fix: remediate critical security findings C1–C6 - #12
Merged
Conversation
Removes ~13k tracked virtualenv and bytecode files that were committed despite .gitignore (SEC audit C4). Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
- Restore CSRF on session APIs; add csrf.js + template meta tags - Bind /v1 user_id to API key owner (IDOR fix) - Fail closed on missing/invalid TOKEN_ENCRYPTION_KEY in production - Disable manual /api/setup_tokens in production - Fix get_db imports to modules.database - Harden cookies, cron methods, dev-login compare, analytics tokens Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
|
Deployment failed for project post-pilot with the following error: Learn More: https://vercel.link/3Fpeeb1 |
ShadowWalkerNC
marked this pull request as ready for review
August 9, 2026 23:13
Simple conflicts combined. Intent conflicts resolved as: - CSRF: protect session APIs; exempt v1/stripe/cron/embed only - setup_tokens: always 410 Gone (OAuth-only, matches Wave A) Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Aug 10, 2026
Resolve simple TODO.md conflict by keeping main Phase-5 structure and linking docs/SECURITY_AUDIT.md (C1–C6 remediations tracked in #12). Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
- Treat only VERCEL_ENV=production as production (preview no longer hard-fails without TOKEN_ENCRYPTION_KEY at import time) - Narrow ruff CI to fatal-error rules; add Fernet key fallback when CI_TOKEN_ENCRYPTION_KEY secret is unset - Fix location_service.py apostrophe SyntaxError that broke py_compile Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
- Merge main (#11 audit doc); resolve TODO.md conflict - vercel.json: daily cron schedules (Hobby rejects hourly/minute) - CI: file-backed SQLite; flake8 F811/F841/F824 cleanups - conftest forces test DB path so :memory: cannot break tokens table Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Nested same-quote f-strings are SyntaxError on 3.11 (CI) though valid on 3.12. Co-authored-by: Nathaniel Cowperthwaite <ShadowWalkerNC@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates critical security findings C1–C6 and unblocks the two failing PR checks (Lint & Test, Vercel).
Security (C1–C6)
X-CSRFToken/v1user_id bound to API key owner (IDOR fix)TOKEN_ENCRYPTION_KEYin production.venv/__pycache__get_dbimports →modules.databasePOST /api/setup_tokens→ permanent410 GoneCI fixes
:memory:); flake8 F811/F841/F824 cleanups; Python 3.11 f-string SyntaxError inmedia_handler.py/location_service.py.DEPLOY.md. OnlyVERCEL_ENV=productionis treated as production so preview deploys do not hard-exit without secrets.Merge
Synced with
main(security audit doc #11).Test plan