scriptoriumadmin/veritas-kanban
1
0
Fork 0
mirror of https://github.com/BradGroux/veritas-kanban.git synced 2026-08-28 02:44:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
veritas-kanban/SECURITY-AUDIT.md
Brad Groux 0c0f5b344d security+quality: final codebase review fixes 
Security (critical):
- Remove shell:true from preview-service spawn (command injection fix)
- Replace exec() with execFile() in github-service (no shell interpolation)
- Add SIGKILL fallback after SIGTERM timeout in worktree-service

Stability:
- Add process cleanup handlers (SIGTERM/SIGINT) for preview servers
- Add MAX_PREVIEW_SERVERS=5 limit to prevent resource exhaustion
- Memoize WebSocket context value to prevent unnecessary re-renders

Code quality:
- Remove hardcoded 'Brad' author → 'User' (3 files)
- Replace hardcoded localhost:3001 URLs with API_BASE (AttachmentsSection)
- Fix SECURITY-AUDIT.md date (2025 → 2026)
- Add license/repository/author to all 6 package.json files

Data hygiene:
- Untrack all runtime data files (.veritas-kanban/*.json, telemetry, activity)
- Simplify .gitignore: .veritas-kanban/* except .gitkeep
- Removed ~15,700 lines of runtime data from git history
2026-01-29 06:13:10 -06:00

1.5 KiB
Raw Blame History

Security Audit Report

Last audited: 2026-01-29 Tool: pnpm audit (pnpm 9.15.4) Node version: 22.x

Summary

Severity Count
Critical 0
High 0
Moderate 0
Low 0

Result: No known vulnerabilities found.

Production Dependencies

pnpm audit --prod — Clean. No vulnerabilities in production dependency tree.

All Dependencies (including devDependencies)

pnpm audit — Clean. No vulnerabilities in full dependency tree.

Overrides

The following version overrides are configured in the root package.json to pin patched versions:

Package Override Reason
hono >=4.11.7 Ensures patched version (prior advisory)

Accepted Risks / Suppressions

None at this time. All dependencies are clean.

CI Integration

  • Blocking audit: pnpm audit --prod --audit-level=high — fails the pipeline on high/critical vulnerabilities in production dependencies.
  • Informational audit: pnpm audit — reports all vulnerabilities (including devDependencies) without blocking, for visibility.

Process

  1. Run pnpm audit periodically and before releases
  2. CI automatically blocks merges with high/critical production vulnerabilities
  3. For accepted risks, document in this file with justification and review date
  4. Use pnpm.overrides in root package.json to pin fixed versions when transitive deps lag