Development

[jordanlambrecht]

Closes #118

[github-actions]

Knip Code Analysis

Found 9 total issues

Category	Count
Unused Dependencies	1
Unused Dev Dependencies	4
Unused Exports	4

View details

Run pnpm knip locally to see the full report.

Use pnpm knip:filter pattern to filter results by file path.

---

Use /** @public */ JSDoc tags to mark intentionally exported symbols.

[github-actions]

🚫 Security audit failed

Critical Failures

Check	File	Details
External fetch calls have timeouts	src/lib/query-options.ts:12	fetch() call without a timeout signal — add signal: AbortSignal.timeout(ms)
External fetch calls have timeouts	src/lib/query-options.ts:21	fetch() call without a timeout signal — add signal: AbortSignal.timeout(ms)

Passed (37/38)

• ✅ Auth enforcement on protected routes (per-handler)
• ✅ No dangerous functions (eval, innerHTML, etc.)
• ✅ No hardcoded secrets in source
• ✅ Security headers in next.config.ts
• ✅ Cookie security (httpOnly, sameSite, secure)
• ✅ No sensitive fields in API responses
• ✅ No .env files committed to repo
• ✅ No raw SQL in API routes
• ✅ No fetch/redirect with unvalidated URLs in routes
• ✅ Timing-safe comparison for secret values
• ✅ No raw SQL migration files (schema-first only)
• ✅ Docker container runs as non-root user
• ✅ Public routes match proxy allowlist
• ✅ File delete operations have path traversal defense
• ✅ Password hashing uses Argon2 (not SHA-256/bcrypt)
• ✅ Encrypted columns written via encrypt()
• ✅ TOTP 2FA flow integrity
• ✅ Emergency lockdown flow integrity
• ✅ Scrub & delete (nuke) flow integrity
• ✅ Backup restore flow integrity
• ✅ Login flow integrity
• ✅ Auth result checked before proceeding
• ✅ Backup password inputs bounded before key derivation
• ✅ Webhook delivery fetch uses redirect: "error"
• ✅ SESSION_SECRET minimum-length guard in auth/crypto modules
• ✅ Notification URL validators include SSRF protection
• ✅ Dockerfile does not COPY sensitive files
• ✅ No secret env vars in client components
• ✅ Adapter Cookie headers guard against injection
• ✅ Adapter files do not log credential values
• ✅ No console.log in API routes
• ✅ No TODO/FIXME in security-critical files
• ✅ JSON.parse wrapped in try-catch
• ✅ No swallowed errors in catch blocks
• ✅ Request body size validation on upload routes
• ✅ BigInt fields use string serialization
• ✅ No raw error messages in API responses

---

Summary: 37/38 checks passed
— 1 critical failure(s)

See scripts/security-audit.ts for check definitions and SECURITY.md for the full security architecture.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29924532	Triggered	Generic High Entropy Secret	461589c	src/lib/adapters/mam.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[Copilot]

Pull request overview

Copilot reviewed 199 out of 497 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

src/app/api/upload-image/route.ts:96

• The validation bound now uses IMAGE_EXPIRATION_MAX, but the error message still hardcodes 31536000. Update the message to reflect the actual configured max (ideally interpolating IMAGE_EXPIRATION_MAX) so the client gets accurate guidance if the constant changes.

    if (!Number.isFinite(parsed) || parsed < 0 || parsed > IMAGE_EXPIRATION_MAX) {
      return NextResponse.json(
        { error: "expiration must be a positive number of seconds (max 31536000)" },
        { status: 400 }
      )
    }

src/app/api/tag-groups/route.ts:49

• The limit check uses LONG_STRING_MAX, but the error message still says “500 characters or fewer”. To keep error messages consistent with actual validation (and future changes), interpolate LONG_STRING_MAX in the message or update the copy to match the constant’s value.

  if (typeof description === "string" && description.length > LONG_STRING_MAX) {
    return NextResponse.json(
      { error: "Description must be 500 characters or fewer" },
      { status: 400 }
    )
  }