Acceptance criteria met. pnpm audit --audit-level=moderate on main:
1 vulnerabilities found
Severity: 1 moderate
Resolved upgrades (main commit 534945f):
dompurify→ 3.3.4+…
Resolved across two commits, covering both the stdout logger and the DB audit path.
Layer A — pino stdout redact (main commit 534945f, verified at packages/api/src/lib/logger.ts:8-40):
Reda…
Part 1 — TOTP replay race — resolved in commit 3222bec (security: atomic compare-and-swap for TOTP replay window).
- New helper
packages/api/src/lib/totp-consume.ts::consumeTotpWindow()…
*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
Resolved in commit c0c5f76 (security: bound JSONB inputs + whitelist batchUpdateCustomFields keys). Resource.dynamicFields merge now goes through a whitelist of known keys; attacker-controlled…
Resolved in commit 4ff7bc9 (security: SSRF guard covers IPv6 + DNS-rebind defence via pinned IP).
SSRF-guard (packages/api/src/lib/ssrf-guard.ts) — blocks full IPv4 private space…
/api/* — new routes inherit public access
Resolved in commit b32160d (security: default-deny /api middleware allowlist). The web app middleware now allowlists known public /api/* routes; new routes default to auth-required.
/api/* — new routes inherit public access
*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
Resolved in commit d1075af (security: tighten CSP — drop provider wildcards, add object/frame/worker-src).
apps/web/src/middleware.ts::buildCsp() now returns:
connect-src 'self'(was…
Resolved in commit 0303063 (security: constant-time authorize + uniform audit summaries). Authorize path now runs Argon2 verify against a dummy hash when the user is missing, and audit summaries…
Resolved in commit d45cc00 (security: cookie + session hardening). Secure flag enforced in prod, concurrent-session cap implemented, JTI no longer surfaced in responses.
Resolved in commit 93a7fba (security: fail-fast dev-bypass flag in production). The auth bootstrap throws at startup if E2E_TEST_MODE=1 is set while NODE_ENV=production.