Hartmut f8550110eb security: fix 4 OWASP quick-wins from audit round 2 ...

A04-1 (High): docker-compose E2E_TEST_MODE now defaults to "false"
  via ${E2E_TEST_MODE:-false} — prevents accidental security bypass in
  non-test deployments. runtime-env.ts throws at startup if
  E2E_TEST_MODE=true in production.

A05-3 (Medium): all 4 cron routes now fail-closed when CRON_SECRET
  is unset. Extracted shared verifyCronSecret() helper to
  apps/web/src/lib/cron-auth.ts.

A02-1 (Low): verifyCronSecret uses crypto.timingSafeEqual for
  constant-time Bearer token comparison.

A10-1 (Medium): Slack webhook routing uses strict hostname check
  (parsedUrl.hostname === "hooks.slack.com") instead of .includes()
  to prevent bypass via subdomain confusion.

Tickets created for remaining findings: #28 (TOTP rate limit),
#29 (allocations role check), #30 (API keys in DB), #31 (pgAdmin
creds), #32 (MFA enforcement), #33 (auth anomaly alerting),
#34 (comment server-side sanitization).

Co-Authored-By: claude-flow <ruv@ruv.net>

2026-04-01 22:57:51 +02:00

..

anonymization.ts

refactor(runtime): prefer env-backed secrets at runtime

2026-03-30 19:17:32 +02:00

audit.ts

feat(platform): harden access scoping and delivery baseline

2026-03-30 00:27:31 +02:00

auto-staffing.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

budget-alerts.ts

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

cache.ts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

chargeability-alerts.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

comment-entity-registry.ts

fix(comment): align mention audience with entity visibility

2026-03-30 18:50:36 +02:00

content-filter.ts

feat: additive security improvements — prompt guard, content filter, data classification

2026-03-27 16:23:33 +01:00

create-notification.ts

refactor: deduplicate modals, notifications, confirms, comboboxes, proficiency

2026-03-22 21:50:39 +01:00

email.ts

refactor(runtime): prefer env-backed secrets at runtime

2026-03-30 19:17:32 +02:00

estimate-reminders.ts

refactor: deduplicate modals, notifications, confirms, comboboxes, proficiency

2026-03-22 21:50:39 +01:00

format-utils.ts

refactor: consolidate duplicated code across web and API packages

2026-03-19 00:10:08 +01:00

holiday-auto-import.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

holiday-availability.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

image-validation.ts

feat: ACN Application Security Standard V7.30 compliance (19/23 items)

2026-03-27 14:16:39 +01:00

logger.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

notification-targeting.ts

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

prompt-guard.ts

feat: additive security improvements — prompt guard, content filter, data classification

2026-03-27 16:23:33 +01:00

rate-card-lookup.ts

feat: Sprint 3 — automation, intelligence, skill marketplace

2026-03-19 21:39:05 +01:00

reminder-scheduler.ts

fix(api): harden reminder and webhook delivery

2026-03-31 22:36:53 +02:00

resource-access.ts

test(api): cover shared resource access rules

2026-03-31 22:38:02 +02:00

resource-capacity.ts

chore(repo): checkpoint current capakraken implementation state

2026-03-29 12:47:12 +02:00

resource-holiday-context.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

slack-notify.ts

feat: Sprint 5 — AI insights, webhooks/Slack, PWA, performance monitoring

2026-03-20 06:57:20 +01:00

ssrf-guard.ts

security: close audit findings #19–#23 and harden Docker setup (#24)

2026-04-01 18:19:21 +02:00

system-settings-runtime.ts

refactor(settings): adopt environment-only runtime secret flow

2026-03-30 19:55:06 +02:00

task-actions.ts

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

vacation-conflicts.ts

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

vacation-day-count.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

vacation-deduction-snapshot.ts

feat(api): explain holiday-aware vacation deductions

2026-03-31 22:42:00 +02:00

webhook-dispatcher.ts

security: fix 4 OWASP quick-wins from audit round 2

2026-04-01 22:57:51 +02:00