Executive Summary

Critical security issues were present and have been patched in this pass:

  • Removed hardcoded JWT fallback secret and made JWT_SECRET mandatory.
  • Enforced admin access on previously exposed admin dashboard and admin stats endpoint.
  • Enforced admin access on realtime connection stats endpoint.
  • Secured internal git hook endpoints by requiring INTERNAL_HOOK_SECRET and rejecting unauthenticated calls.
  • Removed insecure fallback for cron auth (CRON_SECRET) and fail-closed on missing config.
  • Removed fixed runner fallback secret and switched to required production secret + ephemeral dev secret.
  • Prevented API key leakage in /api/user/ai-config GET responses (masked metadata only).
  • Added encryption-at-rest for user AI provider API keys.
  • Removed auth callback localhost fallbacks in production-sensitive redirect paths.
  • Added regression unit tests for secret handling and strict site URL behavior.

Fixed Findings

Severity Finding Status Evidence
Critical Hardcoded JWT fallback secret Fixed src/lib/auth.ts
Critical Admin dashboard route lacked auth guard Fixed src/pages/admin/index.astro
High /api/admin/stats did not enforce admin auth Fixed src/pages/api/admin/stats.ts
High /api/realtime/events stats endpoint exposed to any logged-in user Fixed src/pages/api/realtime/events.ts
Critical /api/internal/hooks/pre-receive had no shared-secret auth Fixed src/pages/api/internal/hooks/pre-receive.ts
High /api/internal/hooks/post-receive accepted weak default secret fallback Fixed src/pages/api/internal/hooks/post-receive.ts
High Cron GC endpoint accepted weak default secret fallback Fixed src/pages/api/cron/gc.ts
High Git hook installer embedded weak fallback secret Fixed src/lib/git.ts
Medium Runner auth used fixed fallback secret in dev path Fixed src/lib/runner-auth.ts
Medium Env validation did not require CRON_SECRET/RUNNER_SECRET Fixed src/lib/env-validation.ts
High /api/user/ai-config could return raw API keys Fixed src/pages/api/user/ai-config.ts
High AI provider API keys were stored as plain text JSON Fixed src/lib/ai-config.ts, src/pages/api/user/ai-config.ts
Medium Auth callback routes used localhost fallback when SITE_URL missing Fixed src/pages/api/auth/github/callback.ts, src/pages/api/auth/sso/callback.ts, src/pages/api/auth/sso/[provider].ts, src/lib/site-url.ts
Medium Missing regression tests for new secret/auth controls Fixed tests/unit/ai-config.test.ts, tests/unit/site-url.test.ts, tests/unit/runner-auth.test.ts

Remaining Risks (Not Fully Resolved)

Severity Risk Evidence Recommendation
Medium CDN-hosted scripts are used directly (supply-chain risk) e.g. Monaco/Alpine CDN script includes in pages Pin versions with SRI hashes or self-host critical assets.
Medium Production readiness currently blocked by pre-existing lint/type issues unrelated to this patch npm run lint output (many existing errors) Clean type/lint baseline and enforce CI gates before release.
Medium Security test suite currently failing from test setup/schema issues tests/security.test.ts (db.execute is not a function) Repair test harness and add regression tests for newly fixed auth/secret controls.

Dependency Vulnerability Scan

Dependency vulnerability audit could not be completed due network resolution failure:

  • npm audit --omit=dev --json failed with getaddrinfo EAI_AGAIN registry.npmjs.org.

Action required when network is available:

  1. Run npm audit --omit=dev in repo root.
  2. Run npm audit --omit=dev in cli/.
  3. Triage and patch high/critical advisories first.

Validation Notes

Checks performed in this pass:

  • Static grep scan for hardcoded secrets/defaults and auth bypass patterns.
  • Manual review of critical auth, admin, internal hook, and cron endpoints.
  • Attempted test/lint verification (npm run test -- tests/security.test.ts, npm run lint).
  • Added and executed focused regression tests for this hardening set:
    • tests/unit/ai-config.test.ts
    • tests/unit/site-url.test.ts
    • tests/unit/runner-auth.test.ts

Limitations:

  • Full dependency CVE scan blocked by offline registry access.
  • Existing repository-wide type/lint failures prevent clean full-build security validation.

Next Production Hardening Steps

  1. Expand encrypted-at-rest handling to additional sensitive config domains (beyond AI keys).
  2. Repair security tests and add broader regression coverage for:
    • admin route/API authorization
    • internal hook secret verification
    • cron secret verification
    • secret redaction in config APIs
  3. Re-run dependency CVE audits and patch high/critical packages.
  4. Add CI security gates (lint/typecheck/tests + secret scan + audit threshold).