fix(security): harden session, CORS, rate limiting, and cache isolation

[lupita-hom]

Automated security scan — 2026-09-07

Dependency audit

npm audit is clean on both workspaces (0 vulnerabilities, client and server). No npm audit fix changes were needed.

Code review findings (all fixed here)

Area	Issue	Fix
Session secret	Production fell back to hardcoded dev-secret-change-in-production — forgeable session cookies	Boot fails unless SESSION_SECRET >= 32 chars in production
Session fixation	Session id reused across the OAuth privilege change	req.session.regenerate() after token exchange; cookie cleared on logout
OAuth CSRF	state compared with !==, not single-use, missing-value not rejected	Constant-time compare, strict type check, single-use state
CORS	Single hardcoded origin, all methods	Validated ALLOWED_ORIGINS allowlist, methods restricted to GET/POST/OPTIONS
Rate limiting	None — upstream GitHub token burnable, OAuth brute-forceable	express-rate-limit: 600/15m API, 30/15m auth
CSP	Disabled entirely	Explicit policy without upgrade-insecure-requests, plus no-referrer + same-origin CORP
Body size	Unbounded JSON/urlencoded bodies	Capped at 100kb
Cache isolation	Keys used an 8-char access-token substring — collision leaks another user's private repo/org data, and leaks token material into cache state	SHA-256 derived per-user namespace applied to every repo/org key; cache capped at 5000 keys
Injection	PR state query param interpolated into upstream GraphQL	Allowlisted to OPEN/CLOSED/MERGED
Input bounds	page, per_page, maxCommits, tzOffset unbounded	Clamped to sane ranges
Cookie	secure: false hardcoded, default connect.sid name	Opt-in COOKIE_SECURE, renamed to gne.sid
Deps	qs transitive	Override pinned to >=6.16.0

trust proxy set to 1 so rate limiting and secure cookies see the real client IP behind one reverse proxy.

Validation

• tsc --noEmit — clean
• server production build — pass
• client production build — pass
• npm audit after changes — 0 vulnerabilities

Operator note

Two new optional env vars are documented in .env.example: ALLOWED_ORIGINS and COOKIE_SECURE. SESSION_SECRET is now mandatory in production — deployments without it will fail to start (intentionally).

🤖 Automated scheduled security scan